6 Commits

Author SHA1 Message Date
Dan Tran
bda26ff31c perl: Fix CVE-2018-18311 to 18314
(From OE-Core rev: cffd085ef77d055e5e837887b0eaf820aa982f00)

Signed-off-by: Dan Tran <dantran@microsoft.com>
[Perl before 5.26.3 and 5.28.x before 5.28.1]
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-10-10 16:52:30 +01:00
Anuj Mittal
bfa9068b40 perl: skip tests that are not useful
Some tests, like the one that compares the hashes for a list of files
against those stored in a .dat file, don't make sense for downstream
distros packaging perl.

Backport a patch from upstream that allows skipping of these tests at
runtime. Also remove the local patch trying to keep hashes up-to-date
for one of those tests.

Fixes [YOCTO #12787]

(From OE-Core rev: 557f4618b75b8739a647e46054ab587ae2bbdc25)

Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-16 20:35:43 +01:00
Robert Yang
e3bca3c8d0 perl: fix race issues for MakeMaker
Fixed a race issue when compile libhtml-parser-perl and others who use MakeMaker:
[snip]
chmod 755 blib/arch/auto/HTML/Parser/Parser.so
chmod 644 "Parser.bs"
[snip]

The rule INST_DYNAMIC removes '.bs' file which are generated by BOOTSTRAP, but
the have no dependencies, so there is a race issue:

BOOTSTRAP:
    touch foo.bs
    chmod 755 foo.bs

INST_DYNAMIC:
    rm -fr foo.bs

The error would happen when INST_DYNAMIC removes foo.bs after BOOTSTRAP touched
it but before chmod on it.

(From OE-Core rev: f33d7124cd07f776e8b05a26703f6d551357ae09)

Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-25 23:15:49 +01:00
Jagadeesh Krishnanjanappa
227a6c1acb perl: CVE-2018-12015
Remove existing files before overwriting them

Archive should extract only the latest same-named entry.
Extracted regular file should not be writtent into existing block
device (or any other one).

https://rt.cpan.org/Ticket/Display.html?id=125523

Affects perl <= 5.26.2

(From OE-Core rev: 037b205e89ae4c7d638a5c15d64f60e16facbaa2)

Signed-off-by: Jagadeesh Krishnanjanappa <jkrishnanjanappa@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:01 +01:00
Andre McCurdy
fa3529e117 perl: avoid using += with an over-ride
Using += with an over-ride can be a source of confusion so try to
avoid the construct in core recipes.

(From OE-Core rev: 2588c2aae11b7b480022dc11575295fdc792bf3f)

Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-08-23 07:50:00 +01:00
Andrej Valek
c24db0fd6e perl: update to 5.24.4
- fix CVE-2018-6797, CVE-2018-6798, CVE-2018-6913
 - remove patches, which are now included in update
 - refresh patches

(From OE-Core rev: c0dac0d600e81054104f7b377f7c266aa83df371)

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-18 10:18:42 +01:00