summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* bind: update to 9.11.36yocto-3.1.15dunfell-23.0.15Ralph Siemsen2022-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | Security Fixes The lame-ttl option controls how long named caches certain types of broken responses from authoritative servers (see the security advisory for details). This caching mechanism could be abused by an attacker to significantly degrade resolver performance. The vulnerability has been mitigated by changing the default value of lame-ttl to 0 and overriding any explicitly set value with 0, effectively disabling this mechanism altogether. ISC's testing has determined that doing that has a negligible impact on resolver performance while also preventing abuse. Administrators may observe more traffic towards servers issuing certain types of broken responses than in previous BIND 9 releases, depending on client query patterns. (CVE-2021-25219) ISC would like to thank Kishore Kumar Kothapalli of Infoblox for bringing this vulnerability to our attention. [GL #2899] (From OE-Core rev: 8906aa9ec0a80b0f8998fb793f4e9491b3179179) Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* perf-tests: add bash into RDEPENDS (v5.12-rc5+)Bruce Ashfield2022-03-111-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Upstream commit: commit 1dc481c0b0cf18d3952d93a73c4ece90dec277f0 Author: Leo Yan <leo.yan@linaro.org> Date: Sat Mar 20 18:45:54 2021 +0800 perf test: Change to use bash for daemon test When executing the daemon test on Arm64 and x86 with Debian (Buster) distro, both skip the test case with the log: Changes tools/perf/tests/shell/daemon.sh to be explicitly bash (it was already required, but was just skipped on various distros). We add it into our RDEPENDS for perf-tests to fixup 5.12+ builds. We already have relatively heavy RDEPENDS for perf tests (python3), so adding bash into the RDEPENDS isn't signifcant even for older perf builds that use the same recipe. (cherry picked from commit 159cdb159ad0e9d3ed73cfc07f9acd5c0b608e7b) (From OE-Core rev: 0cfc604b48155ed4129bcc056610f32caf1a93b4) Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* tiff: Add backports for two CVEs from upstreamsana kazi2022-03-113-0/+60
| | | | | | | | | | | | | Based on commit from master (From OE-Core rev: a5bb7cc568d5da3633f3854295b0ebe46a2dd863) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 6ae14b4ff7a655b48c6d99ac565d12bf8825414f) Signed-off-by: Sana Kazi <Sana.Kazi@kpit.com> Signed-off-by: Sana Kazi <sanakazisk19@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* vim: Update to 8.2.4524 for further CVE fixesRichard Purdie2022-03-111-2/+2
| | | | | | | | | | | Includes CVE-2022-0696, CVE-2022-0714, CVE-2022-0729. (From OE-Core rev: b7fa41cda88bffa5345d5b9768774cdf28f62b7b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 0d29988958e48534a0076307bb2393a3c1309e03) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* sstate: inside the threadedpool don't write to the shared localdataJose Quaresma2022-03-111-1/+1
| | | | | | | | | | | | | | When inside the threadedpool we make a copy of the localdata to avoid some race condition, so we need to use this new localdata2 and stop write the shared localdata. (From OE-Core rev: 604146a242c3d5f5a9872bb756910f4bd1b58406) Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 90fe6948a9df0b43c58120a9358adb3da1ceb5b9) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* systemd: Ensure uid/gid ranges are set deterministicallyRichard Purdie2022-03-111-0/+2
| | | | | | | | | | | | | | meson.build will fall back to greping /etc/login.defs for values of these if they're not set. Different distros set them (Centos 7/8 does, Ubuntu does not) so output was not deterministic. Avoid this by setting to the default values. We now match the vaules from login.defs from shadow. (From OE-Core rev: 56f57c70fb87beb9a7181df8cb5e7a4a0b5a184a) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 77a6ac0ac266d71e4fe67fd332662081f30cd7bf) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* asciidoc: update git repositoryRoss Burton2022-03-111-1/+1
| | | | | | | | | The asciidoc-py3 repository has been renamed to asciidoc-py. (From OE-Core rev: 6b899f694ec57bb3c6254d59ac5c51378579c014) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: Bump version for 3.1.15 releaseSteve Sakoman2022-03-101-1/+1
| | | | | | | (From meta-yocto rev: b835745e548e81255b78650a433ea14858efe603) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* poky.conf: update tested distrosLee Chee Yang2022-03-101-0/+3
