Commit graph

36245 commits

Author SHA1 Message Date
Zoltan Gyarmati 7d62960bdc package/quazip: bump to v0.8.1
And also add the hash of the COPYING file

Signed-off-by: Zoltan Gyarmati <zgyarmati@zgyarmati.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-03 00:32:27 +02:00
Fabrice Fontaine 82fc6379f0 package/vte: needs host-intltool
Fixes:
 - http://autobuild.buildroot.org/results/30a8032ebba5a30bacd321c407a1d0734fadf757

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-03 00:26:48 +02:00
Jugurtha BELKALEM f4dae144f7 package/qemu: remove comment about sh64
sh64 has been removed since commit [1]:

[1] 4338a319b7

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 23:49:11 +02:00
Jugurtha BELKALEM 8a2d60fe7e package/qemu: enable sparc64 support in host-qemu
This change enables host qemu support for sparc64 which among other
things allows to test this architecture in gitlab.

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 23:48:49 +02:00
Jugurtha BELKALEM 5755e6d7c3 package/qemu: enable nios2 support in host-qemu
This change enables host qemu support for nios2 which among other
things allows to test this architecture in gitlab.

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 23:48:14 +02:00
Peter Korsgaard e5c6f9f497 package/python-matplotlib: needs a toolchain with C++ support
Matplotlib contains .cpp source code:

ls src/*.cpp
src/_backend_agg.cpp
src/_backend_agg_wrapper.cpp
src/_contour.cpp
src/_contour_wrapper.cpp
src/ft2font.cpp
src/ft2font_wrapper.cpp
src/_image.cpp
src/_image_wrapper.cpp
src/mplutils.cpp
src/_path_wrapper.cpp
src/_png.cpp
src/py_converters.cpp
src/_tkagg.cpp
src/_ttconv.cpp
src/_windowing.cpp

So add a dependency on C++ support in the toolchain to fix build errors like
(no autobuilder reference yet):

../output/host/bin/powerpc-buildroot-linux-uclibc-gcc -Wno-unused-result \
  -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -D_LARGEFILE_SOURCE \
  -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -fPIC \
  -DFREETYPE_BUILD_TYPE=system \
  -DPY_ARRAY_UNIQUE_SYMBOL=MPL_matplotlib_ft2font_ARRAY_API \
  -DNPY_NO_DEPRECATED_API=NPY_1_7_API_VERSION -D__STDC_FORMAT_MACROS=1 \
  -I../output/host/lib/python3.7/site-packages/numpy/core/include \
  -Iextern/agg24-svn/include \
  -I../output/host/bin/../powerpc-buildroot-linux-uclibc/sysroot/usr/include \
  -I../output/host/bin/../powerpc-buildroot-linux-uclibc/sysroot/usr/include/freetype2 \
  -I. \
  -I../output/host/powerpc-buildroot-linux-uclibc/sysroot/usr/include/python3.7m \
  -c src/ft2font.cpp -o build/temp.linux-x86_64-3.7/src/ft2font.o
powerpc-buildroot-linux-uclibc-gcc.br_real: error: src/ft2font.cpp: C++
  compiler not installed on this system

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:34:26 +02:00
Pierre-Jean Texier 0b77804697 package/libevent: bump to version 2.1.11
See https://github.com/libevent/libevent/releases

Also remove upstreamed patch (already in version)

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:31:00 +02:00
Fabrice Fontaine 8c4baea84e package/gupnp-tools: bump to version 0.8.15
- Switch to meson-package
- Add patch to fix build without gupnp-av

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:01:38 +02:00
Fabrice Fontaine 66a3fbb9f6 package/gupnp: bump to version 1.0.4
- Switch to meson-package
- Disable introspection (enabled by default)
- Disable examples (enabled by default)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:01:19 +02:00
Fabrice Fontaine f923cccb64 package/gssdp: bump to version 1.0.3
- Switch to meson-package
- Disable examples (enabled by default)
- Disable introspection (enabled by default)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:00:42 +02:00
Fabrice Fontaine 67563ac051 package/gssdp: add optional libgtk3 dependency
gssdp's sniffer depends on libgtk3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 23:00:27 +02:00
Romain Naour 77b3c089e9 package/gcc: remove libmudflap option
libmudflap was removed from gcc 4.9 [1] so it depends on gcc <= 4.9.
This option can't be selected since we removed gcc 4.8 from Buildroot
[2].

