[OE-core] [PATCH] dpkg: Upgrade to 1.17.21
Aníbal Limón
anibal.limon at linux.intel.com
Mon Nov 24 21:16:31 UTC 2014
Remove dpkg-1.17.4-CVE-2014-0471, dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127 and
ignore_extra_fields patches that are already in upstream.
Rebase no-vla-warning patch.
Signed-off-by: Aníbal Limón <anibal.limon at linux.intel.com>
---
meta/recipes-devtools/dpkg/dpkg.inc | 3 +-
.../dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch | 68 ---------------
.../dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch | 97 ----------------------
.../dpkg/dpkg/ignore_extra_fields.patch | 21 -----
.../dpkg/dpkg/no-vla-warning.patch | 24 +++---
meta/recipes-devtools/dpkg/dpkg_1.17.21.bb | 19 +++++
meta/recipes-devtools/dpkg/dpkg_1.17.4.bb | 21 -----
7 files changed, 32 insertions(+), 221 deletions(-)
delete mode 100644 meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch
delete mode 100644 meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch
delete mode 100644 meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch
create mode 100644 meta/recipes-devtools/dpkg/dpkg_1.17.21.bb
delete mode 100644 meta/recipes-devtools/dpkg/dpkg_1.17.4.bb
diff --git a/meta/recipes-devtools/dpkg/dpkg.inc b/meta/recipes-devtools/dpkg/dpkg.inc
index 929906d..c3c51eb 100644
--- a/meta/recipes-devtools/dpkg/dpkg.inc
+++ b/meta/recipes-devtools/dpkg/dpkg.inc
@@ -2,8 +2,7 @@ SUMMARY = "Package maintenance system from Debian"
LICENSE = "GPLv2.0+"
SECTION = "base"
-SRC_URI = "${DEBIAN_MIRROR}/main/d/dpkg/dpkg_${PV}.tar.xz \
- file://ignore_extra_fields.patch"
+SRC_URI = "${DEBIAN_MIRROR}/main/d/dpkg/dpkg_${PV}.tar.xz"
DEPENDS = "zlib bzip2 perl ncurses"
DEPENDS_class-native = "bzip2-replacement-native zlib-native virtual/update-alternatives-native gettext-native perl-native"
diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch
deleted file mode 100644
index e59c666..0000000
--- a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-dpkg: Security Advisory - CVE-2014-3127
-
-commit a12eb58959d0a10584a428f4a3103a49204c410f upstream
-
-dpkg 1.15.9 on Debian squeeze introduces support for the "C-style
-encoded filenames" feature without recognizing that the squeeze patch
-program lacks this feature, which triggers an interaction error that
-allows remote attackers to conduct directory traversal attacks and
-modify files outside of the intended directories via a crafted source
-package.
-
-NOTE: this can be considered a release engineering problem in the
-effort to fix CVE-2014-0471.
-
-Upstream-Status: Backport
-
-Signed-off-by: Wenlin Kang <wenlin.kang at windriver.com>
-Signed-off-by: Wenzong Fan <wenzong.fan at windriver.com>
-=====================================================
-diff -uarN dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm
---- dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm 2014-06-05 16:32:41.765446564 +0800
-+++ dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm 2014-06-05 16:37:21.461446359 +0800
-@@ -324,31 +324,6 @@
- return $line;
- }
-
--my %ESCAPE = ((
-- 'a' => "\a",
-- 'b' => "\b",
-- 'f' => "\f",
-- 'n' => "\n",
-- 'r' => "\r",
-- 't' => "\t",
-- 'v' => "\cK",
-- '\\' => '\\',
-- '"' => '"',
--), (
-- map { sprintf('%03o', $_) => chr($_) } (0..255)
--));
--
--sub _unescape {
-- my ($diff, $str) = @_;
--
-- if (exists $ESCAPE{$str}) {
-- return $ESCAPE{$str};
-- } else {
-- error(_g('diff %s patches file with unknown escape sequence \\%s'),
-- $diff, $str);
-- }
--}
--
- # Fetch the header filename ignoring the optional timestamp
- sub _fetch_filename {
- my ($diff, $header) = @_;
-@@ -358,12 +333,7 @@
-
- # Is it a C-style string?
- if ($header =~ m/^"/) {
-- $header =~ m/^"((?:[^\\"]|\\.)*)"/;
-- error(_g('diff %s patches file with unbalanced quote'), $diff)
-- unless defined $1;
--
-- $header = $1;
-- $header =~ s/\\([0-3][0-7]{2}|.)/_unescape($diff, $1)/eg;
-+ error(_g('diff %s patches file with C-style encoded filename'), $diff);
- } else {
- # Tab is the official separator, it's always used when
- # filename contain spaces. Try it first, otherwise strip on space
diff --git a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch b/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch
deleted file mode 100644
index 195d309..0000000
--- a/meta/recipes-devtools/dpkg/dpkg/dpkg-1.17.4-CVE-2014-0471.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-dpkg: Security Advisory - CVE-2014-0471
-
-commit a82651188476841d190c58693f95827d61959b51 upstream
-
-Directory traversal vulnerability in the unpacking functionality in
-dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8
-allows remote attackers to write arbitrary files via a crafted source
-package, related to "C-style filename quoting."
