curl: update to 7.62.0

deleted file mode 100644
index db07b43..0000000
@@ -1,37 +0,0 @@
-From 57d299a499155d4b327e341c6024e293b0418243 Mon Sep 17 00:00:00 2001
-From: Daniel Stenberg <[email protected]>
-Date: Mon, 13 Aug 2018 10:35:52 +0200
-Subject: [PATCH] Curl_ntlm_core_mk_nt_hash: return error on too long password
-
-... since it would cause an integer overflow if longer than (max size_t
-/ 2).
-
-This is CVE-2018-14618
-
-Bug: https://curl.haxx.se/docs/CVE-2018-14618.html
-Closes #2756
-Reported-by: Zhaoyang Wu
-
-CVE: CVE-2018-14618
-Upstream-Status: Backport
-Signed-off-by: Zhixiong Chi <[email protected]>
----
- lib/curl_ntlm_core.c | 5 ++++-
- 1 file changed, 4 insertions(+), 1 deletion(-)
-
-diff --git a/lib/curl_ntlm_core.c b/lib/curl_ntlm_core.c
-index e27cab353c..922e85a926 100644
---- a/lib/curl_ntlm_core.c
-+++ b/lib/curl_ntlm_core.c
-@@ -557,8 +557,11 @@ CURLcode Curl_ntlm_core_mk_nt_hash(struct Curl_easy *data,
-                                    unsigned char *ntbuffer /* 21 bytes */)
- {
-   size_t len = strlen(password);
--  unsigned char *pw = len ? malloc(len * 2) : strdup("");
-+  unsigned char *pw;
-   CURLcode result;
-+  if(len > SIZE_T_MAX/2) /* avoid integer overflow */
-+    return CURLE_OUT_OF_MEMORY;
-+  pw = len ? malloc(len * 2) : strdup("");
-   if(!pw)
-     return CURLE_OUT_OF_MEMORY;

deleted file mode 100644
index bf972d2..0000000
@@ -1,35 +0,0 @@
-From 55b90532f9190dce40a325b3312d014c66dc3ae1 Mon Sep 17 00:00:00 2001
-From: Changqing Li <[email protected]>
-Date: Thu, 1 Nov 2018 15:27:35 +0800
-Subject: [PATCH] Curl_auth_create_plain_message: fix too-large-input-check
-
-CVE-2018-16839
-Reported-by: Harry Sintonen
-Bug: https://curl.haxx.se/docs/CVE-2018-16839.html
-
-Upstream-Status: Backport [https://github.com/curl/curl/commit
-/f3a24d7916b9173c69a3e0ee790102993833d6c5?diff=unified]
-
-CVE: CVE-2018-16839
-
-Signed-off-by: Changqing Li <[email protected]>
----
- lib/vauth/cleartext.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/lib/vauth/cleartext.c b/lib/vauth/cleartext.c
-index 5d61ce6..1367143 100644
---- a/lib/vauth/cleartext.c
-+++ b/lib/vauth/cleartext.c
-@@ -74,7 +74,7 @@ CURLcode Curl_auth_create_plain_message(struct Curl_easy *data,
-   plen = strlen(passwdp);
- 
-   /* Compute binary message length. Check for overflows. */
--  if((ulen > SIZE_T_MAX/2) || (plen > (SIZE_T_MAX/2 - 2)))
-+  if((ulen > SIZE_T_MAX/4) || (plen > (SIZE_T_MAX/2 - 2)))
-     return CURLE_OUT_OF_MEMORY;
-   plainlen = 2 * ulen + plen + 2;
- 
--- 
-2.7.4
-

43 lines not on this page · raw message

deleted file mode 100644
index 82e7557..0000000
@@ -1,35 +0,0 @@
-From 0e4a6058b130f07cfa52fde8a3cb6f2abfe4c700 Mon Sep 17 00:00:00 2001
-From: Changqing Li <[email protected]>
-Date: Thu, 1 Nov 2018 15:30:56 +0800
-Subject: [PATCH] voutf: fix bad arethmetic when outputting warnings to stderr
-
-CVE-2018-16842
-Reported-by: Brian Carpenter
-Bug: https://curl.haxx.se/docs/CVE-2018-16842.html
-
-Upstream-Status: Backport [https://github.com/curl/curl/commit
-/d530e92f59ae9bb2d47066c3c460b25d2ffeb211]
-
-CVE: CVE-2018-16842
-
-Signed-off-by: Changqing Li <[email protected]>
----
- src/tool_msgs.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/tool_msgs.c b/src/tool_msgs.c
-index 9cce806..05bec39 100644
---- a/src/tool_msgs.c
-+++ b/src/tool_msgs.c
-@@ -67,7 +67,7 @@ static void voutf(struct GlobalConfig *config,
-         (void)fwrite(ptr, cut + 1, 1, config->errors);
-         fputs("\n", config->errors);
-         ptr += cut + 1; /* skip the space too */
--        len -= cut;
-+        len -= cut + 1;
-       }
-       else {
-         fputs(ptr, config->errors);
--- 
-2.7.4
-