| | | | | | | | | add fedora-35, opensuseleap-15.3 and almalinux-8.5 (From meta-yocto rev: 70ef17e11efa774e8b756b4bf3b428f3e010c1c5) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* linux-yocto: update genericx86* to v5.4.178Steve Sakoman2022-03-101-4/+4
| | | | | | | (From meta-yocto rev: 72167ca6e94601773e708741a5914c639317a267) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* docs: fix hardcoded link warning messagesMichael Opdenacker2022-03-097-13/+13
| | | | | | | | | | | | | Sphinx complains about hardcoded links which can be replaced by an extlink. So let's apply its recommendations. (From yocto-docs rev: f550001f32157c7c30cf5506f3da783c0fd96396) Signed-off-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Reported-by: Quentin Schulz <foss+yocto@0leil.net> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* ref-system-requirements.rst: update list of supported distrosSteve Sakoman2022-03-091-0/+5
| | | | | | | | | | Add AlmaLinux 8.5, Fedora 35, and OpenSUSE Leap 15.3 (From yocto-docs rev: 0a5d6189eed86a9fafdae906187d693a50831f1c) Signed-off-by: Steve Sakoman <steve@sakoman.com> Reviewed-by: Michael Opdenacker <michael.opdenacker@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uninative: Upgrade to 3.5Michael Halstead2022-03-091-5/+5
| | | | | | | | | | | | Add support for glibc 2.35. (From OE-Core rev: 51844f2d60d77fb8cb46ffe460402f76ae216ca5) Signed-off-by: Michael Halstead <mhalstead@linuxfoundation.org> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 347b8c87fb4e2c398644f900728cf6e22ba4516d) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* uninative: Add version to uninative tarball nameRichard Purdie2022-03-092-2/+3
| | | | | | | | | | | | | | | | | uninative works via hashes and doesn't need the version in the tarball name but it does make things easier to inspect in DL_DIR. There were reasons such as ease of publication of the build tarballs but we can handle those differently now and the signature issues from the early code aren't an issue now. From 3.4 onwards we can use a version'd name. [YOCTO #12970] (From OE-Core rev: 0ec0e49d0d2a7478efbf20bc3554f0ffba40afa0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dadba70d6a24d8ebb5576598efffa973151c7218) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* buildhistory.bbclass: create the buildhistory directory when neededJose Quaresma2022-03-091-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the BUILDHISTORY_RESET is enabled we need to move the content from BUILDHISTORY_DIR to BUILDHISTORY_OLD_DIR but when we start a clean build in the first run we don't have the BUILDHISTORY_DIR so the move of files will fail. | ERROR: Command execution failed: Traceback (most recent call last): | File "/xxx/poky/bitbake/lib/bb/command.py", line 110, in runAsyncCommand | commandmethod(self.cmds_async, self, options) | File "/xxx/poky/bitbake/lib/bb/command.py", line 564, in buildTargets | command.cooker.buildTargets(pkgs_to_build, task) | File "/xxx/poky/bitbake/lib/bb/cooker.py", line 1481, in buildTargets | bb.event.fire(bb.event.BuildStarted(buildname, ntargets), self.databuilder.mcdata[mc]) | File "/xxx/home/builder/src/base/poky/bitbake/lib/bb/event.py", line 214, in fire | fire_class_handlers(event, d) | File "/xxx/poky/bitbake/lib/bb/event.py", line 121, in fire_class_handlers | execute_handler(name, handler, event, d) | File "/xxx/poky/bitbake/lib/bb/event.py", line 93, in execute_handler | ret = handler(event) | File "/xxx/poky/meta/classes/buildhistory.bbclass", line 919, in buildhistory_eventhandler | entries = [ x for x in os.listdir(rootdir) if not x.startswith('.') ] | FileNotFoundError: [Errno 2] No such file or directory: '/xxx/buildhistory' (From OE-Core rev: de89dc125758f828a7886012bd9b1c8a1017ef48) Signed-off-by: Jose Quaresma <quaresma.jose@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 97bc2168da7dbacdfbf79cd70db674363ab84f6b) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libxml-parser-perl: Add missing RDEPENDSRichard Purdie2022-03-091-0/+1
| | | | | | | | | | | | Running the ptest package in an image alone highlighted missing module dependencies. Add them to fix those errors. (From OE-Core rev: 6e98fdf7832fed3d93645ed69f62c8df5e89b96b) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 3859f49db2d694c7b63fdbe25be0018afba5c738) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cml1.bbclass: Handle ncurses-native being available via pkg-configNathan Rossi2022-03-091-0/+8
