buildroot/package/expat, branch 2017.08.1

expat: fix build on and for kernel older than 3.17

2017-07-17T07:06:23+00:00

The expat build system now fails when the getrandom() system call is not supported. This affect both host and target builds. Define XML_POOR_ENTROPY for target kernels older than 3.17 to fix the build. For the host package define XML_POOR_ENTROPY unconditionally since we have no easy way to know the host kernel version. Note that expat will still use getrandom() on the host when it is available, we don't make security any worse. Fixes (host): http://autobuild.buildroot.net/results/928/928dc2b56d931da84055fdfe78929d1f956de53b/ http://autobuild.buildroot.net/results/ee9/ee90d0a456cbce4c7f22e5f61006612bd9ba30d5/ http://autobuild.buildroot.net/results/dac/dac7231242123ae3dcaa6bbdd65b44fe8d8cb20c/ Fixes (target): http://autobuild.buildroot.net/results/308/308e830219fdfebb5aa6aef51c1dc784254998f6/ http://autobuild.buildroot.net/results/73f/73fa946b0a2205e946ad414079f88e4bdb416f00/ http://autobuild.buildroot.net/results/9d7/9d7bad22ace7fa211b31d752a2255e07cede68be/ [Peter: also use HOST_CPPFLAGS] Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

expat: security bump to version 2.2.2

2017-07-16T21:25:54+00:00

Changes (security fixes): [MOX-006] Fix non-NULL parser parameter validation in XML_Parse; resulted in NULL dereference, previously Drop upstream patch. Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

expat: fix patch that doesn't apply properly

2017-06-20T05:40:25+00:00

Fixes: http://autobuild.buildroot.net/results/23f799009ae10c5de2b06a7747a28804818204c2/ Signed-off-by: Thomas Petazzoni

expat: security bump to version 2.2.1

2017-06-19T20:06:03+00:00

Fixes: - CVE-2017-9233 - External entity infinite loop DoS. See: https://libexpat.github.io/doc/cve-2017-9233/ - CVE-2016-9063 -- Detect integer overflow And further more: - Fix regression from fix to CVE-2016-0718 cutting off longer tag names. - Extend fix for CVE-2016-5300 (use getrandom() if available). - Extend fix for CVE-2012-0876 (Change hash algorithm to William Ahern's version of SipHash). Also add an upstream patch to fix detection of getrandom(). Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

expat: add explicit dependencies for host variant

2016-07-03T06:48:05+00:00

Signed-off-by: Julien Floret Signed-off-by: Thomas Petazzoni

expat: security bump to version 2.2.0

2016-06-23T19:11:14+00:00

Fixes: CVE-2016-4472 - Improve insufficient fix to CVE-2015-1283 / CVE-2015-2716 introduced with Expat 2.1.1 CVE-2016-5300 - Use more entropy for hash initialization than the original fix to CVE-2012-0876 CVE-2012-6702 - Resolve troublesome internal call to srand that was introduced with Expat 2.1.0 when addressing CVE-2012-0876 Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

expat: add fix for CVE-2016-0718

2016-05-22T21:06:41+00:00

Fixes: CVE-2016-0718 - The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution. Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

expat: bump to version 2.1.1

2016-03-14T07:48:43+00:00

Drop 0001-fix-CVE-2015-1283.patch since it's upstream. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

expat: add security patch for CVE-2015-1283

2015-09-01T19:56:34+00:00

Fixes: CVE-2015-1283 - Multiple integer overflows in the XML_GetBuffer function. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

package: add hashes for SourceForge-hosted packages

2014-12-28T21:21:16+00:00

Since SourceForge sometimes serves us faulty tarballs, we can tons of autobuild failures: http://autobuild.buildroot.org/results/9fb/9fba5bf086a4e7a29e5f7156ec43847db7aacfc4/ http://autobuild.buildroot.org/results/6c8/6c837b244c45ac3b3a887734a371cd6d226cf216/ ... Fix that by adding hash files for all SourceForge-hosted packages (thos etht did not already have it). We normally prefer to use hashes published by upstream, but hunting them all one by one is a tedious task, so those hashes were all locally computed with a script that searched for SF-hosted packages, downloades the associated tarball, computed the hash, and stored it in the corresponding .hash file. Also, SF publishes sha1 hashes, while I used the stronger sha256, since sha1 is now considered to be relatively weak. Signed-off-by: "Yann E. MORIN" Cc: Peter Korsgaard Cc: Thomas Petazzoni Cc: Maxime Hadjinlian Cc: Richard Braun Cc: Nathaniel Roach Signed-off-by: Thomas Petazzoni