similarity index 91%
rename from meta/recipes-support/curl/curl_7.61.0.bb
rename to meta/recipes-support/curl/curl_7.62.0.bb
index 56327a6..2baab2b 100644
@@ -7,14 +7,10 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=ef889a37a5a874490ac7ce116396f29a"
 
 SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \
            file://0001-replace-krb5-config-with-pkg-config.patch \
-           file://CVE-2018-14618.patch \
-           file://CVE-2018-16839.patch \
-           file://CVE-2018-16840.patch \
-           file://CVE-2018-16842.patch \
 "
 
-SRC_URI[md5sum] = "31d0a9f48dc796a7db351898a1e5058a"
-SRC_URI[sha256sum] = "5f6f336921cf5b84de56afbd08dfb70adeef2303751ffb3e570c936c6d656c9c"
+SRC_URI[md5sum] = "7adf426f80c68bbdd04d44b9bc171d61"
+SRC_URI[sha256sum] = "7802c54076500be500b171fde786258579d60547a3a35b8c5a23d8c88e8f9620"
 
 CVE_PRODUCT = "curl libcurl"
 inherit autotools pkgconfig binconfig multilib_header

similarity index 98%
rename from meta/recipes-support/nss/nss_3.39.bb
rename to meta/recipes-support/nss/nss_3.40.bb
index cdc95c6..23c95dd 100644
@@ -30,8 +30,8 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
            file://system-pkcs11.txt \
            "
 
-SRC_URI[md5sum] = "10720fc70fd483de1b085402fb10ed59"
-SRC_URI[sha256sum] = "6be64dd76f212415cc8bc34343ac1e7389048db4db9a023a84873c411dc5864b"
+SRC_URI[md5sum] = "f7aec858d192ae03d0e9a35a730c70fa"
+SRC_URI[sha256sum] = "0562087b8bda072bf5964f8acf851f9c0997a59c384f4887cb517b3b628b32dd"
 
 UPSTREAM_CHECK_URI = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Releases"
 UPSTREAM_CHECK_REGEX = "NSS_(?P<pver>.+)_release_notes"

similarity index 73%
rename from meta/recipes-graphics/xorg-lib/libx11-diet_1.6.6.bb
rename to meta/recipes-graphics/xorg-lib/libx11-diet_1.6.7.bb
index a4ba4e5..0bc08fc 100644
@@ -11,8 +11,8 @@ SRC_URI += "file://X18NCMSstubs.patch \
 RPROVIDES_${PN}-dev = "libx11-dev"
 RPROVIDES_${PN}-locale = "libx11-locale"
 
-SRC_URI[md5sum] = "6b0f83e851b3b469dd660f3a95ac3e42"
-SRC_URI[sha256sum] = "65fe181d40ec77f45417710c6a67431814ab252d21c2e85c75dd1ed568af414f"
+SRC_URI[md5sum] = "034fdd6cc5393974d88aec6f5bc96162"
+SRC_URI[sha256sum] = "910e9e30efba4ad3672ca277741c2728aebffa7bc526f04dcfa74df2e52a1348"
 
 EXTRA_OECONF += "--disable-xlocale"
 

index 0bc08fc..9c773a0 100644
@@ -11,9 +11,6 @@ SRC_URI += "file://X18NCMSstubs.patch \
 RPROVIDES_${PN}-dev = "libx11-dev"
 RPROVIDES_${PN}-locale = "libx11-locale"
 
-SRC_URI[md5sum] = "034fdd6cc5393974d88aec6f5bc96162"
-SRC_URI[sha256sum] = "910e9e30efba4ad3672ca277741c2728aebffa7bc526f04dcfa74df2e52a1348"
-
 EXTRA_OECONF += "--disable-xlocale"
 
