This is a security update.
There are fixes for memory leaks, segfaults and CVEs.
CVE-2025-1735
CVE-2025-1220
CVE-2025-6491
Changelog: https://www.php.net/ChangeLog-8.php#8.4.10
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Plenty of other recipes inherit qemu unconditionally, including
some pretty foundational ones like python3, and they do not need
this fix. I think something else is going on here, and that issue
needs to be properly investigated.
There's a request to provide steps to observe the issue, but the original
patch author so far hasn't been able to reproduce it on demand:
https://lists.openembedded.org/g/openembedded-devel/topic/113861973
This reverts commit b2a950a75b15c93f625bfe6514bc248c9310813f.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The recipe unconditionally inherits the qemu class, because it executes
some target binaries when it is cross-compiled and the bit-width of the
build host and the target host are different.
Since it is unconditional, it also means that it is inherited for native
and nativesdk builds also. The qemu class uses some qemu options that are
always derived from the target machine's configuration, even when the
recipe is built for class-native. This means that some of the variables
used by the recipe changes (e.g. QEMU_OPTIONS), and the shared state cache
is invalidated when the target machine changes, even when nodejs-native is
being built - and it triggers a full rebuild of nodejs-native unnecessarily.
To avoid this, inherit the qemu class conditionally, only in case it is
used (when the target and build arch's bit-widths are different).
Also, inherit qemu-native based on the same condition, and move around the
qemu-dependent code a bit, so it will be only executed when the qemu class
is inherited.
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
- The build completes successfully without adding the flag. In fact, the flag is never actually added. Because:
If we use the += operator to add flags to the CC variable early in the recipe, changes will be overwritten because BitBake applies class assignments to CC at a later stage, which replaces any previous modifications. We should use :append to ensure that additions are applied to the final value, after all assignments from core classes have been processed.
- Additionally, the standard way to pass compiler flags in C projects is to use CFLAGS.
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is a small version bump. It includes to following two
commits to fix CVE-2025-4565.
05ba1a810 Add recursion depth limits to pure python
1ef3f01c4 Internal pure python fixes
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
The toolchain selection changes mean CC is not set until after the recipe
is parsed, breaking the manipulations made by this recipe.
Replace it with code to inherit the cmake class, which correctly
configures cmake to use the right compiler/compiler flags.
We need to patch the makefiles to avoid those options being added
incorrectly.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
CVE-2020-36774:
plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x
before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a
denial of service (application crash).
Reference:
[https://nvd.nist.gov/vuln/detail/CVE-2020-36774]
Upstream patches:
[7acdd3c6f6]
Signed-off-by: Zhang Peng <peng.zhang1.cn@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Refreshed abseil-cpp/0004-abseil-ppc-fixes.patch for 20250512.0
Change related to
abseil-cpp/0002-Remove-maes-option-from-cross-compilation.patch
abseil-cpp/0003-Remove-neon-option-from-cross-compilation.patch are
removed in
ea9951d3a9
abseil-cpp/0005-Fix-GCC15-warning-that-ciso646-is-deprecated-in-C-17.patch
is submitted in
5f3435aba0
Signed-off-by: Willy Tu <wltu@google.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
According to [1], there are 3 Xmlrpc-c releases: Super Stable,
Stable and Advanced, and Advanced is newly updated.
The version in stable sub directory is 1.60.0 which is mismatch
with recipe version
Switch to advanced sub directory, in which the version is 1.64.0
root@intel-x86-64:~# xmlrpc-c-config --version
1.64.0
[1] https://xmlrpc-c.sourceforge.io/downloading.php
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
It need gfortran to build and if we have clang as system compiler it
does not work properly to compile it.
Fixes
aarch64-yoe-linux-gfortran: fatal error: cannot read spec file 'libgfortran.spec': No such file or directory
compilation terminated.
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
==========
https://github.com/jqlang/jq/releases/tag/jq-1.8.0
Security fixes
* CVE-2024-23337: Fix signed integer overflow in jvp_array_write and jvp_object_rehash. @itchyny de21386
The fix for this issue now limits the maximum size of arrays and objects to 536870912 (2^29) elements.
* CVE-2024-53427: Reject NaN with payload while parsing JSON. @itchyny a09a4df
The fix for this issue now drops support for NaN with payload in JSON (like NaN123).
Other JSON extensions like NaN and Infinity are still supported.
* CVE-2025-48060: Fix heap buffer overflow in jv_string_vfmt. @itchyny c6e0416
* Fix use of uninitialized value in check_literal. @itchyny #3324
* Fix segmentation fault on strftime/1, strflocaltime/1. @itchyny #3271
* Fix unhandled overflow in @base64d. @emanuele6 #3080
Signed-off-by: Vijay Anusuri <vanusuri@mvista.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
GCC 15 seems to be confused about when the <version> header was
introduced (C++20) and expects it to be used with C++17.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This reverts commit 24ff52ba3b73757cc0255a5b19822e2e4d3d4e0a.
