Per [1] this CVE is already patched by commit [2].
This can be also verified with yocto build.
Running without this patch:
root@qemux86-64:~# sfconvert poc.wav output format wave
malloc(): corrupted top size
Aborted
Running with it:
root@qemux86-64:~# sfconvert poc.wav output format wave
Audio File Library: Bad number of coefficients [error 62]
Could not open file 'poc.wav' for reading.
[1] https://github.com/mpruett/audiofile/issues/56
[2] c48e4c6503
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 68f55c158e15a5d35702ae5c730586001e487f86)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Use patch from buildroot:
844a7c6281
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 88faae83b2b0e68827c457f4f348f7d7868f5258)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Use patch from buildroot:
bd5f84d301
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit 9d668989b1447fb19aff55c1a47acdf8d4e8c5e2)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Use patch from buildroot:
434890df2a
Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
(cherry picked from commit f29fbaa4650201a059c65572947ed8faa991fcd8)
Signed-off-by: Armin Kuster <akuster808@gmail.com>
They endup in undefined intrinsics demanded by compiler
error: use of undeclared identifier '__riscv_vsetvlmax_e8mf8'
Perhaps an upgrade of vendored highway module ( when it happens)
will fix it
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Commit 5f453c3401e20eb5489fac4d3b54a5bf96d019ab installs
libraries but without the pkgconfig files, making them harder to link
to. This adds pkgconfig files for these libraries
Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Additional changes:
Use https protocol for git fetch
Build with meson
Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Upstream repo does not tag so, use UPSTREAM_CHECK_COMMITS to detect
upstream updates.
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Alexandre Truong <alexandre.truong@smile.fr>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Modifying existing UPSTREAM_CHECK_URI and adding UPSTREAM_CHECK_REGEX
fix UNKNOWN_BROKEN status from running devtool check-upgrade-status.
The next version of the package can be found from upstream
sources.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Adding UPSTREAM_CHECK_URI and UPSTREAM_CHECK_REGEX fix
UNKNOWN_BROKEN status from running devtool check-upgrade-status.
The next version of the package can be found from upstream
sources.
Signed-off-by: Alexandre Truong <alexandre.truong@smile.fr>
Reviewed-by: Yoann Congal <yoann.congal@smile.fr>
Changelog:
============
* Fix 0.17.2 regression in the fontconfig fontprovider
leading to undesirable widths being chosen from large typographic families
* Fix configure generated with slibtool-provided autoconf macros
* Fix "make check" for shared-only builds
* Constify some API parameters in a backwards-compatible manner
* Add new ass_malloc and ass_free API functions
* Tweak default optimization flags
* Speed up parsing of events with very long override blocks
* Improve handling of HarfBuzz-related failures
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The recipe used in the `meta-openembedded` is a different xsp package compared to the one which has the CVE issue.
Package used in `meta-embedded`: maemo xsp http://repository.maemo.org/pool/maemo/ossw/source/x/xsp/
Package with CVE issue: mono xsp https://github.com/mono/xsp
Signed-off-by: Ninette Adhikari <ninette@thehoodiefirm.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Commit 9389d63fdddcab400cb0b243b74d47bf665aba18 removed a previous patch
that caused the recipe to install the header and library files. Restore
this behavior to the new meson based build system.
