buildroot, branch 2017.08.1

Update for 2017.08.1

2017-10-23T21:41:14+00:00

Signed-off-by: Peter Korsgaard

linux-headers: bump 4.{4, 9, 13}.x series

2017-10-22T22:41:33+00:00

[Peter: drop 4.13.x bump] Signed-off-by: Bernd Kuhls Signed-off-by: Peter Korsgaard (cherry picked from commit f7479f4c818f335332fdca128d7d4f3e5e7c02ac) Signed-off-by: Peter Korsgaard

sqlite: add security patches

2017-10-22T22:40:34+00:00

CVE-2017-13685: The dump_callback function in SQLite 3.20.0 allows remote attackers to cause a denial of service (EXC_BAD_ACCESS and application crash) via a crafted file. CVE-2017-15286: SQLite 3.20.1 has a NULL pointer dereference in tableColumnList in shell.c because it fails to consider certain cases where `sqlite3_step(pStmt)==SQLITE_ROW` is false and a data structure is never initialized. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni (cherry picked from commit d3c96bd5a6d3d64ab9c61104c6078b4bc89b12ec) Signed-off-by: Peter Korsgaard

libffi: add patch to fix MIPS support

2017-10-22T22:40:02+00:00

Building Python 3.x on MIPS with musl fails because the libffi code uses a "#ifdef linux" test to decide if we're building on Linux or not. When building with -std=c99, "linux" is not defined, so instead of including , libffi's code tries to include , which doesn't exist on musl. The right fix is to use __linux__, which is POSIX compliant, and therefore defined even when -std=c99 is used. Note that glibc and uClibc were not affected because they do provide a header in addition to the one. Signed-off-by: Mauro Condarelli [Thomas: reformat patch with Git, add a better commit log and description.] Signed-off-by: Thomas Petazzoni (cherry picked from commit 4852f05907cd365825f37c283a415a77ba1fcba9) Signed-off-by: Peter Korsgaard

Add DEPENDENCIES_HOST_PREREQ to the list of packages

2017-10-22T22:39:43+00:00

That way packages included in that list like ccache will also be regarded as a normal packages for targets like external-deps, show-targets or legal-info Signed-off-by: Alfredo Alvarez Fernandez Signed-off-by: Arnout Vandecappelle (Essensium/Mind) (cherry picked from commit 862b76cfefc101943f09db2a73f5519f9a5bb2cb) Signed-off-by: Peter Korsgaard

dependencies: always use HOSTCC_NOCACHE for DEPENDENCIES_HOST_PREREQ

2017-10-22T22:39:21+00:00

Currently, HOSTCC and HOSTCXX are set to their _NOCACHE variants in the 'dependencies' target. This is needed because at that time, ccache is not built yet - host-ccache is one of the dependencies. However, because this override is only specified for the 'dependencies' target (and thereby gets inherited by its dependencies), the override is only applied when the package is reached through the 'dependencies' target. This is not the case when one of DEPENDENCIES_HOST_PREREQ is built directly from the command line, e.g. when doing 'make host-ccache'. So in that case, ccache will be built with ccache... which fails of course. To fix this, directly apply the override to the DEPENCIES_HOST_PREREQ targets. Note that this only fixes the issue for 'make host-ccache', NOT for e.g. 'make host-ccache-configure'. Signed-off-by: Alfredo Alvarez Fernandez [Arnout: improve commit message] Signed-off-by: Arnout Vandecappelle (Essensium/Mind) (cherry picked from commit 36d398ac30f35ca9d4405a9dee2b33560ec3595d) Signed-off-by: Peter Korsgaard

xen: add upstream post-4.9.0 security fix for XSA-245

2017-10-22T22:38:31+00:00

Fixes XA-245: ARM: Some memory not scrubbed at boot https://xenbits.xenproject.org/xsa/advisory-245.html Notice: Not applying XSA-237..244 as they are x86 only and have patch file name conflicts between 2017.02.x and master. Signed-off-by: Peter Korsgaard (cherry picked from commit 90b9b457ecd5e6ebea9d48f36c030b95ca67059b) Signed-off-by: Peter Korsgaard

lame: security bump to version 3.100

2017-10-22T22:37:35+00:00

Fixes the following security issues: CVE-2017-9410: fill_buffer_resample function in libmp3lame/util.c heap-based buffer over-read and ap CVE-2017-9411: fill_buffer_resample function in libmp3lame/util.c invalid memory read and application crash CVE-2017-9412: unpack_read_samples function in frontend/get_audio.c invalid memory read and application crash Drop patches now upstream or no longer needed: 0001-configure.patch: Upstream as mentioned in patch description 0002-gtk1-ac-directives.patch: Upstream as mentioned in patch description/release notes: Resurrect Owen Taylor's code dated from 97-11-3 to properly deal with GTK1. This was transplanted back from aclocal.m4 with a patch provided by Andres Mejia. This change makes it easy to regenerate autotools' files with a simple invocation of autoconf -vfi. 0003-msse.patch: Not needed as -march nowadays implies -msse. With these removed, autoreconf is no longer needed. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni (cherry picked from commit 7e3583dd558925a447eaa4367d659f39482fbbc0) Signed-off-by: Peter Korsgaard

busybox: add upstream post-1.27.2 httpd fix

2017-10-22T22:36:58+00:00

Signed-off-by: Peter Korsgaard (cherry picked from commit ec58149009776f63767644f9a3409f420c271766) Signed-off-by: Peter Korsgaard

busybox: bump to version 1.27.2

2017-10-22T22:36:50+00:00

Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni (cherry picked from commit 5cdb463e442d63f0ba361e7348d0ed56cb9b63d0) Signed-off-by: Peter Korsgaard