-
-Upstream-Status: Backport
-
-Signed-off-by: Wenlin Kang <wenlin.kang at windriver.com>
-Signed-off-by: Wenzong Fan <wenzong.fan at windriver.com>
-===================================================
-diff -uarN dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm
---- dpkg-1.17.1-org/scripts/Dpkg/Source/Patch.pm 2014-06-05 15:24:07.422446284 +0800
-+++ dpkg-1.17.1/scripts/Dpkg/Source/Patch.pm 2014-06-05 15:41:37.746446314 +0800
-@@ -324,14 +324,53 @@
- return $line;
- }
-
--# Strip timestamp
--sub _strip_ts {
-- my $header = shift;
--
-- # Tab is the official separator, it's always used when
-- # filename contain spaces. Try it first, otherwise strip on space
-- # if there's no tab
-- $header =~ s/\s.*// unless ($header =~ s/\t.*//);
-+my %ESCAPE = ((
-+ 'a' => "\a",
-+ 'b' => "\b",
-+ 'f' => "\f",
-+ 'n' => "\n",
-+ 'r' => "\r",
-+ 't' => "\t",
-+ 'v' => "\cK",
-+ '\\' => '\\',
-+ '"' => '"',
-+), (
-+ map { sprintf('%03o', $_) => chr($_) } (0..255)
-+));
-+
-+sub _unescape {
-+ my ($diff, $str) = @_;
-+
-+ if (exists $ESCAPE{$str}) {
-+ return $ESCAPE{$str};
-+ } else {
-+ error(_g('diff %s patches file with unknown escape sequence \\%s'),
-+ $diff, $str);
-+ }
-+}
-+
-+# Fetch the header filename ignoring the optional timestamp
-+sub _fetch_filename {
-+ my ($diff, $header) = @_;
-+
-+ # Strip any leading spaces.
-+ $header =~ s/^\s+//;
-+
-+ # Is it a C-style string?
-+ if ($header =~ m/^"/) {
-+ $header =~ m/^"((?:[^\\"]|\\.)*)"/;
-+ error(_g('diff %s patches file with unbalanced quote'), $diff)
-+ unless defined $1;
-+
-+ $header = $1;
-+ $header =~ s/\\([0-3][0-7]{2}|.)/_unescape($diff, $1)/eg;
-+ } else {
-+ # Tab is the official separator, it's always used when
-+ # filename contain spaces. Try it first, otherwise strip on space
-+ # if there's no tab
-+ $header =~ s/\s.*// unless $header =~ s/\t.*//;
-+ }
-+
- return $header;
- }
-
-@@ -400,7 +439,7 @@
- unless(s/^--- //) {
- error(_g("expected ^--- in line %d of diff `%s'"), $., $diff);
- }
-- $path{old} = $_ = _strip_ts($_);
-+ $path{old} = $_ = _fetch_filename($diff, $_);
- $fn{old} = $_ if $_ ne '/dev/null' and s{^[^/]*/+}{$destdir/};
- if (/\.dpkg-orig$/) {
- error(_g("diff `%s' patches file with name ending .dpkg-orig"), $diff);
-@@ -412,7 +451,7 @@
- unless (s/^\+\+\+ //) {
- error(_g("line after --- isn't as expected in diff `%s' (line %d)"), $diff, $.);
- }
-- $path{new} = $_ = _strip_ts($_);
-+ $path{new} = $_ = _fetch_filename($diff, $_);
- $fn{new} = $_ if $_ ne '/dev/null' and s{^[^/]*/+}{$destdir/};
-
- unless (defined $fn{old} or defined $fn{new}) {
diff --git a/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch b/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch
deleted file mode 100644
index 4e3eb97..0000000
--- a/meta/recipes-devtools/dpkg/dpkg/ignore_extra_fields.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-Upstream-Status: Inappropriate [workaround]
-
-Index: dpkg-1.16.8/dpkg-deb/build.c
-===================================================================
---- dpkg-1.16.8.orig/dpkg-deb/build.c
-+++ dpkg-1.16.8/dpkg-deb/build.c
-@@ -340,13 +340,13 @@ check_new_pkg(const char *dir)
- if (pkg->priority == pri_other)
- warning(_("'%s' contains user-defined Priority value '%s'"),
- controlfile, pkg->otherpriority);
-- for (field = pkg->available.arbs; field; field = field->next) {
-+ /*for (field = pkg->available.arbs; field; field = field->next) {