[1] 4a692aefee
[2] f66952197b

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 22:51:54 +02:00
Romain Naour d36f2c7333 package/gdb: remove gdb 7.12.1
gdb 7.12.1 was released on 21 Jan 2017 [1] and is the last version that
doesn't requires a C++11 compiler.  Since Buildroot now support three other
gdb versions (8.1, 8.2 and 8.3), reduce the number of choice by dropping
7.12.1.

Remove BR2_PACKAGE_GDB_NEEDS_CXX11 symbol since it's not useful
anymore.

[1] https://lists.gnu.org/archive/html/info-gnu/2017-01/msg00009.html

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 22:49:23 +02:00
Fabrice Fontaine 5b169afaa4 package/quagga: bump to version 1.2.4
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 22:48:00 +02:00
Fabrice Fontaine 5f867b988b package/dnsmasq: fix build with kernel >= 5.2
Fixes:
 - http://autobuild.buildroot.org/results/edfe5d208f1626903ce16cd481a29e54f9e8c611

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 22:47:37 +02:00
Fabrice Fontaine bc153c3930 package/pdbg: fix musl build
Fixes:
 - http://autobuild.buildroot.org/results/81b1107bdb06250e1a7837506aec0c9762e771c5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 22:46:14 +02:00
Bernd Kuhls 2205122ee2 package/mpv: bump version to 0.29.1
Added license hash, removed patches:

0003: upstream PR was closed as 'merged'
0004: patch was backported and is now included

Renamed license file according to upstream change.

Support for sdl1 was removed upstream:
1dcf511376

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-02 22:25:55 +02:00
Peter Korsgaard 60d516989e {linux, linux-headers}: bump 4.{14, 19}.x / 5.2.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 19:46:55 +02:00
Peter Korsgaard 5660ed9c55 package/mosquitto: bump to version 1.6.4
Bugfix release, fixing a number of issues.  For details, see the
announcement:

https://mosquitto.org/blog/2019/08/version-1-6-4-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 19:46:48 +02:00
Peter Korsgaard 273427f928 package/imagemagick: fix host build for old distributions
Fixes:
http://autobuild.buildroot.net/results/5f0/5f0b85033e800c9eebc46812592966ec6826bb5d/

imagemagick uses clock_gettime, which was provided by librt rather than libc
in glibc < 2.17 - Causing link errors.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-02 19:46:40 +02:00
Arnout Vandecappelle (Essensium/Mind) 651524db3a package/Config.in: remove double /
Detected by check-package, which gets confused by it.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-02 18:43:57 +02:00
Titouan Christophe 22f3c69149 package/mosquitto: fix typo in Config.in
Introduced in ea989ad2b2

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 17:28:19 +02:00
Petr Vorel 74cbe7cbbf package/iputils: fix build with thread support disabled
Fixes:
http://autobuild.buildroot.net/results/10652b7bf6a606f0dd802916006c44abf3e5e059
http://autobuild.buildroot.net/results/9656af1aafbd2624fb75bf5fc1dfa13b6175c10b
http://autobuild.buildroot.net/results/2e170e149b293d40978e158d55dc0102315b9d86

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 17:27:16 +02:00
Marcel Patzlaff 59f5617148 package/pkg-kconfig.mk: new <pkg>-diff-config target
This patch introduces the new target to compare the current
configuration with the one derived from the defconfig + fragments (if
any). It helps identifying settings not yet inserted to the defconfig
or any fragment.

