summaryrefslogtreecommitdiffstats
path: root/package/spice
Commit message (Collapse)AuthorAgeFilesLines
* spice: add upstream security fixes for CVE-2017-7506Peter Korsgaard2017-07-143-0/+154
| | | | | | | | | | | Fixes CVE-2017-7506 - Possible buffer overflow via invalid monitor configurations. For more details, see: https://marc.info/?l=oss-security&m=150001782924095 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* spice: add post-0.12.8 upstream security fixesPeter Korsgaard2017-06-223-0/+136
| | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2016-9577 Frediano Ziglio of Red Hat discovered a buffer overflow vulnerability in the main_channel_alloc_msg_rcv_buf function. An authenticated attacker can take advantage of this flaw to cause a denial of service (spice server crash), or possibly, execute arbitrary code. CVE-2016-9578 Frediano Ziglio of Red Hat discovered that spice does not properly validate incoming messages. An attacker able to connect to the spice server could send crafted messages which would cause the process to crash. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: security bump to version 0.12.8Peter Korsgaard2017-06-222-24/+2
| | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2016-0749: The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow. CVE-2016-2150: SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261. The pyparsing check has been dropped from configure, and the spice protocol definition is again included, so the workarounds can be removed. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: security bump to version 0.12.6Peter Korsgaard2017-06-223-57/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2015-3247: Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors. CVE-2015-5260: Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL commands related to the surface_id parameter. CVE-2015-5261: Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface creation. Client/gui support is gone upstream (moved to spice-gtk / virt-viewer), so add Config.in.legacy handling for them. Lz4 is a new optional dependency, so handle it. The spice protocol definition is no longer included and instead used from spice-protocol. The build system uses pkg-config --variable=codegendir to find the build time path of this, which doesn't take our STAGING_DIR prefix into consideration, so it needs some help. The installed protocol definition will likewise be newer than the generated files, so we need to workaround that to ensure they are not regenerated (which needs host python / pyparsing). Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: bump to version 0.12.5Peter Korsgaard2017-06-224-58/+36
| | | | | | | | | | | | | | | | | | | | | | | Tunneling support is gone upstream, so drop the patch and add Config.in.legacy handling for the option. Celt051 is no longer a hard dependency, and opus is a new optional dependency, so adjust the dependencies to match. Python / pyparsing are not needed as the tarball contains the generated files (this should presumably have been host-python in the first place as these are used at build time), but we need a small workaround to convince configure that they really aren't needed. Alsa-lib is only needed for client support, and the configure script checks for X11/Xext/Xrender, so adjust the dependencies to match. A user manual is now generated by default if asciidoc is available, so explicitly disable that. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package makefiles: clean up backslash spacing.Adam Duskett2017-04-221-12/+12
| | | | | | | | | | The check-package script when ran gave warnings on only using one space before backslashes on all of these makefiles. This patch cleans up all warnings related to the one space before backslashes rule in the make files in the package directory. Signed-off-by: Adam Duskett <aduskett@codeblue.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package: remove trailing backslashRicardo Martincoski2017-04-061-2/+2
| | | | | | | | | | | Occurrences were searched using [1]: check-package --include-only TrailingBackslash $(find * -type f) and manually removed. [1] http://patchwork.ozlabs.org/patch/729669/ Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boot, package: use SPDX short identifier for LGPLv2.1/LGPLv2.1+Rahul Bedarkar2017-04-011-1/+1