The original patch was my bad. The patches for oe-core were re-worked,
but I forgot the recall this patch.
In fact, inheriting qemu is needed because it sets a clear barriar
for people to use qemu user mode. And the QEMU_OPTIONS settings
are also in qemu.bbclass.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Fix HOMEPAGE
License Update: COPYING.GPL - whitespace changes and change of address of the
Free Software Foundation. COPYING.LGPL - whitespace changes and change of
address of the Free Software Foundation.
| checking for itstool... no
| configure: error: itstool not found
add itstool-native to DEPENDS to address configure failure.
| ERROR: glade-3.36.0-r0 do_configure: QA Issue: AM_GNU_GETTEXT used but no inherit gettext [configure-gettext]
inherit gettext to address QA error.
The code of gladeui/glade-command.c has changed from using
G_OBJECT (prop) to GLADE_PROPERTY (prop)
G_OBJECT (widget) to GLADE_WIDGET (widget)
thus resolving the incompatible pointer types seen in glade 3.22.2.
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changes for version 1.24
* Add a test for large BLOB with parameter
* Fix Dave Labley's broken e-mail address
* Stop parsing a column named "limits" as the LIMIT keyword (https://github.com/perl5-dbi/DBD-MariaDB/issues/208)
* Various test fixes (e.g. no dead loop in t/87async.t, remembering the value of --testauthplugin for repeated Makefile.PL runs, support for the Embedded server, explicit disconnect after testing the connection)
* Better handling of the Embedded server (e.g. fix mariadb_hostinfo and SQL_SERVER_NAME, no support for async queries and mariadb_max_allowed_packets, extended documentation of mariadb_embedded_options)
* Add new Makefile.PL option --requireembsup (and a corresponding env variable DBD_MARIADB_REQUIREEMBSUP) to ensure the client library's support for the Embedded server
* More support and fixes for new MySQL 8 features (mariadb_auto_reconnect for 8.0.24+, SSL options for MySQL 8.3.0+, bind params for 8.3.0+)
* Documentation of empty versus undefined password
* Stop calling mariadb_db_reconnect when changing $dbh attributes unless it's really needed
* On MSWin32, non-socket connections do not use WINAPI HANDLE
* Fix type (MEDIMUMBLOB -> MEDIUMBLOB)
* Handle new SSL error messages in tests (https://github.com/perl5-dbi/DBD-MariaDB/issues/209)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Changelog:
===========
* Spellcheck
* Fix Makefile rules for Changes (Windows case issue)
* Another example to bind columns (issue#159)
* Fix fetchall_arrayref for undefined NAME (issue#156)
Signed-off-by: Jason Schonberg <schonm@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Avoid inheriting qemu.bbclass and use oe.qemu.xxx instead.
Also, the 'qemu-native' dep is replaced by 'qemuwrapper-cross' for
PACKAGE_WRITE_DEPS. qemuwrapper-cross is the one that is actually
used by postints and it has 'qemu-native' in DEPENDS.
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Brotli can crash nodejs (on ARM), because the memory allocated for
brotli wasn't properly aligned.
https://github.com/google/brotli/issues/1159dc035bbc9b
Signed-off-by: Jeroen Hofstee <jhofstee@victronenergy.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
* License-Update:
Copyright year updated to 2025
* It seems snprintf in glibc is locale-aware. And it will format
floating-point numbers according to the locale when the numeric
locale is set (e.g., de_DE).
But in musl, snprintf does not respect locale settings for number
formatting. It will always use a period as the decimal separator
regardless of the locale set.
So exclude TEST CASE "locale-dependent test (LC_NUMERIC=de_DE)" [1]
right now and add the case back once the issue resolved by upstream.
# ./run-ptest
PASS: test-algorithms_cpp11
PASS: test-allocator_cpp11
PASS: test-alt-string_cpp11
PASS: test-assert_macro_cpp11
PASS: test-binary_formats_cpp11
PASS: test-bjdata_cpp11
PASS: test-bson_cpp11
PASS: test-byte_container_with_subtype_cpp11
PASS: test-capacity_cpp11
PASS: test-cbor_cpp11
PASS: test-class_const_iterator_cpp11
PASS: test-class_iterator_cpp11
PASS: test-class_lexer_cpp11
PASS: test-class_parser_cpp11
[snip]
[1] https://github.com/nlohmann/json/issues/4767
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