Signed-off-by: Neel Gandhi <neel.gandhi@amd.com>
Signed-off-by: Mark Hatle <mark.hatle@amd.com>
Signed-off-by: Mark Hatle <mark.hatle@kernel.crashing.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
We need to disable this on riscv64 as it results in undefined symbols
with clang especially
libjxl/0.10.2/recipe-sysroot/usr/include/hwy/ops/rvv-inl.h:591:17: error: use
of undeclared identifier '__riscv_vsetvlmax_e8mf8'
591 | HWY_RVV_FOREACH(HWY_RVV_LANES, Lanes, setvlmax_e, _ALL)
| ^
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fix incompatible pointer type error when gcc option
'-Wincompatible-pointer-types' set:
cdrkit-1.1.11/genisoimage/eltorito.c:399:41: error: passing argument 1 of 'set_721' from incompatible pointer type [-Wincompatible-pointer-types]
399 | set_721(&last_section_header->entry_count, nentries);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| char (*)[2]
In file included from cdrkit/1.1.11/cdrkit-1.1.11/genisoimage/eltorito.c:39:
cdrkit-1.1.11/genisoimage/genisoimage.h:507:21: note: expected 'char *' but argument is of type 'char (*)[2]'
507 | extern void set_721(char *, unsigned int);
| ^~~~~~
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
libvpx-configure-support-blank-prefix.patch
refreshed for 1.14.1
Changelog:
============
- Improved the detection of compiler support for AArch64 extensions,
particularly SVE.
- Added vpx_codec_get_global_headers() support for VP9.
- Added buffer bounds checks to vpx_writer and vpx_write_bit_buffer.
- Fix to GetSegmentationData() crash in aq_mode=0 for RTC rate control.
- Fix to alloc for row_base_thresh_freq_fac.
- Free row mt memory before freeing cpi->tile_data.
- Fix to buffer alloc for vp9_bitstream_worker_data.
- Fix to VP8 race issue for multi-thread with pnsr_calc.
- Fix to uv width/height in vp9_scale_and_extend_frame_ssse3.
- Fix to integer division by zero and overflow in calc_pframe_target_size().
- Fix to integer overflow in vpx_img_alloc() & vpx_img_wrap()(CVE-2024-5197).
- Fix to UBSan error in vp9_rc_update_framerate().
- Fix to UBSan errors in vp8_new_framerate().
- Fix to integer overflow in vp8 encodeframe.c.
- Handle EINTR from sem_wait().
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
* Fix rendering of \h in certain cases
* Fix a minor memory leak in the CoreText and DirectWrite font provider
* Fix wrong ASS_Image dimensions for huge BorderStyle=4 backgrounds
potentially leading to out of bound reads by API users
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Replace references of WORKDIR with UNPACKDIR where it makes sense to do
so in preparation for changing the default value of UNPACKDIR.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
fixes a misalignment issue in the AVX2 code that could cause crashes under Windows.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Switch to the sourceforge SRC_URI since the mars.org site only supports ftp.
Also switch the HOMEPAGE and BUGTRACKER links over to https.
and drop the obsolete SRC_URI[md5sum].
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Import this recipe from meta-wayland, because it is a prerequisite
for the Gnome desktop. The recently updated gnome-backgrounds package
has converted most of the backgrounds to jxl and to keep them usable
the gdk-pixbuf-loader for jpegxl must be provided. This is included
in the libjxl package itself.
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License-Update: Copyright updated to 2023.
Changelog:
===========
-Significant improvement to packet loss robustness using Deep Redundancy (DRED)
-Improved packet loss concealment through Deep PLC
-Low-bitrate speech quality enhancement down to 6 kb/s wideband
-Improved x86 (AVX2) and Arm (Neon) optimizations
-Support for 4th and 5th order ambisonics
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* as oe-core did in:
https://git.openembedded.org/openembedded-core/commit/?id=d4c346e8ab
* when people are have to maintain own PRs for recipes in oe-core, they
might add them for meta-oe recipes at the same time when upgrading
to next LTS
Signed-off-by: Martin Jansa <martin.jansa@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
Fix to missing prototypes from the rtcd header.
Fix to segfault when total size is enlarged but width is smaller.
Fix to the build for arm64ec using MSVC.
Fix to copy BLOCK_8X8's mi to PICK_MODE_CONTEXT::mic.
Fix to -Wshadow warnings.
Fix to heap overflow in vpx_get4x4sse_cs_neon.
Fix to buffer overrun in highbd Neon subpel variance filters.
Added bitexact encode test script.
Fix to -Wl,-z,defs with Clang's sanitizers.
Fix to decoder stability after error & continued decoding.
