busybox: security bump to version 1.24.2

The version bump doesn't inherently fix the security issues, however the added CVE patches do, which fix:

CVE-2016-2147 - out of bounds write (heap) due to integer underflow in udhcpc.
CVE-2016-2148 - heap-based buffer overflow in OPTION_6RD parsing.

Drop patches that are upstream as well.

---
 ...gs-strip-non-l-arguments-returned-by-pkg.patch} |   0
 package/busybox/0002-unzip.patch                   | 111 -----------------
 package/busybox/0003-ash-recursive-heredocs.patch  |  84 +++++++++++++
 .../busybox/0003-g-unzip-fix-recent-breakage.patch | 134 ---------------------
 package/busybox/0004-fix-CVE-2016-2147.patch       |  73 +++++++++++
 package/busybox/0004-truncate-open-mode.patch      |  74 ------------
 package/busybox/0005-fix-CVE-2016-2148.patch       |  56 +++++++++
 package/busybox/busybox.hash                       |   6 +-
 package/busybox/busybox.mk                         |   2 +-
 9 files changed, 217 insertions(+), 323 deletions(-)
 rename package/busybox/{0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch => 0002-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch} (100%)
 delete mode 100644 package/busybox/0002-unzip.patch
 create mode 100644 package/busybox/0003-ash-recursive-heredocs.patch
 delete mode 100644 package/busybox/0003-g-unzip-fix-recent-breakage.patch
 create mode 100644 package/busybox/0004-fix-CVE-2016-2147.patch
 delete mode 100644 package/busybox/0004-truncate-open-mode.patch
 create mode 100644 package/busybox/0005-fix-CVE-2016-2148.patch

similarity index 100%
rename from package/busybox/0008-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch
rename to package/busybox/0002-Makefile.flags-strip-non-l-arguments-returned-by-pkg.patch

index 99fb8e4..7486aeb 100644
@@ -1,3 +1,3 @@
-# From http://busybox.net/downloads/busybox-1.24.1.tar.bz2.sign
-md5 be98a40cadf84ce2d6b05fa41a275c6a  busybox-1.24.1.tar.bz2
-sha1 157d14d24748b4505b1a418535688706a2b81680  busybox-1.24.1.tar.bz2
+# From http://busybox.net/downloads/busybox-1.24.2.tar.bz2.sign
+md5	2eaae519cac1143bcf583636a745381f	busybox-1.24.2.tar.bz2
+sha1	03e6cfc8ddb2f709f308719a9b9f4818bc0a28d0	busybox-1.24.2.tar.bz2

index 7c904c8..c7fb8b4 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-BUSYBOX_VERSION = 1.24.1
+BUSYBOX_VERSION = 1.24.2
 BUSYBOX_SITE = http://www.busybox.net/downloads
 BUSYBOX_SOURCE = busybox-$(BUSYBOX_VERSION).tar.bz2
 BUSYBOX_LICENSE = GPLv2

2.7.3

I also have problems applying this one:

Applying: busybox: security bump to version 1.24.2 .git/rebase-apply/patch:190: space before tab in indent.

        int t;
.git/rebase-apply/patch:193: space before tab in indent.
        smallint alreadyseen = tokpushback;
.git/rebase-apply/patch:196: space before tab in indent.
        /*
.git/rebase-apply/patch:197: space before tab in indent.
         * eat newlines
.git/rebase-apply/patch:198: space before tab in indent.
         */

fatal: corrupt patch at line 444
Patch failed at 0001 busybox: security bump to version 1.24.2

Bye, Peter Korsgaard

Odd, it does apply if i download it from patchwork into a clean buildroot tree.
I do get the warnings, but the whitespace is inherent in the CVE patches. Regards.

Hi,

I cannot even get it from patchwork here:

pwclient get 602119
Traceback (most recent call last):
File "/home/peko/bin/pwclient", line 500, in <module>

    main()
  File "/home/peko/bin/pwclient", line 465, in main
    action_get(rpc, patch_id)
  File "/home/peko/bin/pwclient", line 238, in action_get
    s = rpc.patch_get_mbox(patch_id)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1224, in __call__
    return self.__send(self.__name, args)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1578, in __request
    verbose=self.__verbose
  File "/usr/lib/python2.7/xmlrpclib.py", line 1264, in request
    return self.single_request(host, handler, request_body, verbose)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1297, in single_request
    return self.parse_response(response)
  File "/usr/lib/python2.7/xmlrpclib.py", line 1467, in parse_response
    p.feed(data)
  File "/usr/lib/python2.7/xmlrpclib.py", line 557, in feed
    self._parser.Parse(data, 0)

xml.parsers.expat.ExpatError: not well-formed (invalid token): line 142, column 22

Venlig hilsen,
Peter Korsgaard 

Hi.
I've downloaded directly (mbox) via web, i'm not using pwclient. Regards.

Hi,

Funky, that works. Committed, thanks.

Venlig hilsen,
Peter Korsgaard