| | | | | | | | | | | | | | | | | | | | The linux kernel will by default use pkg-config to get ncurses(w) paths, falling back to absolute path checks otherwise. If the build host does not have ncurses installed this will fail as pkg-config will not search the native sysroot for ncurses. To more all kernel/kconfig sources, inject the equivalent native pkg-config variables similar to what is done by the pkg-config-native script. This only affects the menuconfig python task itself and the oe_terminal call inside it. (cherry picked from commit abb95c421bb67d452691819e3f63dabd02e2ba37) (From OE-Core rev: dc6b20475a69c9fbab9a97a93119aeedf54deb23) Signed-off-by: Nathan Rossi <nathan@nathanrossi.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* bootchart2: Add missing python3-math dependencyMarek Vasut2022-03-091-1/+1
| | | | | | | | | | | | | | | | Without this dependency, generating the bootchart may fail with: " ModuleNotFoundError: No module named 'random' " (cherry picked from commit 487e9f16a00f895159b79f1865fe8b626b47ddc2) (From OE-Core rev: 123d4a673dadfee14d5ad8bbc503405da9602bb0) Signed-off-by: Marek Vasut <marex@denx.de> Cc: Mingli Yu <mingli.yu@windriver.com> Cc: Richard Purdie <richard.purdie@linuxfoundation.org> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* wireless-regdb: upgrade 2021.08.28 -> 2022.02.18wangmy2022-03-091-1/+1
| | | | | | | | | | (From OE-Core rev: fd64364f16c822960a00e8a28b87b0ec590eed74) Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e5c06ddfd3c0db0d0762c0241c019f59ad310e53) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Revert "cve-check: add lockfile to task"Ross Burton2022-03-091-1/+0
| | | | | | | | | | | | | | | | | | Now that all of the functions in cve-check open the database read-only, we can remove this lockfile. This means cve-check can run in parallal again, improving runtimes massively. This reverts commit d55fbf4779483d2cfd71df78d0f733b599fef739. (From OE-Core rev: 1a30a8513ca47890470ee9d19a5ea36437e664bf) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit e60d149b41d14d177df20dbecaef943696df1586) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* cve-check: get_cve_info should open the database read-onlyRoss Burton2022-03-091-1/+2
| | | | | | | | | | | | | | | All of the function in cve-check should open the database read-only, as the only writer is the fetch task in cve-update-db. However, get_cve_info() was failing to do this, which might be causing locking issues with sqlite. (From OE-Core rev: 2b3d13a451e99db669977d4d1172653b736ae6e1) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 8de517238f1f418d9af1ce312d99de04ce2e26fc) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* coreutils: remove obsolete ignored CVE listRoss Burton2022-03-091-3/+0
| | | | | | | | | | | | | | | | Three CVEs were meant to be ignored via CVE_WHITELIST, but that wasn't the correct variable name. The CPEs for those CVEs mean that they don't get picked up in our report, so just remove the assignment. (From OE-Core rev: c50688e1d0839d71e05a0d15dd948113d2ef83f6) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit dea00faf30ec7c19b6b5ed4651b430ba3faf69ff) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: fix CVE-2022-25315Steve Sakoman2022-03-092-0/+146
| | | | | | | | | | | | | | | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in storeRawNames. Backport patch from: https://github.com/libexpat/libexpat/pull/559/commits/eb0362808b4f9f1e2345a0cf203b8cc196d776d9 CVE: CVE-2022-25315 (From OE-Core rev: 9cb21fd89de99abeeef1dd962e6019943de546a4) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: fix CVE-2022-25314Steve Sakoman2022-03-092-0/+33
| | | | | | | | | | | | | | | In Expat (aka libexpat) before 2.4.5, there is an integer overflow in copyString. Backport patch from: https://github.com/libexpat/libexpat/pull/560/commits/efcb347440ade24b9f1054671e6bd05e60b4cafd CVE: CVE-2022-25314 (From OE-Core rev: b92c33285c5f886c95a3734e61007b522b62a71f) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: fix CVE-2022-25313Steve Sakoman2022-03-093-0/+363