 PACKAGECONFIG ??= ""

index 36c950a..ea2ebfb 100644
@@ -10,6 +10,9 @@ FILESEXTRAPATHS =. "${FILE_DIRNAME}/libx11:"
 
 PE = "1"
 
+SRC_URI[md5sum] = "034fdd6cc5393974d88aec6f5bc96162"
+SRC_URI[sha256sum] = "910e9e30efba4ad3672ca277741c2728aebffa7bc526f04dcfa74df2e52a1348"
+
 PROVIDES = "virtual/libx11"
 
 XORG_PN = "libX11"

index f0f1bfd..6141f57 100644
@@ -1,8 +1,5 @@
 require libx11.inc
 
-SRC_URI[md5sum] = "034fdd6cc5393974d88aec6f5bc96162"
-SRC_URI[sha256sum] = "910e9e30efba4ad3672ca277741c2728aebffa7bc526f04dcfa74df2e52a1348"
-
 SRC_URI += "file://disable_tests.patch \
             file://Fix-hanging-issue-in-_XReply.patch \
            "

deleted file mode 100644
index e0cced5..0000000
@@ -1,41 +0,0 @@
-From b9de21ef51a7ceab7122a707c188602eae22c4ee Mon Sep 17 00:00:00 2001
-From: Chris Clayton <[email protected]>
-Date: Mon, 20 Aug 2018 12:00:31 +0100
-Subject: [PATCH] kexec: fix for "Unhandled rela relocation: R_X86_64_PLT32" error
-
-In response to a change in binutils, commit b21ebf2fb4c
-(x86: Treat R_X86_64_PLT32 as R_X86_64_PC32) was applied to
-the linux kernel during the 4.16 development cycle and has
-since been backported to earlier stable kernel series. The
-change results in the failure message in $SUBJECT when
-rebooting via kexec.
-
-Fix this by replicating the change in kexec.
-
-Upstream-Status: Backport[https://git.kernel.org/pub/scm/utils/kernel/kexec/kexec-tools.git/commit/?id=b9de21ef51a7ceab7122a707c188602eae22c4ee]
-
-Signed-off-by: Chris Clayton <[email protected]>
-Acked-by: Baoquan He <[email protected]>
-Tested-by: Bhupesh Sharma <[email protected]>
-Acked-by: Bhupesh Sharma <[email protected]>
-Signed-off-by: Simon Horman <[email protected]>
-Signed-off-by: Mingli Yu <[email protected]>
----
- kexec/arch/x86_64/kexec-elf-rel-x86_64.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/kexec/arch/x86_64/kexec-elf-rel-x86_64.c b/kexec/arch/x86_64/kexec-elf-rel-x86_64.c
-index 7fdde73..db85b44 100644
---- a/kexec/arch/x86_64/kexec-elf-rel-x86_64.c
-+++ b/kexec/arch/x86_64/kexec-elf-rel-x86_64.c
-@@ -79,6 +79,7 @@ void machine_apply_elf_rel(struct mem_ehdr *UNUSED(ehdr),
- 			goto overflow;
- 		break;
- 	case R_X86_64_PC32: 
-+	case R_X86_64_PLT32:
- 		*(uint32_t *)location = value - address;
- 		break;
- 	default:
--- 
-2.7.4
-

similarity index 93%
rename from meta/recipes-kernel/kexec/kexec-tools_2.0.17.bb
rename to meta/recipes-kernel/kexec/kexec-tools_2.0.18.bb
index 4b9b5ac..b06c343 100644
@@ -18,11 +18,10 @@ SRC_URI = "${KERNELORG_MIRROR}/linux/utils/kernel/kexec/kexec-tools-${PV}.tar.gz
            file://0010-kexec-ARM-Fix-add_buffer_phys_virt-align-issue.patch \
            file://kexec-x32.patch \
            file://0001-Disable-PIE-during-link.patch \
-           file://0001-kexec-fix-for-Unhandled-rela-relocation-R_X86_64_PLT.patch \
            "
 
-SRC_URI[md5sum] = "8e071ca473694a71e4ae60ed7ef6f377"
-SRC_URI[sha256sum] = "450c87ba048641eb05f9717f5567aca57f063c266149ae663b58a34e5852deaf"
+SRC_URI[md5sum] = "43845327af54b002aaebd5b8076c7bd7"
+SRC_URI[sha256sum] = "594ac13ea437c70b0d5f0eaf5075b93422b05c23c2a5e21991d2442bbd202d86"
 
 inherit autotools update-rc.d systemd