<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 14 June 2016 at 11:14, Jussi Kukkonen <span dir="ltr"><<a href="mailto:jussi.kukkonen@intel.com" target="_blank">jussi.kukkonen@intel.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">* License change LGPL 2.0 -> LGPL 2.1+<br>
* vte-termcap is no more<br>
* API break: current version seems to be parallel installable<br>
with old one, but I did not opt for that.<br>
* Add patch to avoid stack protection by default<br>
* Add SECURITY_NO_PIE_CFLAGS exception until linking failure with<br>
libc_nonshared.a is resolved (undefined reference to<br>
__init_array_start)<br></blockquote><div><br></div><div>Just found out Khem has worked around a similar problem with libtool-cross already: I've modified this patch so that SECURITY_NO_PIE_CFLAGS is no longer used, but instead libtool-cross is used:</div><div><br></div><div><div>+# libtool adds "-nostdlib" when g++ is used. This breaks PIE builds.</div><div>+# Use libtool-cross (which has a hack to prevent that) instead.</div><div>+EXTRA_OEMAKE_class-target = "LIBTOOL=${STAGING_BINDIR_CROSS}/${HOST_SYS}-libtool"</div><div><br></div></div><div> - Jussi</div><div><br></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">
Signed-off-by: Jussi Kukkonen <<a href="mailto:jussi.kukkonen@intel.com">jussi.kukkonen@intel.com</a>><br>
---<br>
meta/conf/distro/include/security_flags.inc | 2 +<br>
.../vte/vte-0.28.2/cve-2012-2738.patch | 136 ---------------------<br>
.../vte/vte-0.28.2/obsolete_automake_macros.patch | 14 ---<br>
meta/recipes-support/vte/vte.inc | 15 ---<br>
...-Don-t-enable-stack-protection-by-default.patch | 29 +++++<br>
meta/recipes-support/vte/<a href="http://vte_0.28.2.bb" rel="noreferrer" target="_blank">vte_0.28.2.bb</a> | 16 ---<br>
meta/recipes-support/vte/<a href="http://vte_0.44.1.bb" rel="noreferrer" target="_blank">vte_0.44.1.bb</a> | 24 ++++<br>
7 files changed, 55 insertions(+), 181 deletions(-)<br>
delete mode 100644 meta/recipes-support/vte/vte-0.28.2/cve-2012-2738.patch<br>
delete mode 100644 meta/recipes-support/vte/vte-0.28.2/obsolete_automake_macros.patch<br>
delete mode 100644 meta/recipes-support/vte/vte.inc<br>
create mode 100644 meta/recipes-support/vte/vte/0001-Don-t-enable-stack-protection-by-default.patch<br>
delete mode 100644 meta/recipes-support/vte/<a href="http://vte_0.28.2.bb" rel="noreferrer" target="_blank">vte_0.28.2.bb</a><br>
create mode 100644 meta/recipes-support/vte/<a href="http://vte_0.44.1.bb" rel="noreferrer" target="_blank">vte_0.44.1.bb</a><br>
<br>
diff --git a/meta/conf/distro/include/security_flags.inc b/meta/conf/distro/include/security_flags.inc<br>
index ea1d4e5..0df65e0 100644<br>
--- a/meta/conf/distro/include/security_flags.inc<br>
+++ b/meta/conf/distro/include/security_flags.inc<br>
@@ -95,6 +95,8 @@ SECURITY_CFLAGS_pn-zlib = "${SECURITY_NO_PIE_CFLAGS}"<br>
SECURITY_CFLAGS_pn-ltp = "${SECURITY_NO_PIE_CFLAGS}"<br>
SECURITY_CFLAGS_pn-pulseaudio = "${SECURITY_NO_PIE_CFLAGS}"<br>
<br>
+SECURITY_CFLAGS_pn-vte = "${SECURITY_NO_PIE_CFLAGS}"<br>
+<br>