- if (known_arbitrary_field(field))
- continue;
-
- warning(_("'%s' contains user-defined field '%s'"), controlfile,
- field->name);
-- }
-+ }*/
-
- free(controlfile);
diff --git a/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch b/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
index 0e57dbc..f660b18 100644
--- a/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
+++ b/meta/recipes-devtools/dpkg/dpkg/no-vla-warning.patch
@@ -11,22 +11,22 @@ Upstream-Status: Pending
Signed-off-by: Donn Seeley <donn.seeley at windriver.com>
Signed-off-by: Robert Yang <liezhi.yang at windriver.com>
+Signed-off-by: Aníbal Limón <anibal.limon at linux.intel.com>
---
m4/dpkg-compiler.m4 | 1 -
1 file changed, 1 deletion(-)
diff --git a/m4/dpkg-compiler.m4 b/m4/dpkg-compiler.m4
-index f1c760b..500b5ad 100644
+index 53f67c6..6e66a43 100644
--- a/m4/dpkg-compiler.m4
+++ b/m4/dpkg-compiler.m4
-@@ -72,7 +72,6 @@ if test "x$enable_compiler_warnings" = "xyes"; then
- DPKG_WARNING_ALL([-Wformat-security])
- DPKG_WARNING_ALL([-Wpointer-arith])
- DPKG_WARNING_ALL([-Wlogical-op])
-- DPKG_WARNING_ALL([-Wvla])
- DPKG_WARNING_ALL([-Winit-self])
- DPKG_WARNING_ALL([-Wwrite-strings])
- DPKG_WARNING_ALL([-Wcast-align])
---
-1.7.10.4
-
+@@ -49,7 +49,6 @@ AC_DEFUN([DPKG_CHECK_COMPILER_WARNINGS], [
+ DPKG_CHECK_COMPILER_FLAG([-Wformat-security])
+ DPKG_CHECK_COMPILER_FLAG([-Wpointer-arith])
+ DPKG_CHECK_COMPILER_FLAG([-Wlogical-op])
+- DPKG_CHECK_COMPILER_FLAG([-Wvla])
+ DPKG_CHECK_COMPILER_FLAG([-Winit-self])
+ DPKG_CHECK_COMPILER_FLAG([-Wwrite-strings])
+ DPKG_CHECK_COMPILER_FLAG([-Wcast-align])
+---
+1.17.21
diff --git a/meta/recipes-devtools/dpkg/dpkg_1.17.21.bb b/meta/recipes-devtools/dpkg/dpkg_1.17.21.bb
new file mode 100644
index 0000000..15c0277
--- /dev/null
+++ b/meta/recipes-devtools/dpkg/dpkg_1.17.21.bb
@@ -0,0 +1,19 @@
+require dpkg.inc
+LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
+
+SRC_URI += "file://noman.patch \
+ file://check_snprintf.patch \
+ file://check_version.patch \
+ file://preinst.patch \
+ file://fix-timestamps.patch \
+ file://remove-tar-no-timestamp.patch \
+ file://fix-abs-redefine.patch \
+ file://arch_pm.patch \
+ file://dpkg-configure.service \
+ file://glibc2.5-sync_file_range.patch \
+ file://no-vla-warning.patch \
+ "
+
+SRC_URI[md5sum] = "765a96fd0180196613bbfa3c4aef0775"
+SRC_URI[sha256sum] = "3ed776627181cb9c1c9ba33f94a6319084be2e9ec9c23dd61ce784c4f602cf05"
+
diff --git a/meta/recipes-devtools/dpkg/dpkg_1.17.4.bb b/meta/recipes-devtools/dpkg/dpkg_1.17.4.bb
deleted file mode 100644
index 83526f3..0000000
--- a/meta/recipes-devtools/dpkg/dpkg_1.17.4.bb
+++ /dev/null
@@ -1,21 +0,0 @@
-require dpkg.inc
-LIC_FILES_CHKSUM = "file://COPYING;md5=751419260aa954499f7abaabaa882bbe"
-
-SRC_URI += "file://noman.patch \
- file://check_snprintf.patch \
- file://check_version.patch \
- file://preinst.patch \
- file://fix-timestamps.patch \
- file://remove-tar-no-timestamp.patch \
- file://fix-abs-redefine.patch \
- file://arch_pm.patch \
- file://dpkg-configure.service \
- file://glibc2.5-sync_file_range.patch \
- file://no-vla-warning.patch \
- file://dpkg-1.17.4-CVE-2014-0471.patch \
- file://dpkg-1.17.4-CVE-2014-0471-CVE-2014-3127.patch \
- "
-
-SRC_URI[md5sum] = "cc25086e1e3bd9512a95f14cfe9002e1"
-SRC_URI[sha256sum] = "01cdc81c33e77c3d7c40df17e19171794542be7cf12e411381ffcaa8f87b1854"
-
--
1.9.1
More information about the Openembedded-core
mailing list