| | | | | | | | | | | We want to use SPDX identifier for license string as much as possible. SPDX short identifier for LGPLv2.1/LGPLv2.1+ is LGPL-2.1/LGPL-2.1+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/LGPLv2.1(\+)?/LGPL-2.1\1/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/spice: depend on libglib2Bernd Kuhls2016-02-211-0/+1
| | | | | | | | | | The package selects BR2_PACKAGE_LIBGLIB2 but did not depend on it. The buildsystem treats libglib2 as a hard-dependency: https://cgit.freedesktop.org/spice/spice/tree/configure.ac?h=0.12#n117 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* spice: arch-mask toolchain commentGustavo Zacarias2016-02-171-0/+1
| | | | | | | | Otherwise it shows up for other architectures with minimal toolchains giving the impression that it's available/tested. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: add hash fileGustavo Zacarias2015-07-161-0/+2
| | | | Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
* package/*: rename patches according to the new policyPeter Korsgaard2015-02-031-0/+0
| | | | | | | Autogenerated from rename-patch.py (http://patchwork.ozlabs.org/patch/403345) Signed-off-by: Samuel Martin <s.martin49@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Rename BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBSThomas Petazzoni2014-12-111-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Since a while, the semantic of BR2_PREFER_STATIC_LIB has been changed from "prefer static libraries when possible" to "use only static libraries". The former semantic didn't make much sense, since the user had absolutely no control/idea of which package would use static libraries, and which packages would not. Therefore, for quite some time, we have been starting to enforce that BR2_PREFER_STATIC_LIB should really build everything with static libraries. As a consequence, this patch renames BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS, and adjust the Config.in option accordingly. This also helps preparing the addition of other options to select shared, shared+static or just static. Note that we have verified that this commit can be reproduced by simply doing a global rename of BR2_PREFER_STATIC_LIB to BR2_STATIC_LIBS plus adding BR2_PREFER_STATIC_LIB to Config.in.legacy. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
* package: indentation cleanupJerzy Grzegorek2014-11-021-1/+1
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: indentation cleanupJerzy Grzegorek2014-10-251-8/+8
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package: indentation cleanupJerzy Grzegorek2014-10-251-5/+5
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* .mk files: bulk aligment and whitespace cleanup of assignmentsThomas De Schampheleire2014-10-071-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Buildroot coding style defines one space around make assignments and does not align the assignment symbols. This patch does a bulk fix of offending packages. The package infrastructures (or more in general assignments to calculated variable names, like $(2)_FOO) are not touched. Alignment of line continuation characters (\) is kept as-is. The sed command used to do this replacement is: find * -name "*.mk" | xargs sed -i \ -e 's#^\([A-Z0-9a-z_]\+\)\s*\([?:+]\?=\)\s*$#\1 \2#' -e 's#^\([A-Z0-9a-z_]\+\)\s*\([?:+]\?=\)\s*\([^\\]\+\)$#\1 \2 \3#' -e 's#^\([A-Z0-9a-z_]\+\)\s*\([?:+]\?=\)\s*\([^\\ \t]\+\s*\\\)\s*$#\1 \2 \3#' -e 's#^\([A-Z0-9a-z_]\+\)\s*\([?:+]\?=\)\(\s*\\\)#\1 \2\3#' Brief explanation of this command: ^\([A-Z0-9a-z_]\+\) a regular variable at the beginning of the line \([?:+]\?=\) any assignment character =, :=, ?=, += \([^\\]\+\) any string not containing a line continuation \([^\\ \t]\+\s*\\\) string, optional whitespace, followed by a line continuation character \(\s*\\\) optional whitespace, followed by a line continuation character Hence, the first subexpression handles empty assignments, the second handles regular assignments, the third handles regular assignments with line continuation, and the fourth empty assignments with line continuation. This expression was tested on following test text: (initial tab not included) FOO = spaces before FOO = spaces before and after FOO = tab before FOO = tab and spaces before FOO = tab after FOO = tab and spaces after FOO = spaces and tab after FOO = \ FOO = bar \ FOO = bar space \ FOO = \ GENIMAGE_DEPENDENCIES = host-pkgconf libconfuse FOO += spaces before FOO ?