| | | | | | | | | | | | | | | | | | In Expat (aka libexpat) before 2.4.5, an attacker can trigger stack exhaustion in build_model via a large nesting depth in the DTD element. Backport patch from: https://github.com/libexpat/libexpat/pull/558/commits/9b4ce651b26557f16103c3a366c91934ecd439ab Also add patch which fixes a regression introduced in the above fix: https://github.com/libexpat/libexpat/pull/566 CVE: CVE-2022-25313 (From OE-Core rev: 8105700b1d6d23c87332f453bdc7379999bb4b03) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: fix CVE-2022-25236Steve Sakoman2022-03-092-0/+130
| | | | | | | | | | | | | | | | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. Backport patches from: https://github.com/libexpat/libexpat/pull/561/commits CVE: CVE-2022-25236 (From OE-Core rev: 72ab213c128ef75669447eadcae8219a9f87f941) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* expat: fix CVE-2022-25235Steve Sakoman2022-03-092-0/+284
| | | | | | | | | | | | | | | | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context. Backport patches from: https://github.com/libexpat/libexpat/pull/562/commits CVE: CVE-2022-25235 (From OE-Core rev: 27ab07b1e8caa5c85526eee4a7a3ad0d73326866) Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-23772Minjae Kim2022-03-092-0/+51
| | | | | | | | | | | | | | | math/big: prevent large memory consumption in Rat.SetString An attacker can cause unbounded memory growth in a program using (*Rat).SetString due to an unhandled overflow. Upstream-Status: Backport [https://go.dev/issue/50699] CVE: CVE-2022-23772 (From OE-Core rev: e4d15040f62744265b9236ad7276f3371a9172da) Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* go: fix CVE-2022-23806Minjae Kim2022-03-092-0/+143
| | | | | | | | | | | | | | | | | crypto/elliptic: fix IsOnCurve for big.Int values that are not valid coordinates Some big.Int values that are not valid field elements (negative or overflowing) might cause Curve.IsOnCurve to incorrectly return true. Operating on those values may cause a panic or an invalid curve operation. Note that Unmarshal will never return such values. Upstream-Status: Backport [https://go.dev/issue/50974] CVE: CVE-2022-23806 (From OE-Core rev: eb7aa0929ecd712aeeec0ff37dfb77c3da33b375) Signed-off-by:Minjae Kim <flowergom@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* libarchive: Fix for CVE-2021-36976Virendra Thakur2022-03-094-1/+540
| | | | | | | | | | | | | | | | Add patch to fix CVE-2021-36976 CVE-2021-36976 fix are provided by below mentioned pull request. 1) https://github.com/libarchive/libarchive/pull/1491 2) https://github.com/libarchive/libarchive/pull/1492 3) https://github.com/libarchive/libarchive/pull/1493 (From OE-Core rev: 6c356aec8dabc08bd98da3106780896dc7b52501) Signed-off-by: Virendra Thakur <virendra.thakur@kpit.com> Signed-off-by: virendra thakur <thakur.virendra1810@gmail.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a crash in scriptsMarta Rybczynska2022-03-022-0/+38
| | | | | | | | | | | | | This patch adds a fix for a crash in grub's script handling. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 79ce9059f716546a7d6f4562ba194aedd90c22cd) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: avoid a NULL pointer dereferenceMarta Rybczynska2022-03-022-0/+34
| | | | | | | | | | | | | This patch adds a fix for a NULL pointer dereference in grub's commands/ls. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 6666dccd33178445f3c4fe277354393efb70285a) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a NULL pointer dereferenceMarta Rybczynska2022-03-022-0/+29
| | | | | | | | | | | | | This patch adds a fix for a NULL pointer dereference in grub's script/execute. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: ddf62ae472c3c26af7a4c91e4216c8d5ba4604ac) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix incorrect use of a negative valueMarta Rybczynska2022-03-022-0/+51
| | | | | | | | | | | | | This patch adds a fix for an incorrect use of a negative value in grub's util/glue-efi. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: de1fe600212ff6d460bdc672d7ca0e13afbe7514) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for an incorrect castMarta Rybczynska2022-03-022-0/+47
| | | | | | | | | | | | | This patch adds a fix for incorrect casting from signed to unsigned in grub's util/grub-editenv. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 906ecdc9efbc1b4025c2c7a9797ebd374f8508af) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for NULL pointer dereferenceMarta Rybczynska2022-03-022-0/+42
| | | | | | | | | | | | | This patch adds a fix for a NULL pointer dereference in grub's util/grub-install. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 35310bcfd53752081ed600e77f58ca3fb8db46ac) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a check for a NULL pointerMarta Rybczynska2022-03-022-0/+43