Signed-off-by: Marcel Patzlaff <m.patzlaff@pilz.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 17:18:25 +02:00
Marcel Patzlaff 38a1954ad9 package/pkg-kconfig.mk: reusability improvements
This patch refactors savedefconfig and the configuration re-generation
to separate macros so that the functionality can be re-used in further
rules.

Signed-off-by: Marcel Patzlaff <m.patzlaff@pilz.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 17:18:25 +02:00
Julien BOIBESSOT 9ace1cff33 package/mtd: needs zstd
For the target variant, zstd is an optional dependency when ubifs-tools
are enabled. For the host variant, we make it an unconditional
dependency.

Fixes:
http://autobuild.buildroot.org/results/99baf1de106f9c80a32e665263c1e4278097643d (target)
http://autobuild.buildroot.org/results/e3b96704f0b23e82999aa3d6e93233edecbecfe7 (host)

Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com>
Tested-by: Markus Mayer <mmayer@broadcom.com>
[yann.morin.1998@free.fr: fix the target variant too]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-02 17:10:50 +02:00
Arnout Vandecappelle (Essensium/Mind) d7215f2bbb package/quagga: fix static linking with getopt
quagga has its own copy of getopt_long() instead of using the system's,
and this copy also defines the opterr and optind variables. Obviously,
this is only apparent when linking statically.

This problem can easily be avoided by making sure that getopt() itself
is defined too. This way, there is no reason any more to pull in libc's
getopt() and the corresponding definitions of opterr and optind. Note
that getopt() itself is pulled in by netsnmp, not by quagga itself.

Fortunately, there's a REALLY_NEED_PLAIN_GETOPT flag that we can define
to make sure getopt() does get built by quagga. We can safely do this
unconditionally (instead of only when BR2_PACKAGE_QUAGGA_SNMP and
BR2_STATIC_LIBS are enabled): without netsnmp, getopt() will simply not
be used, and with dynamic libs there's no risk of conflicts anyway.

Fixes:
http://autobuild.buildroot.net/results/0ac598c2259a8d7e8b72d4e8ed95079675b31b84

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 10:29:07 +02:00
Thomas Petazzoni b9c2894298 package/bison: fix parallel build issue
Following the bump of Bison to 3.4.1 in commit
d3c2f33543, the build started failing on
autobuilders using a fairly old version of make (3.81). The failure is
caused by a parallel build problem in examples/c/reccalc/.

Fixing it is not trivial, and would require autoreconf, which then
fails due to help2man being missing. So for the time being, simply
disable parallel build on bison.

The issue has been reported to the bug-bison@ mailing list, but the
e-mail doesn't appear yet in the mailing list archives.

Fixes:

  http://autobuild.buildroot.net/results/856/8568bcef944096f2c21470d36f02b520989af5eb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-02 09:46:23 +02:00
Fabrice Fontaine 332c7b1992 package/dropwatch: remove binutils dependency
Add a patch to make binutils optional and disable it in the context of
buildroot as suggested by Thomas in
https://patchwork.ozlabs.org/patch/1134299

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 23:26:25 +02:00
Angelo Compagnucci 74d9e5d9b8 package/mono: bump to version 6.0.0.313
This patch bumps mono to version 6.0.0.313 and it's related dependency
monolite to version d0aa6798-834d-11e9-b38a-3b0d70487d01.

The hash of the mono license file has changed, with the following
modification:

-* mcs/nunit24: MS-PL
-

However, this modification is in the "Build Time Code" section, which
describes the license of the parts of the code used only at build
time, which we don't document in the <pkg>_LICENSE
variable. Therefore, no relevant licensing change has occured from the
point of view of <pkg>_LICENSE.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
[Thomas: update the hash of the license file, and add a corresponding
explanation in the commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-01 23:06:09 +02:00
Bernd Kuhls b9833c6f52 package/php: security bump version to 7.3.8
Release notes: https://www.php.net/ChangeLog-7.php#7.3.8

Fixes CVE-2019-11042 & CVE-2019-11041

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 22:53:13 +02:00
Philip Molloy ffe9eaf337 system: directly use system shell as root shell
Rather than through the /bin/sh symlink, because because invocating bash as
sh causes bash to mimic sh (see INVOCATION in bash(1)).