= spaces before and after FOO := FOO = FOO = FOO = FOO = $(MAKE1) CROSS_COMPILE=$(TARGET_CROSS) -C AT91BOOTSTRAP3_DEFCONFIG = \ AXEL_DISABLE_I18N=--i18n=0 After this bulk change, following manual fixups were done: - fix line continuation alignment in cegui06 and spice (the sed expression leaves the number of whitespace between the value and line continuation character intact, but the whitespace before that could have changed, causing misalignment. - qt5base was reverted, as this package uses extensive alignment which actually makes the code more readable. Finally, the end result was manually reviewed. Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Cc: Yann E. Morin <yann.morin.1998@free.fr> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* packages: rename FOO_CONF_OPT into FOO_CONF_OPTSThomas De Schampheleire2014-10-041-8/+8
| | | | | | | | | | | | To be consistent with the recent change of FOO_MAKE_OPT into FOO_MAKE_OPTS, make the same change for FOO_CONF_OPT. Sed command used: find * -type f | xargs sed -i 's#_CONF_OPT\>#&S#g' Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package: remove the trailing slash sign from <PKG>_SITE variableJerzy Grzegorek2014-07-311-1/+1
| | | | | | | | | | | | Since the trailing slash is stripped from $($(PKG)_SITE) by pkg-generic.mk: $(call DOWNLOAD,$($(PKG)_SITE:/=)/$($(PKG)_SOURCE)) so it is redundant. This patch removes it from $(PKG)_SITE variable for BR consistency. Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* cegui06: need dynamic library supportThomas Petazzoni2014-02-261-0/+4
| | | | | | | | | Fixes: http://autobuild.buildroot.org/results/caf/caf421629f4465cd347dc40af0b559c4d9b0c09f/ Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* spice: bump to version 0.12.4Axel Lin2013-12-123-1/+35
| | | | | | | | | According to the ChangeLog, spice needs glib2 since 0.12.2. Thus add libglib2 dependency to fix build error if !BR2_PACKAGE_LIBGLIB2. Also add a patch to fix trivial build error. Signed-off-by: Axel Lin <axel.lin@ingics.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Config.in files: whitespace cleanupThomas De Schampheleire2013-11-111-2/+2
| | | | | | | | | | This patch fixes the following whitespace problems in Config.in files: - trailing whitespace - spaces instead of tabs for indentation - help text not indented with tab + 2 spaces Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Config.in files: unify comments of toolchain option dependenciesThomas De Schampheleire2013-10-141-1/+1
| | | | | | | | This patch lines up the comments in Config.in files that clarify which toolchain options the package depends on. Signed-off-by: Thomas De Schampheleire <thomas.de.schampheleire@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Normalize separator size to 80Alexandre Belloni2013-06-061-2/+2
| | | | | Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* Convert headers to lower case when relevantAlexandre Belloni2013-06-061-1/+1
| | | | | Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* spice: entire client support needs C++/threads, not just start dialog guiPeter Korsgaard2013-01-011-4/+4
| | | | | | Fixes http://autobuild.buildroot.net/results/230e6d78e3ec740a7794316cc388c6685e040946 Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: don't enable GUI if dependencies not metYann E. MORIN2012-12-261-0/+6
| | | | | | | | | | | | | | The spice GUI selects unconditionally selects cegui06, but cegui06 requires threads and C++, so spice GUI must also depend on threads and C++. Fixes: http://autobuild.buildroot.net/results/37f8ee90bb4348db97daef83493005c42a193b91/ Merry X-Mas! ;-) [Peter: add SPICE_CLIENT dependency] Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: Only builds on x86Maxime Ripard2012-12-171-0/+2
| | | | | | | | | | | The spice configure script explicitly checks for x86 or x86-64, so disable it on other architectures Fixes http://autobuild.buildroot.org/results/7f7e2d46542a685b93211f76ad063f8b2ba7b5e5/build-end.log Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: enable slirp supportYann E. MORIN2012-12-162-1/+14
| | | | | Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: enable GUIYann E. MORIN2012-12-162-1/+15
| | | | | Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: enable clientYann E. MORIN2012-12-162-1/+20
| | | | | Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
* package/spice: new packageYann E. MORIN2012-12-162-0/+85
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
OpenPOWER on IntegriCloud