Fix to mismatch of VP9 encode with NEON intrinsics with C only version.
Fix to Arm64 MSVC compile vpx_highbd_fdct4x4_neon.
Fix to fragments count before use.
Fix to a case where target bandwidth is 0 for SVC.
Fix mask in vp9_quantize_avx2,highbd_get_max_lane_eob.
Fix to int overflow in vp9_calc_pframe_target_size_one_pass_cbr.
Fix to integer overflow in vp8,ratectrl.c.
Fix to integer overflow in vp9 svc.
Fix to avg_frame_bandwidth overflow.
Fix to per frame qp for temporal layers.
Fix to unsigned integer overflow in sse computation.
Fix to uninitialized mesh feature for BEST mode.
Fix to overflow in highbd temporal_filter.
Fix to unaligned loads w/w==4 in vpx_convolve_copy_neon.
Skip arm64_neon.h workaround w/VS >= 2019.
Fix to c vs avx mismatch of diamond_search_sad().
Fix to c vs intrinsic mismatch of vpx_hadamard_32x32() function.
Fix to a bug in vpx_hadamard_32x32_neon().
Fix to Clang -Wunreachable-code-aggressive warnings.
Fix to a bug in vpx_highbd_hadamard_32x32_neon().
Fix to -Wunreachable-code in mfqe_partition.
Force mode search on 64x64 if no mode is selected.
Fix to ubsan failure caused by left shift of negative.
Fix to integer overflow in calc_pframe_target_size.
Fix to float-cast-overflow in vp8_change_config().
Fix to a null ptr before use.
Conditionally skip using inter frames in speed features.
Remove invalid reference frames.
Disable intra mode search speed features conditionally.
Set nonrd keyframe under dynamic change of deadline for rtc.
Fix to scaled reference offsets.
Set skip_recode=0 in nonrd_pick_sb_modes.
Fix to an edge case when downsizing to one.
Fix to a bug in frame scaling.
Fix to pred buffer stride.
Fix to a bug in simple motion search.
Update frame size in actual encoding.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The musl issue that 0004-Do-not-use-getsubopt.patch fixes has already
been addressed by the following v4l-utils upstream commit:
commit 6e19bb895a16a9a247524ac526ab47f576cc36f6
Author: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Date: Thu Nov 25 10:59:22 2021 +0100
v4l-utils: use v4l_getsubopt instead of getsubopt
Android doesn't have getsubopt at all, and some libc implementations
use a getsubopt variant that behaves slightly different.
So add a new v4l-getsubopt.h header that either just uses the glibc
function (if glibc is detected) or uses a static inline v4l_getsubopt
that is copied from glibc. This should avoid such problems.
Reported-by: Marian Buschsieweke <marian.buschsieweke@ovgu.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Remove the unneeded patch.
Signed-off-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Update to 1.26.1.
Remove the Makefile.am patches as they no longer apply due to
the switch to Meson.
Backport a fix that prevents installing 50-rc_keymap.conf in systems
without systemd.
Signed-off-by: Fabio Estevam <festevam@denx.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* Added patches to fix -> unversioned.so was causing incorrect packaging and errors.
