patch: fix CVE-2015-1196

The following changes since commit 2d923d6dfe9431dbc005f8ba39838eb4519c471c:

python-pygobject: Disable parallel make install in native case (2015-03-25 12:38:44 +0000)

are available in the git repository at:

git://git.openembedded.org/openembedded-core-contrib rbt/patch
http://cgit.openembedded.org/cgit.cgi/openembedded-core-contrib/log/?h=rbt/patch

Robert Yang (1):
patch: fix CVE-2015-1196

 meta/recipes-devtools/patch/patch.inc              |    5 +-
 .../patch/patch/patch-CVE-2015-1196.patch          |  200 ++++++++++++++++++++
 2 files changed, 204 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/patch/patch/patch-CVE-2015-1196.patch

1.7.9.5

A directory traversal flaw was reported in patch:

References:
http://www.openwall.com/lists/oss-security/2015/01/18/6
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=775227
https://bugzilla.redhat.com/show_bug.cgi?id=1182154

[YOCTO #7182]

---
 meta/recipes-devtools/patch/patch.inc              |    5 +-
 .../patch/patch/patch-CVE-2015-1196.patch          |  200 ++++++++++++++++++++
 2 files changed, 204 insertions(+), 1 deletion(-)
 create mode 100644 meta/recipes-devtools/patch/patch/patch-CVE-2015-1196.patch

index 332b97a..d306403 100644
@@ -4,7 +4,10 @@ produced by the diff program and applies those differences to one or more \
 original files, producing patched versions."
 SECTION = "utils"
 
-SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz"
+SRC_URI = "${GNU_MIRROR}/patch/patch-${PV}.tar.gz \
+        file://patch-CVE-2015-1196.patch \
+        "
+
 S = "${WORKDIR}/patch-${PV}"
 
 inherit autotools update-alternatives

1.7.9.5

This patch shouldn't change the .inc but the versioned .bb file instead, otherwise non-gplv3 builds fail.

In the interests of expedience, I tweaked the patch to apply to the versioned .bb file instead and queued it.

Cheers,

Richard

Thank you very much.

// Robert