The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes
a NULL pointer dereference and crash when reading crafted input that
triggers assignment of a NULL value within an asn1_node structure. It
may lead to a remote denial of service attack.
References:
https://nvd.nist.gov/vuln/detail/CVE-2017-10790http://git.savannah.gnu.org/gitweb/?p=libtasn1.git;a=commit;
h=d8d805e1f2e6799bb2dff4871a8598dc83088a39
(From OE-Core rev: 6176151625c971de031e14c97601ffd75a29772f)
(From OE-Core rev: 649f78102222ec156d490968c13d3222379a1956)
Signed-off-by: Yue Tao <Yue.Tao@windriver.com>
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-Do-not-add-cli-args.h-to-cli-args.stamp-Makefile-tar.patch, it's merged upstream.
Rebase 0001-configure.ac-fix-sed-command.patch.
(From OE-Core rev: bed7c85e9ed77ae961c4588d4f7eca6b20d2f1e8)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removed the following Backported patches:
1. 0001-configure-don-t-add-Werror-to-build-flags.patch
2. 0002-ASN.y-corrected-compiler-warning.patch
3. 0003-parser_aux-corrected-potential-null-pointer-derefere.patch
4. 0004-tools-eliminated-compiler-warnings.patch
fixed the following build error with musl
...
| from ../../libtasn1-4.10/gl/getopt.c:28:
| ./stdint.h:89:5: error: #if with no expression
| #if
| ^
(From OE-Core rev: 70138279e4f4da74cd63402d7201c74ab2528fa8)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This fixes a potential pollution by the build host and build error
when yacc isn't installed on the build host:
| ../../libtasn1-4.9/build-aux/ylwrap: line 175: yacc: command not found
| Makefile:1116: recipe for target 'ASN1.c' failed
| make[3]: *** [ASN1.c] Error 127
(From OE-Core rev: 1135024502bb120c331e065f4c441d6a3efb6d4f)
Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Specify whether to use libseccomp or not. Do not
just let configure check for it.
(From OE-Core rev: 62cc91e8831c72e9beceff13ad68dd69298135b5)
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Do not reference unavailable system calls when
building for ARM_EABI.
(From OE-Core rev: 67f0094af624866f02e7fb0173c335a7e8942921)
Signed-off-by: Joe Slater <jslater@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
when using clang, configure it poking at build host
if we do not use it then it falls back to sysroot
which is what we need here.
(From OE-Core rev: ee0b0da237c1661f43e27e26e0ab24b7d8ed174f)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add a 0001-Do-not-add-cli-args.h-to-cli-args.stamp-Makefile-tar.patch
to fix a compile issue (incorrect creation of an empty header).
Add a libunistring dependency as gnutls has gained it.
(From OE-Core rev: b2ec343ad770c26f39f3a6d335e4bb3ccbf41aec)
(From OE-Core rev: 84c6a3bcf44950049bba255075177a0004058a44)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
getVar() now defaults to expanding by default, thus remove the True
option from getVar() calls with a regex search and replace.
Search made with the following regex: getVar ?\(( ?[^,()]*), True\)
(From OE-Core rev: 7c552996597faaee2fbee185b250c0ee30ea3b5f)
Signed-off-by: Joshua Lock <joshua.g.lock@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove backported 0001-Use-correct-include-dir-with-minitasn.patch and
CVE-2016-7444.patch (which still applied silently and incorrectly:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=10450).
(From OE-Core rev: 118b7233721c374314b9ceca5a101e772a29d8c3)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Previously the OCSP certificate check wouldn't verify the serial
length and could succeed in cases it shouldn't (CVE-2016-7444).
(From OE-Core rev: d7e97992befd3fa5c1c6616652a3aa723d08c531)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Current release has relocations in .text on x86. Silence the
warning for now: Upcoming release should have a real fix.
[YOCTO #10290]
(From OE-Core rev: a55a20aea2128d777630a1c6d946f4434b18a227)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
gtk-doc also requires --enable-doc, so that is no longer configurable.