Signed-off-by: Philip Molloy <philip.a.molloy@gmail.com>
[yann.morin.1998@free.fr: use the system shell, not a new option,
 as suggested by Arnout]
[Peter: describe why this is done using the description from Philip's help
 text]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 22:49:50 +02:00
Arnold Bloemert f0453de25d package/gst1-plugins-good: add shout2 plugin option
Signed-off-by: Arnold Bloemert <abloemert@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-01 21:10:52 +02:00
Romain Naour a2e71ff581 package/piglit: new package
Piglit is an open-source test suite for OpenGL implementations.
It's an python3 script based around several tools like glxinfo,
wflinfo, dmesg.

Even though waffle support can be replaced by freeglut,
using pliglit with waffle is recommended since freeglut
will be replaced by waffle.

Add host-python-{mako,numpy,six} dependency since the build system
is checking with the host-python interpreter.

There is no comment about waffle dependency due to too complex
dependencies of waffle.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[Reworked during the Buildroot summer camp 2019]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Arnout: small corrections to license info. It's messy.]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-01 21:01:17 +02:00
Petr Vorel 9440f3554b package/iputils: use capabilities if possible
If support for extended attributes is enabled, then we can use them to
store capabilities. If not, we keep using the setuid bit.

arping does not get a capability, as it can be used for arp poisoning.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[yann.morin.1998@free.fr:
  - resort to using q full-fledged conditional block
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 20:22:03 +02:00
Yann E. MORIN d413204a32 package/iputils: drop setuid on arping
arping can be used for arp poisoning, so it should really not be setuid.

Reported-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Acked-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 20:21:27 +02:00
Fabrice Fontaine 6f05569211 package/gmrender-resurrect: bump to version a7b0b1b9ca482d2d34ac62c2f2dc0cf0dfbb702b
Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 20:14:48 +02:00
Fabrice Fontaine ff68ca92cb package/cloop: bump to version 3.14.1.2
- Remove patch, it is not needed anymore as CFLAGS/LDFLAGS are now
  correctly passed to extract_compressed_fs. CFLAGS/LDFLAGS are not
  passed to cloop_suspend but it isn't built. Moreover original CFLAGS
  are lost but this is acceptable)
- Switch site to http://snapshot.debian.org/archive/debian as
  http://debian-knoppix.alioth.debian.org/packages/sources/cloop is not
  available anymore
- Add hash for license files

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 20:12:19 +02:00
Fabrice Fontaine edf97df877 package/cloop: needs _GNU_SOURCE
host-cloop needs _GNU_SOURCE for loff_t otherwise build fails with gcc
8.3.0 on:
extract_compressed_fs.c: In function 'main':
extract_compressed_fs.c:55:2: error: unknown type name 'loff_t'; did you mean 'off_t'?
  loff_t *offsets;

Fixes:
 - No autobuilder failures

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 20:12:04 +02:00
Vincent Stehlé 499dfc9410 qemu: fix host virtfs option
Fix the build of host-qemu with virtfs enabled: fix a typo in makefile
conditional and add a dependency on host-libcap as that is a dependency of
virtfs support:

    if test "$virtfs" != no && test "$cap" = yes && test "$attr" = yes ; then
      virtfs=yes

The virtfs configuration option was added by commit e0f49e6484
("package/qemu: add option to enable virtual filesystem in host qemu").