# Recipes which fail to compile when elevating -Wformat-security to an error<br>
SECURITY_STRINGFORMAT_pn-busybox = ""<br>
SECURITY_STRINGFORMAT_pn-console-tools = ""<br>
diff --git a/meta/recipes-support/vte/vte-0.28.2/cve-2012-2738.patch b/meta/recipes-support/vte/vte-0.28.2/cve-2012-2738.patch<br>
deleted file mode 100644<br>
index 9b99803..0000000<br>
--- a/meta/recipes-support/vte/vte-0.28.2/cve-2012-2738.patch<br>
+++ /dev/null<br>
@@ -1,136 +0,0 @@<br>
-Upstream-Status: Backport<br>
-CVE: CVE-2012-2738<br>
-Signed-off-by: Ross Burton <<a href="mailto:ross.burton@intel.com">ross.burton@intel.com</a>><br>
-<br>
-From e524b0b3bd8fad844ffa73927c199545b892cdbd Mon Sep 17 00:00:00 2001<br>
-From: Christian Persch <<a href="mailto:chpe@gnome.org">chpe@gnome.org</a>><br>
-Date: Sat, 19 May 2012 19:36:09 +0200<br>
-Subject: [PATCH 1/2] emulation: Limit integer arguments to 65535<br>
-<br>
-To guard against malicious sequences containing excessively big numbers,<br>
-limit all parsed numbers to 16 bit range. Doing this here in the parsing<br>
-routine is a catch-all guard; this doesn't preclude enforcing<br>
-more stringent limits in the handlers themselves.<br>
-<br>
-<a href="https://bugzilla.gnome.org/show_bug.cgi?id=676090" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=676090</a><br>
----<br>
- src/table.c | 2 +-<br>
- src/vteseq.c | 2 +-<br>
- 2 files changed, 2 insertions(+), 2 deletions(-)<br>
-<br>
-diff --git a/src/table.c b/src/table.c<br>
-index 140e8c8..85cf631 100644<br>
---- a/src/table.c<br>
-+++ b/src/table.c<br>
-@@ -550,7 +550,7 @@ _vte_table_extract_numbers(GValueArray **array,<br>
- if (G_UNLIKELY (*array == NULL)) {<br>
- *array = g_value_array_new(1);<br>
- }<br>
-- g_value_set_long(&value, total);<br>
-+ g_value_set_long(&value, CLAMP (total, 0, G_MAXUSHORT));<br>
- g_value_array_append(*array, &value);<br>
- } while (i++ < arginfo->length);<br>
- g_value_unset(&value);<br>
-diff --git a/src/vteseq.c b/src/vteseq.c<br>
-index 7ef4c8c..10991db 100644<br>
---- a/src/vteseq.c<br>
-+++ b/src/vteseq.c<br>
-@@ -557,7 +557,7 @@ vte_sequence_handler_multiple(VteTerminal *terminal,<br>
- GValueArray *params,<br>
- VteTerminalSequenceHandler handler)<br>
- {<br>
-- vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXLONG);<br>
-+ vte_sequence_handler_multiple_limited(terminal, params, handler, G_MAXUSHORT);<br>
- }<br>
-<br>
- static void<br>
---<br>
-2.4.9 (Apple Git-60)<br>
-<br>
-<br>
-From cf1ad453a8def873c49cf6d88162593402f32bb2 Mon Sep 17 00:00:00 2001<br>
-From: Christian Persch <<a href="mailto:chpe@gnome.org">chpe@gnome.org</a>><br>
-Date: Sat, 19 May 2012 20:04:12 +0200<br>
-Subject: [PATCH 2/2] emulation: Limit repetitions<br>
-<br>
-Don't allow malicious sequences to cause excessive repetitions.<br>
-<br>
-<a href="https://bugzilla.gnome.org/show_bug.cgi?id=676090" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=676090</a><br>
----<br>
- src/vteseq.c | 25 ++++++++++++++++++-------<br>
- 1 file changed, 18 insertions(+), 7 deletions(-)<br>
-<br>
-diff --git a/src/vteseq.c b/src/vteseq.c<br>
