| Age | Commit message (Collapse) | Author |
|---|
|
Backport patch to fix CVE-2018-18751 for gettext. Because po-gram-gen.y
has been modified by fix-CVE-2018-18751.patch, it requires yacc which
provided by bison-native to re-create po-gram-gen.c. Please remove
bison-native from DEPENDS* when next upgrade.
Ref:
https://security-tracker.debian.org/tracker/CVE-2018-18751
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
For reasons I can't explain gettext uses several hundred lines of convoluted m4
to find the paths to a library.
If we don't tell it where to find a library it will hunt around and potentially
have host contamination as /usr/lib on the host is explicitly searched.
If we tell it the prefix to a library then we get bad RPATHs in the binaries
(such as /usr/lib/../lib), and the search assumes that it knows best about what
the library directories are under that prefix (even when it's wrong).
So, replace the lookup where possible with pkg-config calls (libxml2, glib,
libcroco). libunistring doens't have a pkgconfig file so just don't use the
system libunistring: the library is tiny anyway.
(From OE-Core rev: 1ff35fbbdd50660b86f8e254685ae0c8338b6e11)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
|
Fixed when compile with "-Wformat -Wformat-security -Werror=format-security":
| gettext-tools/gnulib-lib/libcroco/cr-statement.c: In function 'cr_statement_dump_charset':
| gettext-tools/gnulib-lib/libcroco/cr-statement.c:2661:17: error: format not a string literal and no format arguments [-Werror=format-security]
| fprintf (a_fp, str) ;
And:
gettext-tools/gnulib-lib/libxml/timsort.h:326:80: warning: format '%lu' expects argument of type 'long unsigned int', but argument 3 has type 'unsigned int' [-Wformat=]
fprintf(stderr, "Error allocating temporary storage for tim sort: need %lu bytes", sizeof(SORT_TYPE) * new_size);
[YOCTO #9544]
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
|
|
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
|
Kai Kang
Ross Burton
Robert Yang