Details: https://nvd.nist.gov/vuln/detail/CVE-2024-1013
The vulnerability has been patched since 2.3.13[1], however
NVD tracks it without version info.
Due to this, mark it patched explicitly.
[1]: 249bfcc511
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The following two patches are dropped as they have already been
in the new version:
- 0001-exe-Makefile.am-add-CROSS_LAUNCHER-to-run-odbc_confi.patch
- CVE-2024-1013.patch
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This reverts commit 24ff52ba3b73757cc0255a5b19822e2e4d3d4e0a.
The original patch was my bad. The patches for oe-core were re-worked,
but I forgot the recall this patch.
In fact, inheriting qemu is needed because it sets a clear barriar
for people to use qemu user mode. And the QEMU_OPTIONS settings
are also in qemu.bbclass.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Avoid inheriting qemu.bbclass and use oe.qemu.xxx instead.
Also, the 'qemu-native' dep is replaced by 'qemuwrapper-cross' for
PACKAGE_WRITE_DEPS. qemuwrapper-cross is the one that is actually
used by postints and it has 'qemu-native' in DEPENDS.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
An out-of-bounds stack write flaw was found in unixODBC on 64-bit
architectures where the caller has 4 bytes and callee writes 8 bytes.
This issue may go unnoticed on little-endian architectures, while
big-endian architectures can be broken.
References:
https://nvd.nist.gov/vuln/detail/CVE-2024-1013
Signed-off-by: Soumya Sambu <soumya.sambu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Brings
Fix iconv handle leak with pooling
Add windows encoding patch
Avoid failed build if clock_gettime() is not available
Allow passing in a entire connection string into iusql
Allow isql to handle SQL_SUCCESS_WITH_INFO from SQLPrepare
Add extra logging for ODBCINST connect settings
Allow allocated copy (instead of fixed length) for the connection string with pooling to allow any length
Export __clear_ini_cache() from odbcinst to allow explicitly clearing the ini cache
Fix seg fault when used with SQLAPI
Add --enable-utf8ini flag to add utf8 to WCHAR conversions in SQLGetPrivateProfileStringW
Allow longer error messages via GetDiag functions
Add --enable-singleenv to enable single shared env handle when using pooling
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The build process currently succeeds but the odbc.pc file is not correctly
generated.
The error message is like below in log.do_compile and log.do_install:
/bin/bash: line 1: ../exe/odbc_config: cannot execute binary file: Exec format error
I can see the message comes from the following line in exe/Makefile.am:
@sed "s![@]ODBC_ULEN[@]!`$(top_builddir)/exe/odbc_config$(EXEEXT) --ulen`!" \
$(top_builddir)/DriverManager/odbc.pc > $(top_builddir)/exe/odbc.pc.tmp
It's running the exe/odbc_config program we built out. But the binary is for the target
platform and if we run it on the build host, we get that error message. The resulting ulen
and build_cflags in the final odbc.pc file are also empty.
Fix the issue by using qemu usermode to launch the target binary.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Error: Transaction test error:
file /usr/include/unixODBC/config.h conflicts between attempted installs of unixodbc-dev-2.3.11-r0.aarch64 and lib32-unixodbc-dev-2.3.11-r0.armv7ahf_neon
file /usr/include/unixODBC/unixodbc_conf.h conflicts between attempted installs of unixodbc-dev-2.3.11-r0.aarch64 and lib32-unixodbc-dev-2.3.11-r0.armv7ahf_neon
file /usr/include/unixodbc.h conflicts between attempted installs of unixodbc-dev-2.3.11-r0.aarch64 and lib32-unixodbc-dev-2.3.11-r0.armv7ahf_neon
The differences of config.h are as follows:
@@ -14,7 +14,7 @@
/* #undef C_ALLOCA */
/* Lib directory */
-#define DEFLIB_PATH "/usr/lib64"
+#define DEFLIB_PATH "/usr/lib"
/* Using perdriver iconv */
/* #undef ENABLE_DRIVER_ICONV */
@@ -275,7 +275,7 @@
#define INCLUDE_PREFIX "/usr/include"
/* Lib directory */
-#define LIB_PREFIX "/usr/lib64"
+#define LIB_PREFIX "/usr/lib"
/* Define to the sub-directory where libtool stores uninstalled libraries. */
#define LT_OBJDIR ".libs/"
@@ -311,7 +311,7 @@
#define PACKAGE_VERSION "2.3.11"
/* Platform is 64 bit */
-#define PLATFORM64 /**/
+/* #undef PLATFORM64 */
/* Install prefix */
#define PREFIX "/usr"
@@ -323,10 +323,10 @@
#define SHLIBEXT ".so"
/* The size of `long', as computed by sizeof. */