| | | | | | | | | | | | | This patch adds a check for a NULL pointer before use in grub's loader/xnu. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 1d95061ecdc920835df44c0c3ed274193f26948e) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: avoid a memory leakMarta Rybczynska2022-03-022-0/+78
| | | | | | | | | | | | | | This patch fixes a memory leak in grub's loader/xnu when an error is detected in grub_xnu_writetree_toheap(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 265baabc6e7ce4962c22489158dba113e0d74b91) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a memory leakMarta Rybczynska2022-03-022-0/+39
| | | | | | | | | | | | | This patch adds a fix for a memory leak in grub's loader/xnu. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: b53db9013a0f4b3a2a91ec6e5c39d939f388749c) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix checking for NULLMarta Rybczynska2022-03-022-0/+48
| | | | | | | | | | | | | This patch adds a fix for checking for NULL in grub's loader/bsd. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: d4cc82cfdae5c44702925f901db4e35761b1bb7d) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: remove dead codeMarta Rybczynska2022-03-022-0/+35
| | | | | | | | | | | | | This patch removes dead code from grub's gfxmenu/gui_list. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 0319465b022e211f2a98ba5cee13a68818f5cf87) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: test for malformed jpeg filesMarta Rybczynska2022-03-022-0/+39
| | | | | | | | | | | | | This patch adds a fix for handling malformed JPEG files in grub's video/readers/jpeg. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: d8cdb3a17f6e874d232979307a3f25511172d086) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix a possible integer overflowMarta Rybczynska2022-03-022-0/+40
| | | | | | | | | | | | | This patch adds a fix for a possible integer overflow in grub's video/fb/video_fb. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: d15e7cc6fc7de358da2fd1faa8a8ea5bc2fabe98) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix multiple integer overflowsMarta Rybczynska2022-03-022-0/+105
| | | | | | | | | | | | | This patch adds a fix for multiple integer overflows in grub's video/fb/video_fb. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 68b91792ed00f9decc85f300eefe0b7e8f80c98b) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix an integer overflowMarta Rybczynska2022-03-022-0/+79
| | | | | | | | | | | | | This patch adds a fix for a potential integer overflow in grub's video/fb/fbfill. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: fbf3260bd196a5d252ad5ccf2a5fe719d3bd9c7f) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: remove unneeded return valueMarta Rybczynska2022-03-022-0/+95
| | | | | | | | | | | | | This patch removes an uneeded return value in grub's (static) grub_video_gop_fill_mode_info(). It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: dd8837823a279290aec963be1a2646940719c767) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: fix a memory leakMarta Rybczynska2022-03-022-0/+57
| | | | | | | | | | | | | Add a fix of a memory leak in grub's commands/hashsum. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: de075f9421a16e1728968349ba16b0d68d47efea) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a memory leakMarta Rybczynska2022-03-022-0/+53
| | | | | | | | | | | | | This patch adds a fix for a memory leak in grub's normal/completion. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: e58e6e646c2efb91dba3ffa6db3a43b7972f0c87) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a memory leakMarta Rybczynska2022-03-022-0/+44
| | | | | | | | | | | | | This patch fixes a memory leak in grub's syslinux parsing. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: a9d0155842f0582a0d247c81bf972661f0a2cda8) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* grub: add a fix for a possible NULL dereferenceMarta Rybczynska2022-03-022-0/+34
| | | | | | | | | | | | | This patch adds a fix for a possible NULL dereference in grub's libgcrypt/mpi. It is a part of a security series [1]. [1] https://lists.gnu.org/archive/html/grub-devel/2021-03/msg00007.html (From OE-Core rev: 33aa1a133cf2893a6d3a1f94bd098ee1c16a8abc) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-08-08 09:18:48 +0000