(From OE-Core rev: 32dd42e8930bf38abf280e04b4ee22c9a9a2fae9)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These patches are backported from master to fix issues raised by clang
compiler.
(From OE-Core rev: 6e3ff002e1a24936acb20dd209ea758c065cc16a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
4.8 -> 4.9
(From OE-Core rev: 7ad0009d9282bd2af15b8b5d26a20a321cab0a32)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove no longer supported --disable-crywrap option.
Add a checksum for the LICENSE file with licensing overview.
(From OE-Core rev: e8ef5912aac0104d9a47d6d10a95e64426d8840e)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Version 3.4.10 (released 2016-03-03)
** libgnutls: Eliminated issues preventing buffers more than 2^32 bytes
to be used with hashing functions.
** libgnutls: Corrected leaks and other issues in gnutls_x509_crt_list_import().
** libgnutls: Fixes in DSA key handling for PKCS #11. Report and patches
by Jan Vcelak.
** libgnutls: Several fixes to prevent relying on undefined behavior of C
(found with libubsan).
* Version 3.4.11 (released 2016-04-11)
** libgnutls: Fixes in gnutls_record_get/set_state() with DTLS. Reported
by Fridolin Pokorny.
** libgnutls: Fixes in DSA key generation under PKCS #11. Report and patches
by Jan Vcelak.
** libgnutls: Corrected behavior of ALPN extension parsing during session
resumption. Report and patches by Yuriy M. Kaminskiy.
** libgnutls: Corrected regression (since 3.4.0) in gnutls_server_name_set()
which caused it not to accept non-null-terminated hostnames. Reported
by Tim Ruehsen.
** libgnutls: Corrected printing of the IP Adress name constraints.
** ocsptool: use HTTP/1.0 for requests. This avoids issue with servers
serving chunk encoding which ocsptool doesn't support. Reported by Thomas
Klute.
** certtool: do not require a CA for OCSP signing tag. This follows the
recommendations in RFC6960 in 4.2.2.2 which allow a CA to delegate OCSP
signing to another certificate without requiring it to be a CA. Reported
by Thomas Klute.
(From OE-Core rev: a41d0ba222b5f0542cb39fe0dcaae1b72cd47e35)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
4.7 -> 4.8
(From OE-Core rev: 5bf69b1253ae82e85b1d550ce00d0708ee3c016b)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This version fixes bugs in the current stable branch.
* Version 3.4.9 (released 2016-02-03)
** libgnutls: Corrected ALPN protocol negotiation. Before GnuTLS would
negotiate the last commonly supported protocol, rather than the
first. Reported by Remi Denis-Courmont (#63).
** libgnutls: Tolerate empty DN fields in informational output
functions.
** libgnutls: Corrected regression causes by incorrect fix in
gnutls_x509_ext_export_key_usage() at 3.4.8 release.
** API and ABI modifications:
No changes since last version.
(From OE-Core rev: 6708665b4d72e1c56021a73f99e02657c5600c88)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libidn (Internationalized Domain Name support library) may not be
desired in all cases, so add a PACKAGECONFIG option to control it.
Allow --enable-doc, libtasn1 internal -vs- external (still internal
by default) and p11-kit support to be controlled via PACKAGECONFIG
too.
(From OE-Core rev: cdce5b95fef7a557333c220ad40b7341cbe2624a)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuTLS depends on gmp. The dependency is usually satisfied indirectly
via nettle, but for correctness make it explicit in the gnutls recipe.
(From OE-Core rev: 584aba196c31520da7a9ece6d1b99442bbb3bd39)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Reordering, plus combine two LDFLAGS_append_libc-uclibc lines into one.
(From OE-Core rev: b21aeb4ac8a5a392234deaa2c0400c6f1a39b871)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
uclibc has its own implementation for libargp
(From OE-Core rev: 5aea684689662d8cb0387f7268e1e69fd4bf0122)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libidn is needed by the new version to compare hostnames.
Openssl compatibility is no longer enabled by default, but is
required by other packages in oe-core.
