buildroot/package, branch 2017.11.2

package/xen: Force disable SDL for xen-qemu build

2018-01-21T20:19:55+00:00

Fixes autobuilder issue: http://autobuild.buildroot.net/results/8bcb80dc93d38bb38ca32ad93d52c22d1176d57e/ Signed-off-by: Alistair Francis Signed-off-by: Peter Korsgaard (cherry picked from commit a5dd72181e1a79ffe65c788a2c1db9acdf6aa933) Signed-off-by: Peter Korsgaard

rpcbind: Backport fixes to memory leak security fix

2018-01-21T20:18:25+00:00

Commit 954509f added a security fix for CVE-2017-8779, involving pairing all svc_getargs() calls with svc_freeargs() to avoid a memory leak. However it also introduced a couple of issues: - The call to svc_freeargs() from rpcbproc_callit_com() may result in an attempt to free static memory, resulting in undefined behaviour. - A typo in the svc_freeargs() call from pmapproc_dump() causes NIS (aka ypbind) to fail. Backport upstream fixes for these issues to version 0.2.3. Signed-off-by: Ed Blake Signed-off-by: Thomas Petazzoni (cherry picked from commit 5a9a95d0eb15c189f1361c12c105eb0ba8842c77) Signed-off-by: Peter Korsgaard

iputils: fix ping and traceroute6 executable permissions

2018-01-21T20:17:41+00:00

The iputils executables are installed without the setuid bit set, which prevents some programs from working. This patch adds a permission table to fix the permissions of the ping and traceroute6 executables. Signed-off-by: Einar Jon Gunnarsson Signed-off-by: Thomas Petazzoni (cherry picked from commit b0e2d00289eeb1a7201ba49e5cedfd3175f92140) Signed-off-by: Peter Korsgaard

linux-headers: bump 4.{4, 9, 14}.x series

2018-01-21T20:15:50+00:00

[Peter: drop 4.14.x bump] Signed-off-by: Fabio Estevam Signed-off-by: Thomas Petazzoni (cherry picked from commit f8fc447c20745bf851ceba8ac0963439103acb0e) Signed-off-by: Peter Korsgaard

bind: security bump to version 9.11.2-P1

2018-01-21T20:14:37+00:00

Fixes the following security issue: CVE-2017-3145: Improper sequencing during cleanup can lead to a use-after-free error, triggering an assertion failure and crash in named. For more details, see the advisory: https://lists.isc.org/pipermail/bind-announce/2018-January/001072.html Signed-off-by: Peter Korsgaard Signed-off-by: Thomas Petazzoni (cherry picked from commit d72a2b9247d885c4fc5c2ca6066d3ae6a27a8653) Signed-off-by: Peter Korsgaard

linux-firmware: fix install for Chelsio T[45]

2018-01-16T22:24:13+00:00

It's broken since 1c9846ec "linux-firmware: Bump to the latest version" Fix it by updating the name of the file to install. Do not use * since it would install also old versions that would take 1MB extra space in the target. Signed-off-by: Ricardo Martincoski Cc: Peter Korsgaard Cc: Yann E. MORIN Cc: Yegor Yefremov Signed-off-by: Peter Korsgaard

package/ti-cgt-pru: bump to 2.2.1

2018-01-16T19:33:45+00:00

See: http://www.ti.com/tool/download/PRU-CGT-2-2 The ti-cgt-pru v2.1.x installer are affected by a bug with recent distribution (Fedora 27 and Ubuntu 17.10) using kernel 4.13 or 4.14 with a glibc 2.26. The installer is stuck in a futex(wait) system call. While at it, add license hash. Fixes: http://autobuild.buildroot.net/results/68f/68f60ad38d9b6eae83b5d233966616a25d8c9391 Signed-off-by: Romain Naour Cc: Ash Charles Cc: Matthew Weber Tested-by: Matt Weber Signed-off-by: Thomas Petazzoni (cherry picked from commit 0e162b932d67668a4f075da803efb62b01ec917d) Signed-off-by: Peter Korsgaard

mcookie: correct wrong memset argument

2018-01-16T18:45:05+00:00

Fixes #10216 Building mcookie generates a warning about possible wrong arguments to memset: mcookie.c:207:26: warning: argument to ‘sizeof’ in ‘memset’ call is the same expression as the destination; did you mean to dereference it? [-Wsizeof-pointer-memaccess] memset(ctx, 0, sizeof(ctx)); /* In case it's sensitive */ ctx is a pointer to a structure, so the code should use the size of the structure and not the size of the pointer when it tries to clear the structure, similar to how it got fixed upstream back in 2009: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/lib/md5.c?id=6596057175c6ed342dc20e85eae8a42eb29b629f Signed-off-by: Peter Korsgaard (cherry picked from commit 40f4191f2a1246b792ffc0c02b6c9bd2d62649f2) Signed-off-by: Peter Korsgaard

lz4: install programs as well as libraries

2018-01-16T18:44:55+00:00

Prior to commit 8ad38a4fc2007df4bee9a941aed46c8771b6a84c ("package/lz4: bump version to r131"), the lz4 package was installing both libraries and programs, but this commit changed the behavior to only install libraries. The contributor might have been confused by the fact that the build command was "$(MAKE) ... -C $(@D) liblz4", suggesting that only the library was built. But since the install command was "$(MAKE) ... -C $(@D) install", the programs were effectively built as part of the install step, and installed as well. Since it makes sense for lz4 to also installs its programs, this commit adjusts the package accordingly. It is worth mentioning that using the "all" target during the build step is important. Indeed, otherwise the programs/Makefile has a "default" target that doesn't build everything (especially the lz4c program) and it end up being built as part of the install step, due to how the makefile dependencies are handled in the lz4 project. To make sure that everything gets built during the build step, we explicitly use the "all" target. Fixes bug #9996 Reported-by: Jamin Collins Initial-analysis-by: Arnout Vandecappelle Signed-off-by: Thomas Petazzoni Signed-off-by: Peter Korsgaard (cherry picked from commit 6f1c11f79a64387c1f1749550804f8aae0cfa7a7) Signed-off-by: Peter Korsgaard

busybox: don't remove S01logging when CONFIG_SYSLOGD is disabled

2018-01-16T18:43:50+00:00

The current busybox.mk explicitly removes S01logging if CONFIG_SYSLOGD is disabled in the Busybox configuration. However: - This causes the removal of the S01logging script potentially installed by another package (currently syslog-ng, rsyslog and sysklogd can all install a S01logging script). - We generally don't try to clean-up stuff that we may have installed in a previous make invocation and that is no longer needed following a configuration change. Fixes bug #10176 Reported-by: Karl Krach Fix-provided-by: Karl Krach Signed-off-by: Thomas Petazzoni (cherry picked from commit 84e835ea9261b3e844f1a18489dd89253e3eb839) Signed-off-by: Peter Korsgaard