Fiedler Roman discovered that coreutils' parse_datetime() function
has some flaws that may be exploitable if the date(1), touch(1),
or potentially other programs, accept untrusted input for certain
parameters. While researching this issue, he discovered that it
was independently discovered by Bertrand Jacquin and reported at
http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16872
$ touch '--date=TZ="123"345" @1'
*** Error in `touch': free(): invalid pointer: 0x00007fffd33e55e0 ***
Aborted
$ date '--date=TZ="123"345" @1'
date[394]: segfault at 7fff24000000 ip 00007f6dd5b73404 sp 00007fff27cce8f8
error 4 in libc-2.20.so[7f6dd5af7000+199000]
Segmentation fault
(From OE-Core rev: 54debe63cbd38dba56895541c434f895e158f70b)
Signed-off-by: Maxin B. John <maxin.john@enea.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed when build with meta-selinux even with --without-selinux:
runcon.c:49:28: fatal error: selinux/flask.h: No such file or directory
# include <selinux/flask.h>
^
compilation terminated.
(From OE-Core rev: d52a606c8a75496f3b7239adc19fdb66e3ae576a)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upgrade coreutils to 8.22.
Changes since 8.21:
1) Remove the acl patch as it's not needed now.
2) Add a new patch to fix the following compile error.
"dummy-man: too many non-option arguments"
(From OE-Core rev: 144a48e34d17fd8736a482bae4ee69efc37b8a1f)
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