-index 10991db..209522f 100644<br>
---- a/src/vteseq.c<br>
-+++ b/src/vteseq.c<br>
-@@ -1392,7 +1392,7 @@ vte_sequence_handler_dc (VteTerminal *terminal, GValueArray *params)<br>
- static void<br>
- vte_sequence_handler_DC (VteTerminal *terminal, GValueArray *params)<br>
- {<br>
-- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_dc);<br>
-+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_dc);<br>
- }<br>
-<br>
- /* Delete a line at the current cursor position. */<br>
-@@ -1785,7 +1785,7 @@ vte_sequence_handler_reverse_index (VteTerminal *terminal, GValueArray *params)<br>
- static void<br>
- vte_sequence_handler_RI (VteTerminal *terminal, GValueArray *params)<br>
- {<br>
-- vte_sequence_handler_multiple(terminal, params, vte_sequence_handler_nd);<br>
-+ vte_sequence_handler_multiple_r(terminal, params, vte_sequence_handler_nd);<br>
- }<br>
-<br>
- /* Save cursor (position). */<br>
-@@ -2777,8 +2777,7 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)<br>
- {<br>
- GValue *value;<br>
- VteScreen *screen;<br>
-- long param, end, row;<br>
-- int i;<br>
-+ long param, end, row, i, limit;<br>
- screen = terminal->pvt->screen;<br>
- /* The default is one. */<br>
- param = 1;<br>
-@@ -2796,7 +2795,13 @@ vte_sequence_handler_insert_lines (VteTerminal *terminal, GValueArray *params)<br>
- } else {<br>
- end = screen->insert_delta + terminal->row_count - 1;<br>
- }<br>
-- /* Insert the new lines at the cursor. */<br>
-+<br>
-+ /* Only allow to insert as many lines as there are between this row<br>
-+ * and the end of the scrolling region. See bug #676090.<br>
-+ */<br>
-+ limit = end - row + 1;<br>
-+ param = MIN (param, limit);<br>
-+<br>
- for (i = 0; i < param; i++) {<br>
- /* Clear a line off the end of the region and add one to the<br>
- * top of the region. */<br>
-@@ -2817,8 +2822,7 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)<br>
- {<br>
- GValue *value;<br>
- VteScreen *screen;<br>
-- long param, end, row;<br>
-- int i;<br>
-+ long param, end, row, i, limit;<br>
-<br>
- screen = terminal->pvt->screen;<br>
- /* The default is one. */<br>
-@@ -2837,6 +2841,13 @@ vte_sequence_handler_delete_lines (VteTerminal *terminal, GValueArray *params)<br>
- } else {<br>
- end = screen->insert_delta + terminal->row_count - 1;<br>
- }<br>
-+<br>
-+ /* Only allow to delete as many lines as there are between this row<br>
-+ * and the end of the scrolling region. See bug #676090.<br>
-+ */<br>
-+ limit = end - row + 1;<br>
-+ param = MIN (param, limit);<br>
-+<br>
- /* Clear them from below the current cursor. */<br>
- for (i = 0; i < param; i++) {<br>
- /* Insert a line at the end of the region and remove one from<br>
---<br>
-2.4.9 (Apple Git-60)<br>
-<br>
diff --git a/meta/recipes-support/vte/vte-0.28.2/obsolete_automake_macros.patch b/meta/recipes-support/vte/vte-0.28.2/obsolete_automake_macros.patch<br>
deleted file mode 100644<br>
index 6763d37..0000000<br>
--- a/meta/recipes-support/vte/vte-0.28.2/obsolete_automake_macros.patch<br>
+++ /dev/null<br>
@@ -1,14 +0,0 @@<br>