* Added openssl as a depends because trying to link with native libcrypto in some builds -> lib32-wavpack/5.6.0/recipe-sysroot-native/usr/lib/libcrypto.so: file not recognized: file format not recognized
License-Update: Copyright year changes
Changelog:
* added: AIFF file import/export support
* added: WATCOM compiler and OS/2 support
* added: cmake support for mingw, builds Cooledit + Winamp plugins
* added: --force-even-byte-depth option for rounding up bit depths
* fixed: detect and report PCM files having non-zero padding bits
* fixed: possible crash when displaying long channel assignments
* fixed: big-endian-sourced "raw" files gave big-endian "wav"s
* fixed: numerous minor issues
* fixed: CVE-2021-44269 (encoding crafted DSD file triggers OOB read crash)
* fixed: very long filenames cause stack-overflow crash in all CLI programs
* fixed: the length stored in WAV headers not always corrected when using -i
* fixed: attempting to encode raw DSD audio from stdin sometimes causes crash
* fixed: DSD to PCM decimation: small clicks between tracks and tiny DC offset
* fixed: length update in library-generated WAV headers on big-endian machines
* fixed: sanitize custom extensions read from WavPack files to be alphanumeric
* added: accepting brace-delimited options in the wavpack executable filename
* added: "--drop" option to Windows executables for multi-file "drag-and-drop"
* added" "--raw-pcm" option to wvunpack executable (does DSD --> 24-bit PCM)
* added: "--no-overwrite" option to wavpack executable (to resume sessions)
* improved: build system clean-up including switch to non-recursive "make"
* fixed: potential security issue CVE-2020-35738
* fixed: disable A32 asm code when building for Apple silicon
* fixed: issues with Adobe-style floating-point WAV files
* added: -vv option to wvunpack to quickly verify using just
block checksums (ideal for detecting corrupted files)
* added: --normalize-floats option to wvunpack for correctly
exporting un-normalized floating-point files
* updated: Visual Studio 2019 for Windows builds
* dropped: WinXP support in official binaries
* fixed: OSS-Fuzz issues 19925, 19928, 20060, 20448
(no CVEs or vulnerabilities)
* fixed: trailing garbage characters on imported ID3v2 TXXX tags
* fixed: various minor undefined behavior and memory access issues
* fixed: sanitize tag extraction names for length and path inclusion
* improved: reformat wvunpack "help" and split into long + short versions
* added: regression testing to Travis CI for OSS-Fuzz crashers
* fixed: potential security issues including the following CVEs:
CVE-2018-19840 CVE-2018-19841 CVE-2018-10536
CVE-2018-10537 CVE-2018-10538 CVE-2018-10539
CVE-2018-10540 CVE-2018-7254 CVE-2018-7253
CVE-2018-6767
* added: support for CMake, Travis CI, and Google's OSS-fuzz
* fixed: use correction file for encode verify (pipe input, Windows)
* fixed: correct WAV header with actual length (pipe input, -i option)
* fixed: thumb interworking and not needing v6 architecture (ARM asm)
* added: handle more ID3v2.3 tag items and from all file types
* fixed: coredump on Sparc64 (changed MD5 implementation)
* fixed: handle invalid ID3v2.3 tags from sacd-ripper
* fixed: several corner-case memory leaks
Signed-off-by: alperak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fixed do_package error when json-c is in the build dependencies chain:
ERROR: QA Issue: -dev package libv4l-dev contains non-symlink .so '/usr/lib/libv4l2tracer.so' [dev-elf]
This recipe builds out files such as av4l1compat.so v4l2convert.so and
libv4l2tracer.so which are not symlinks.
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Update faad2 to latest 2.11.1 release. Use SRCREV matching tag 2.11.1 .
Switch to cmake .
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The libvpx project has removed the support for these values, and
the recipe can't be built anymore for these arch's when these values
are used. The correct value for these arch's is `generic-gnu`,
which is used as a default fallthrough value for all platforms
in the recipe for arch's that are not specified explicitly.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
There is no version "2". The tag "jack2-control-api-relicense-nedko"
incorrectly triggered AUH to identify it as version "2". Additionally,
the previous recipe version "1.19.22" was also incorrect. It should
actually have been "1.9.22".
License-Update: Update the licenses based on analysis of the code
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The command "bitbake universe -c fetch" currently throws a ton of warnings
as there are many 'impossible' dependencies.
In some cases these variants may never have worked and were just added by copy
and paste of recipes. In some cases they once clearly did work but became
broken somewhere along the way. Users may also be carrying local bbappend files
which add further BBCLASSEXTEND.
Having universe fetch work without warnings is desireable so clean up the broken
variants. Anyone actually needing something dropped here can propose adding it
and the correct functional dependencies back quite easily. This also then
ensures we're not carrying or fixing things nobody uses.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