-#define SIZEOF_LONG 8
+#define SIZEOF_LONG 4
/* The size of `long int', as computed by sizeof. */
-#define SIZEOF_LONG_INT 8
+#define SIZEOF_LONG_INT 4
/* If using the C implementation of alloca, define if you know the
direction of stack growth for your system; otherwise it will be
@@ -351,7 +351,7 @@
#define SYSTEM_FILE_PATH "/etc"
/* Lib path */
-#define SYSTEM_LIB_PATH "/usr/lib64"
+#define SYSTEM_LIB_PATH "/usr/lib"
/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. This
macro is obsolete. */
@@ -383,7 +383,7 @@
/* #undef _ALL_SOURCE */
/* Number of bits in a file offset, on hosts where this is settable. */
-/* #undef _FILE_OFFSET_BITS */
+#define _FILE_OFFSET_BITS 64
/* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */
/* #undef _LARGEFILE_SOURCE */
The differences of unixodbc_conf.h are as follows:
@@ -19,7 +19,7 @@
/* #undef C_ALLOCA */
/* Lib directory */
-#define DEFLIB_PATH "/usr/lib64"
+#define DEFLIB_PATH "/usr/lib"
/* Using perdriver iconv */
/* #undef ENABLE_DRIVER_ICONV */
@@ -342,7 +342,7 @@
#define INCLUDE_PREFIX "/usr/include"
/* Lib directory */
-#define LIB_PREFIX "/usr/lib64"
+#define LIB_PREFIX "/usr/lib"
/* Define if the OS needs help to load dependent libraries for dlopen(). */
/* #undef LTDL_DLOPEN_DEPLIBS */
@@ -396,7 +396,7 @@
/* Define to the version of this package. */
/* Platform is 64 bit */
-#define PLATFORM64 /**/
+/* #undef PLATFORM64 */
/* Install prefix */
#define PREFIX "/usr"
@@ -408,7 +408,7 @@
#define SHLIBEXT ".so"
/* The size of `long', as computed by sizeof. */
-#define SIZEOF_LONG 8
+#define SIZEOF_LONG 4
/* If using the C implementation of alloca, define if you know the
direction of stack growth for your system; otherwise it will be
@@ -431,7 +431,7 @@
#define SYSTEM_FILE_PATH "/etc"
/* Lib path */
-#define SYSTEM_LIB_PATH "/usr/lib64"
+#define SYSTEM_LIB_PATH "/usr/lib"
/* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
#define TIME_WITH_SYS_TIME 1
The differences of unixodbc.h are as follows:
@@ -14,4 +14,4 @@
#define HAVE_UNISTD_H 1
/* Define to the value of sizeof(long) */
-#define SIZEOF_LONG_INT 8
+#define SIZEOF_LONG_INT 4
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
* Add connection pooling via wide connection functions
* Remove "#define VERSION" from unixodbc_conf.h
* Call driver functions through prototypes
* Add connection pool limit option
* Add fseeko support in cursor lib
* Try and prevent logging buffer overflow
* Add 'echo' option to isql/iusql
* Alter isql/iusql buffering
* Alter unicode to ascii conversion in SQLGetDiagField
* Fix pooling problem when user name and or password is not provided
* Fix a couple of reported buffer overflow conditions
* Fix iconv leak with timeout in pooled connection
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
=========
* Add configure support for editline
* SQLDriversW was ignoring user config
* SQLDataSources Fix termination character
* Fix for pooling seg fault
* Make calling SQLSetStmtAttrW call the W function in the driver if its there
* Try and fix race condition clearing system odbc.ini file
* Remove trailing space from isql/iusql SQL
* When setting connection attributes set before connect also check if the W entry points can be used
* Try calling the W error functions first if available in the driver
* Add iconvperdriver configure option to allow calling unicode_setup in SQLAllocHandle
* iconv handles was being lost when reusing pooled connection
* Catch null copy in iniPropertyInsert
* Fix a few leaks
* Remove "#define UNIXODBC_SOURCE" from unixodbc_conf.h
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
The unixODBC package no longer includes a driver for MySQL (that lives
elsewhere) so there is no reason to require MySQL libs at build time.
It does, however, want to build against readline, which was being pulled
in transitively by mysql5 before.
Signed-off-by: Dan Callaghan <dan.callaghan@opengear.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Release notes from http://www.unixodbc.org/:
* Single bug fix that was a possible security issue so I have pushed a version out.
- Fix order of arguments in SQLWriteFileDSN.c, fix unwanted free() in iusql.c
- Add pkg-config files
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
unixODBC is an Open Source ODBC sub-system and an
ODBC SDK for Linux, Mac OSX, and UNIX.
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