-Upstream-Status: Submitted [<a href="https://bugzilla.gnome.org/show_bug.cgi?id=691545" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/show_bug.cgi?id=691545</a>]<br>
-<br>
-Signed-off-by: Marko Lindqvist <<a href="mailto:cazfi74@gmail.com">cazfi74@gmail.com</a>><br>
-diff -Nurd vte-0.28.2/gnome-pty-helper/<a href="http://configure.in" rel="noreferrer" target="_blank">configure.in</a> vte-0.28.2/gnome-pty-helper/<a href="http://configure.in" rel="noreferrer" target="_blank">configure.in</a><br>
---- vte-0.28.2/gnome-pty-helper/<a href="http://configure.in" rel="noreferrer" target="_blank">configure.in</a> 2010-07-15 20:08:44.000000000 +0300<br>
-+++ vte-0.28.2/gnome-pty-helper/<a href="http://configure.in" rel="noreferrer" target="_blank">configure.in</a> 2013-01-11 14:50:34.971027440 +0200<br>
-@@ -8,7 +8,6 @@<br>
- AC_ISC_POSIX<br>
- AC_PROG_CC<br>
- AC_STDC_HEADERS<br>
--AM_PROG_CC_STDC<br>
-<br>
- if test -z "$enable_maintainer_mode"; then<br>
- enable_maintainer_mode=yes<br>
diff --git a/meta/recipes-support/vte/vte.inc b/meta/recipes-support/vte/vte.inc<br>
deleted file mode 100644<br>
index 8565cc2..0000000<br>
--- a/meta/recipes-support/vte/vte.inc<br>
+++ /dev/null<br>
@@ -1,15 +0,0 @@<br>
-SUMMARY = "Virtual terminal emulator GTK+ widget library"<br>
-BUGTRACKER = "<a href="https://bugzilla.gnome.org/buglist.cgi?product=vte" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/buglist.cgi?product=vte</a>"<br>
-LICENSE = "LGPLv2.0"<br>
-DEPENDS = " glib-2.0 gtk+ intltool-native ncurses"<br>
-RDEPENDS_libvte = "vte-termcap"<br>
-<br>
-inherit gnome gtk-doc distro_features_check upstream-version-is-even gobject-introspection<br>
-ANY_OF_DISTRO_FEATURES = "${GTK2DISTROFEATURES}"<br>
-<br>
-EXTRA_OECONF = "--disable-python"<br>
-<br>
-PACKAGES =+ "libvte vte-termcap"<br>
-FILES_libvte = "${libdir}/*.so.* ${libexecdir}/gnome-pty-helper"<br>
-FILES_vte-termcap = "${datadir}/vte/termcap-0.0"<br>
-<br>
diff --git a/meta/recipes-support/vte/vte/0001-Don-t-enable-stack-protection-by-default.patch b/meta/recipes-support/vte/vte/0001-Don-t-enable-stack-protection-by-default.patch<br>
new file mode 100644<br>
index 0000000..fcfc559<br>
--- /dev/null<br>
+++ b/meta/recipes-support/vte/vte/0001-Don-t-enable-stack-protection-by-default.patch<br>
@@ -0,0 +1,29 @@<br>
+From b0a579d83e355545b64742c997fe8b1d58bf4207 Mon Sep 17 00:00:00 2001<br>
+From: Jussi Kukkonen <<a href="mailto:jussi.kukkonen@intel.com">jussi.kukkonen@intel.com</a>><br>
+Date: Mon, 13 Jun 2016 11:05:00 +0300<br>
+Subject: [PATCH] Don't enable stack-protection by default<br>
+<br>
+These are set by security_flags.inc.<br>
+<br>
+Upstream-Status: Inappropriate [configuration]<br>
+Signed-off-by: Jussi Kukkonen <<a href="mailto:jussi.kukkonen@intel.com">jussi.kukkonen@intel.com</a>><br>
+---<br>
+ <a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a> | 2 --<br>
+ 1 file changed, 2 deletions(-)<br>
+<br>
+diff --git a/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a> b/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
+index 068d072..d580f84 100644<br>
+--- a/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
++++ b/<a href="http://configure.ac" rel="noreferrer" target="_blank">configure.ac</a><br>
+@@ -138,8 +138,6 @@ m4_define([compiler_flags_common],[ dnl<br>
+ -fno-common dnl<br>
+ -fdiagnostics-show-option dnl<br>
+ -fno-strict-aliasing dnl<br>
+- -fstack-protector dnl<br>
+- -fstack-protector-strong dnl<br>
+ -fno-semantic-interposition dnl<br>
+ -Wno-deprecated-declarations dnl<br>
+ ])<br>
+--<br>
+2.1.4<br>
+<br>
diff --git a/meta/recipes-support/vte/<a href="http://vte_0.28.2.bb" rel="noreferrer" target="_blank">vte_0.28.2.bb</a> b/meta/recipes-support/vte/<a href="http://vte_0.28.2.bb" rel="noreferrer" target="_blank">vte_0.28.2.bb</a><br>
deleted file mode 100644<br>
index 74087ca..0000000<br>
--- a/meta/recipes-support/vte/<a href="http://vte_0.28.2.bb" rel="noreferrer" target="_blank">vte_0.28.2.bb</a><br>
+++ /dev/null<br>
@@ -1,16 +0,0 @@<br>
-require vte.inc<br>
-<br>
-LIC_FILES_CHKSUM = "file://COPYING;md5=3bf50002aefd002f49e7bb854063f7e7"<br>
-<br>
-PR = "r6"<br>
-<br>
-SRC_URI += "file://obsolete_automake_macros.patch \<br>
- file://cve-2012-2738.patch \<br>
- "<br>
-<br>
-CFLAGS += "-D_GNU_SOURCE"<br>
-<br>
-SRC_URI[archive.md5sum] = "497f26e457308649e6ece32b3bb142ff"<br>
-SRC_URI[archive.sha256sum] = "86cf0b81aa023fa93ed415653d51c96767f20b2d7334c893caba71e42654b0ae"<br>
-<br>
-RECIPE_NO_UPDATE_REASON = "matchbox-terminal needs to be ported over to new vte first"<br>
diff --git a/meta/recipes-support/vte/<a href="http://vte_0.44.1.bb" rel="noreferrer" target="_blank">vte_0.44.1.bb</a> b/meta/recipes-support/vte/<a href="http://vte_0.44.1.bb" rel="noreferrer" target="_blank">vte_0.44.1.bb</a><br>
new file mode 100644<br>
index 0000000..f42a9aa<br>
--- /dev/null<br>
+++ b/meta/recipes-support/vte/<a href="http://vte_0.44.1.bb" rel="noreferrer" target="_blank">vte_0.44.1.bb</a><br>
@@ -0,0 +1,24 @@<br>
+SUMMARY = "Virtual terminal emulator GTK+ widget library"<br>
+BUGTRACKER = "<a href="https://bugzilla.gnome.org/buglist.cgi?product=vte" rel="noreferrer" target="_blank">https://bugzilla.gnome.org/buglist.cgi?product=vte</a>"<br>
+LICENSE = "LGPLv2.1+"<br>
+DEPENDS = "glib-2.0 gtk+3 intltool-native"<br>
+<br>
+LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c"<br>
+<br>
+inherit gnomebase gtk-doc distro_features_check upstream-version-is-even vala gobject-introspection<br>
+<br>
+SRC_URI += "file://0001-Don-t-enable-stack-protection-by-default.patch"<br>
+SRC_URI[archive.md5sum] = "20916d97a5902657e54307cc2757beee"<br>
+SRC_URI[archive.sha256sum] = "712dd548339f600fd7e221d12b2670a13a4361b2cd23ba0e057e76cc19fe5d4e"<br>
+<br>
+ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"<br>
+<br>
+PACKAGECONFIG[gnutls] = "--with-gnutls,--without-gnutls,gnutls"<br>
+<br>
+CFLAGS += "-D_GNU_SOURCE"<br>
+<br>
+# Enable vala only if gobject-introspection is enabled<br>
+EXTRA_OECONF = "--enable-vala=auto"<br>
+<br>
+PACKAGES =+ "libvte"<br>
+FILES_libvte = "${libdir}/*.so.*"<br>
<span class=""><font color="#888888">--<br>
2.1.4<br>
<br>
</font></span></blockquote></div><br></div></div>