buildroot/package/expat, branch 2017.11

expat: bump to version 2.2.4

2017-09-06T20:42:14+00:00

Upstream migrated to automake for autotools: the "installlib" target no longer exist, and we can use the standard "install" target, and therefore drop the special INSTALL_STAGING_OPTS and INSTALL_TARGET_OPTS variables. Add license hash. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

expat: bump to version 2.2.3

2017-08-09T21:51:21+00:00

Drop the XML_POOR_ENTROPY workaround. Upstream commit fd9581a34e5665 (Never require XML_POOR_ENTROPY for "./configure && make") fixes this issue. Signed-off-by: Baruch Siach Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

expat: fix build on and for kernel older than 3.17

2017-07-17T07:06:23+00:00

The expat build system now fails when the getrandom() system call is not supported. This affect both host and target builds. Define XML_POOR_ENTROPY for target kernels older than 3.17 to fix the build. For the host package define XML_POOR_ENTROPY unconditionally since we have no easy way to know the host kernel version. Note that expat will still use getrandom() on the host when it is available, we don't make security any worse. Fixes (host): http://autobuild.buildroot.net/results/928/928dc2b56d931da84055fdfe78929d1f956de53b/ http://autobuild.buildroot.net/results/ee9/ee90d0a456cbce4c7f22e5f61006612bd9ba30d5/ http://autobuild.buildroot.net/results/dac/dac7231242123ae3dcaa6bbdd65b44fe8d8cb20c/ Fixes (target): http://autobuild.buildroot.net/results/308/308e830219fdfebb5aa6aef51c1dc784254998f6/ http://autobuild.buildroot.net/results/73f/73fa946b0a2205e946ad414079f88e4bdb416f00/ http://autobuild.buildroot.net/results/9d7/9d7bad22ace7fa211b31d752a2255e07cede68be/ [Peter: also use HOST_CPPFLAGS] Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

expat: security bump to version 2.2.2

2017-07-16T21:25:54+00:00

Changes (security fixes): [MOX-006] Fix non-NULL parser parameter validation in XML_Parse; resulted in NULL dereference, previously Drop upstream patch. Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

expat: fix patch that doesn't apply properly

2017-06-20T05:40:25+00:00

Fixes: http://autobuild.buildroot.net/results/23f799009ae10c5de2b06a7747a28804818204c2/ Signed-off-by: Thomas Petazzoni

expat: security bump to version 2.2.1

2017-06-19T20:06:03+00:00

Fixes: - CVE-2017-9233 - External entity infinite loop DoS. See: https://libexpat.github.io/doc/cve-2017-9233/ - CVE-2016-9063 -- Detect integer overflow And further more: - Fix regression from fix to CVE-2016-0718 cutting off longer tag names. - Extend fix for CVE-2016-5300 (use getrandom() if available). - Extend fix for CVE-2012-0876 (Change hash algorithm to William Ahern's version of SipHash). Also add an upstream patch to fix detection of getrandom(). Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni

expat: add explicit dependencies for host variant

2016-07-03T06:48:05+00:00

Signed-off-by: Julien Floret Signed-off-by: Thomas Petazzoni

expat: security bump to version 2.2.0

2016-06-23T19:11:14+00:00

Fixes: CVE-2016-4472 - Improve insufficient fix to CVE-2015-1283 / CVE-2015-2716 introduced with Expat 2.1.1 CVE-2016-5300 - Use more entropy for hash initialization than the original fix to CVE-2012-0876 CVE-2012-6702 - Resolve troublesome internal call to srand that was introduced with Expat 2.1.0 when addressing CVE-2012-0876 Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

expat: add fix for CVE-2016-0718

2016-05-22T21:06:41+00:00

Fixes: CVE-2016-0718 - The Expat XML parser mishandles certain kinds of malformed input documents, resulting in buffer overflows during processing and error reporting. The overflows can manifest as a segmentation fault or as memory corruption during a parse operation. The bugs allow for a denial of service attack in many applications by an unauthenticated attacker, and could conceivably result in remote code execution. Signed-off-by: Gustavo Zacarias Signed-off-by: Thomas Petazzoni

expat: bump to version 2.1.1

2016-03-14T07:48:43+00:00

Drop 0001-fix-CVE-2015-1283.patch since it's upstream. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard