[Armadeus-commitlog] armadeus branch, master, updated. armadeus-7.0-101-g619e77d44
Brought to you by:
sszy
Menu
▾
▴
[Armadeus-commitlog] armadeus branch, master, updated. armadeus-7.0-101-g619e77d44
|
From: Sébastien S. <ss...@us...> - 2019-07-12 13:39:04
|
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "armadeus".
The branch, master has been updated
via 619e77d44912fc53fb5f8cd54c4b315155d578b8 (commit)
via cb93376509ddcaf4b70e76f982c2787a7e4d31e9 (commit)
from 9f82aab36dd626b9c5ed31fa6d091087ae93c488 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 619e77d44912fc53fb5f8cd54c4b315155d578b8
Author: Sébastien Szymanski <seb...@ar...>
Date: Fri Jul 12 15:35:46 2019 +0200
[BSP] Makefile: always save BR sources in downloads directory
commit cb93376509ddcaf4b70e76f982c2787a7e4d31e9
Author: Sébastien Szymanski <seb...@ar...>
Date: Fri Jul 12 15:34:01 2019 +0200
[BUILDROOT] 2019.02: unzip: fix downloading by updating patches from Debian
-----------------------------------------------------------------------
Summary of changes:
Makefile | 6 +-
...ip-update-security-and-bux-fix-patches-fr.patch | 89 ++++++++++++++++++++++
patches/buildroot/2019.02/cleanup_buildroot.sh | 2 +
3 files changed, 92 insertions(+), 5 deletions(-)
create mode 100644 patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
diff --git a/Makefile b/Makefile
index 72f722bba..8d430ae99 100644
--- a/Makefile
+++ b/Makefile
@@ -37,11 +37,7 @@ ARMADEUS_CONFIG_DIR:=$(BUILDROOT_DIR)/configs
BUILDROOT_SOURCE:=buildroot-$(BUILDROOT_VERSION).tar.bz2
#BUILDROOT_DIR is defined in ./Makefile.in
PATCH_DIR = patches
-ifeq ($(ARMADEUS_DL_DIR),)
-BUILDROOT_FILE_PATH = $(BUILDROOT_DIR)/downloads
-else
-BUILDROOT_FILE_PATH = $(ARMADEUS_DL_DIR)
-endif
+BUILDROOT_FILE_PATH = $(ARMADEUS_TOPDIR)/downloads
TAR_OPTIONS = --exclude=.svn --exclude=.git --exclude=.gitignore --strip-component=1 -xf
BUILDROOT_PATCH_SCRIPT = $(BUILDROOT_DIR)/support/scripts/apply-patches.sh
ARMADEUS_ENV_FILE:=$(ARMADEUS_TOPDIR)/armadeus_env.sh
diff --git a/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch b/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
new file mode 100644
index 000000000..bd3fe9ff3
--- /dev/null
+++ b/patches/buildroot/2019.02/236-package-unzip-update-security-and-bux-fix-patches-fr.patch
@@ -0,0 +1,89 @@
+From 1df827a1219a61cba3ace88a3ef5d2cc02d17b32 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9bastien=20Szymanski?=
+ <seb...@ar...>
+Date: Fri, 12 Jul 2019 15:15:26 +0200
+Subject: [PATCH 1/1] package/unzip: update security and bux fix patches from
+ Debian
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Fix the URL and add three new patches. Quoting changelog [1]:
+
+unzip (6.0-24) unstable; urgency=medium
+
+ * Apply two patches by Mark Adler:
+ - Fix bug in undefer_input() that misplaced the input state.
+ - Detect and reject a zip bomb using overlapped entries. Closes: #931433.
+ Bug discovered by David Fifield. For reference, this is CVE-2019-13232.
+
+ -- Santiago Vila <sa...@de...> Thu, 11 Jul 2019 18:03:34 +0200
+
+unzip (6.0-23) unstable; urgency=medium
+
+ * Fix lame code in fileio.c which parsed 64-bit values incorrectly.
+ Thanks to David Fifield for the report. Closes: #929502.
+
+ -- Santiago Vila <sa...@de...> Wed, 29 May 2019 00:24:08 +0200
+
+[1] https://sources.debian.org/data/main/u/unzip/6.0-24/debian/changelog
+
+Signed-off-by: Sébastien Szymanski <seb...@ar...>
+---
+ package/unzip/unzip.hash | 3 +++
+ package/unzip/unzip.mk | 29 ++++++++++++++++-------------
+ 2 files changed, 19 insertions(+), 13 deletions(-)
+
+diff --git a/package/unzip/unzip.hash b/package/unzip/unzip.hash
+index fbf2615ad6..0c384d006e 100644
+--- a/package/unzip/unzip.hash
++++ b/package/unzip/unzip.hash
+@@ -13,3 +13,6 @@ sha256 ea04cfc8b7ca3b3c03117da0d891870b8c542d26188ef5593fd7e479f4f29f4e 17-resto
+ sha256 1872ffdd4d82edd7b1e62c469642bf16a1ca12dd26d41bd3f0b44f0f7602eb63 18-cve-2014-9913-unzip-buffer-overflow.patch
+ sha256 60840ea8f5d11a276972fb5b43652cdd49a9ed93b2cc0586ad309bf52104b012 19-cve-2016-9844-zipinfo-buffer-overflow.patch
+ sha256 4eabc3faeddd56ebc3d5053486b61f8758d840902725fd555d3472cffb094437 20-cve-2018-1000035-unzip-buffer-overflow.patch
++sha256 df3b0eeea8dcc161a2565e306b5dda13d27de43145e198baaf0eab822321ee7e 21-fix-warning-messages-on-big-files.patch
++sha256 2cf5a89e921da99e883bcde0ea03e2c77ae9185f57efaf35e7d43bc24353cfdc 22-cve-2019-13232-fix-bug-in-undefer-input.patch
++sha256 c8e82c80fc7760f90567118a465e4cfa1b8e5d0a5723f9c70e3d21247e550615 23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
+diff --git a/package/unzip/unzip.mk b/package/unzip/unzip.mk
+index 43e90125e6..2887b7b288 100644
+--- a/package/unzip/unzip.mk
++++ b/package/unzip/unzip.mk
+@@ -11,18 +11,21 @@ UNZIP_LICENSE = Info-ZIP
+ UNZIP_LICENSE_FILES = LICENSE
+
+ UNZIP_PATCH = \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/07-increase-size-of-cfactorstr.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/08-allow-greater-hostver-values.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/09-cve-2014-8139-crc-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/11-cve-2014-8141-getzip64data.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/14-cve-2015-7696.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/15-cve-2015-7697.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/17-restore-unix-timestamps-accurately.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
+- https://sources.debian.org/data/main/u/unzip/6.0-22/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/07-increase-size-of-cfactorstr.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/08-allow-greater-hostver-values.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/09-cve-2014-8139-crc-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/10-cve-2014-8140-test-compr-eb.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/11-cve-2014-8141-getzip64data.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/12-cve-2014-9636-test-compr-eb.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/14-cve-2015-7696.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/15-cve-2015-7697.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/16-fix-integer-underflow-csiz-decrypted.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/17-restore-unix-timestamps-accurately.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/18-cve-2014-9913-unzip-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/20-cve-2018-1000035-unzip-buffer-overflow.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/21-fix-warning-messages-on-big-files.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch \
++ https://sources.debian.org/data/main/u/unzip/6.0-24/debian/patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch
+
+ $(eval $(cmake-package))
+--
+2.21.0
+
diff --git a/patches/buildroot/2019.02/cleanup_buildroot.sh b/patches/buildroot/2019.02/cleanup_buildroot.sh
index 25660156d..87132505b 100755
--- a/patches/buildroot/2019.02/cleanup_buildroot.sh
+++ b/patches/buildroot/2019.02/cleanup_buildroot.sh
@@ -183,6 +183,8 @@ rm -rf buildroot/package/sunxi-mali/egl.pc
rm -rf buildroot/package/sunxi-mali/glesv2.pc
rm -rf buildroot/package/sunxi-mali/sunxi-mali.hash
rm -rf buildroot/package/sunxi-mali/sunxi-mali.mk
+rm -rf buildroot/package/unzip/unzip.hash
+rm -rf buildroot/package/unzip/unzip.mk
rm -rf buildroot/package/wolf4sdl/Config.in
rm -rf buildroot/package/wolf4sdl/wolf4sdl.mk
rm -rf buildroot/package/wpa_supplicant/Config.in
hooks/post-receive
--
armadeus
|