(From OE-Core rev: 08fb2a4c2eaabdb2944cefefed51d1b95aedbde1)
Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
4.5 -> 4.7
(From OE-Core rev: bbd0c4d6ac2614486042225312149d32f653955b)
Signed-off-by: Maxin B. John <maxin.john@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remains enabled by default, no functional change.
(From OE-Core rev: b7c5e813011f30b33702d8d2fbff3bdbd61be742)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
AC_LIB_HAVE_LINKFLAGS can sometimes find host libs and is therefore not
robust when cross-compiling. Remove it for zlib and use PKG_CHECK_MODULES
instead.
(From OE-Core rev: 78a0e916882a747c267808c08ab8bc615198b5a8)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The default search path in sysroot is sufficient to find zlib, so the
--with-libz-prefix configure option seems to be unnecessary.
For target builds, relying on sysroot also prevents an absolute path
from being hardcoded in the gnutls.pc pkg-config file.
(From OE-Core rev: 7a800bfeb6c8c83ee7cc74739f496982cd71c8e8)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
update to 3.3.12 to fix some bugs.
http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7967
(From OE-Core rev: 894edb243a984654bb929bbbaf299d89167801f1)
Signed-off-by: Bian Naimeng <biannm@cn.fujitsu.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The "sed 's/.bak//g'" matchs "bitbake", which would cause strange errors
when the S contains "bitbake", fix to "sed 's/\.bak$//'`"
(From OE-Core rev: 51a12be7104bc3925b700597c6d52238c0fc5044)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
It works well now, and bump the PR to avoid:
configure: error: source directory already configured; run "make distclean" there first
(From OE-Core rev: 84f4be762fbf044cfe76de4929e1101357feecef)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
this also includes a fix for CVE-2014-8564.
see http://www.gnutls.org/security.html for CVE-2014-3566 "POODLE" statement.
(From OE-Core rev: 60e4c6ca148e736c947477da4ddcb5e7fdfb94f1)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Disable tpm to solve following error:
.../usr/lib64/libtspi.la: No such file or directory
trousers isn't an oe-core recipe, disable it for now.
(From OE-Core rev: f735a540d2bf489547aede0745e34174c39c71bd)
Signed-off-by: Chong Lu <Chong.Lu@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Avoids WARNING: QA Issue: gnutls-bin rdepends on libidn but its not a build dependency? [build-deps]
(From OE-Core rev: 6fd51f5c15a380eae630fe853ba0eccde7b9a369)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bump version to 4.0
(From OE-Core rev: b4b52af3781b2c32b78b8a897a027bc51e056016)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Bump version to 3.3.5
(From OE-Core rev: daa99947cb03d9e1a7d6c2c2fa71ab0399209689)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Removes not needed or already merged patches.
Removes unused configure flags.
Tells gnutls to use the included libopts.
Removes libextra (not needed since 3.0.5).
(From OE-Core rev: 4e360033579b9501449798b2d118f786816a557f)
Signed-off-by: Valentin Popa <valentin.popa@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The class itself currently does nothing. The idea is to mark all recipes that
make use of the texinfo utilities. In the future, this class could be used to
suppress the generation/formatting of documentation for performance,
explicitly track dependencies on these utilities, and eliminate Yocto's
current dependency on the host system's texinfo utilities.
(From OE-Core rev: e6fb2f9afe2ba6b676c46d1eb297ca9cc532d405)
Signed-off-by: Max Eliaser <max.eliaser@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Otherwise we end up with missing symbols from libpthread
(From OE-Core rev: 9f09353a1548d392a3f71e800be8e1b849960584)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Yue Tao
Alexander Kanavin
Maxin B. John
Patrick Ohly
Joe Slater
Khem Raj
Joshua Lock
Jussi Kukkonen
Andre McCurdy
Bian Naimeng
Robert Yang
Armin Kuster
Chong Lu
Tudor Florea
Richard Purdie
Maxin B. John
Valentin Popa
Max Eliaser