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 19:56:03 +02:00
Fabrice Fontaine 02137d6397 package/glib-networking: needs dynamic library
glib-networking uses the meson's shared_module function

This is a partly revert of commit
ed3eef6bb4 'package/glib-networking: bump
to version 2.61.1' re-adding the dynamic library dependency due to the
meson's build system and not from gnutls

Fixes:
 - http://autobuild.buildroot.org/results/60037e37e020404485df9814f3f3ad4e3b2abdb3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 19:38:46 +02:00
Fabrice Fontaine cf5170adae package/assimp: bump to version 4.1.0
- Remove second patch (already in version)
- Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 18:47:12 +02:00
Matt Weber 2abba0dfb3 package/llvm: disable libxml2
libxml2 is needed during Windows builds to populate the COFF
file manifest info.  This isn't required for Linux builds.

Cc: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-01 18:43:19 +02:00
Matt Weber d899557e4e package llvm/clang: note about version bumping dep
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Acked-by: Romain Naour <romain.naour@smile.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-08-01 18:42:09 +02:00
Peter Korsgaard a62cd7dd4c package/python-django: security bump to version 2.2.4
Fixes the following security issues:

CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator

If django.utils.text.Truncator's chars() and words() methods were passed the
html=True argument, they were extremely slow to evaluate certain inputs due
to a catastrophic backtracking vulnerability in a regular expression.  The
chars() and words() methods are used to implement the truncatechars_html and
truncatewords_html template filters, which were thus vulnerable.

The regular expressions used by Truncator have been simplified in order to
avoid potential backtracking issues.  As a consequence, trailing punctuation
may now at times be included in the truncated output.

CVE-2019-14233: Denial-of-service possibility in strip_tags()

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate certain
inputs containing large sequences of nested incomplete HTML entities.  The
strip_tags() method is used to implement the corresponding striptags
template filter, which was thus also vulnerable.

strip_tags() now avoids recursive calls to HTMLParser when progress removing
tags, but necessarily incomplete HTML entities, stops being made.

Remember that absolutely NO guarantee is provided about the results of
strip_tags() being HTML safe.  So NEVER mark safe the result of a
strip_tags() call without escaping it first, for example with
django.utils.html.escape().

CVE-2019-14234: SQL injection possibility in key and index lookups for
JSONField/HStoreField

Key and index lookups for django.contrib.postgres.fields.JSONField and key
lookups for django.contrib.postgres.fields.HStoreField were subject to SQL
injection, using a suitably crafted dictionary, with dictionary expansion,
as the **kwargs passed to QuerySet.filter().

CVE-2019-14235: Potential memory exhaustion in
django.utils.encoding.uri_to_iri()

If passed certain inputs, django.utils.encoding.uri_to_iri could lead to
significant memory usage due to excessive recursion when re-percent-encoding
invalid UTF-8 octet sequences.

uri_to_iri() now avoids recursion when re-percent-encoding invalid UTF-8
octet sequences.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 18:38:12 +02:00
Bernd Kuhls 29ee5bb352 package/nano: bump version to 4.3
Release notes:
https://lists.gnu.org/archive/html/info-gnu/2019-06/msg00004.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 18:31:51 +02:00
Carlos Santos ffe5fcadfc package/dhcp: fix target installation
We don't use "make install" for the target installation so we must pick
the executables from the ".libs" directories on which libtool generates
them otherwise we install the automatically generated wrapper scripts.

This was not necessary before the upgrade to version 4.4.1.

Fixes: https://bugs.busybox.net/show_bug.cgi?id=12051

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-01 18:26:09 +02:00
Fabrice Fontaine 2405cd042a package/rtorrent: bump to version 0.9.8
Remove patch (already in version) and drop AUTORECONF as it is not
needed anymore

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 18:21:03 +02:00
Fabrice Fontaine 26545af9a1 package/libtorrent: bump to version 0.13.8
Remove both patches (already in version) and drop AUTORECONF as it is
not needed anymore

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-01 18:20:40 +02:00
Pierre-Jean Texier 070bebfa0b package/tinyxml2: bump to version 7.0.1
Even though the hash of the license file changes, there are no changes
in the licensing terms themselves. There are changes in other parts of
readme.md, and whitespace changes in the licensing terms, but no
licensing term changes per-se.

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
[Thomas: add explanation about the license file hash change]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-01 18:18:11 +02:00