summaryrefslogtreecommitdiffstats
path: root/meta/recipes-extended/unzip
AgeCommit message (Collapse)Author
2023-09-22recipes: Drop remaining PR values from recipesRichard Purdie
We've been removing PR values from recipes at upgrade time for a while. In general anyone maintaining a binary distro would end up having to curate these themselves so the values in OE-Core aren't really that useful anymore. In many ways it makes sense to clear out the remaining ones (which are mostly for 'config' recipes that are unlikely to increase in PV) and leave a clean slate for anyone implementing a binary distro config. References are left in meta-selftest since the tests there do involve them and their removal upon upgrade. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-21cve_check: convert CVE_CHECK_IGNORE to CVE_STATUSAndrej Valek
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Reviewed-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2023-06-21unzip: remove hardcoded LARGE_FILE_SUPPORTChen Qi
Now that unzip's configure can correctly do the detection even in case of cross compilation, there's no need to use this hardcoded LARGE_FILE_SUPPORT flag. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-21unzip: fix configure check for cross compilationChen Qi
The original configure runs a generated binary to determine features. This is not correct for cross compilation. So change the runtime tests into compile-time tests to fix the issue. Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-16unzip: Always enable largefile supportKhem Raj
Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-12unzip: Enable largefile support when enabled in distroKhem Raj
The test to determine largefile support is a runtime test which wont work during cross-compile, therefore override the test result from recipe Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-08-12unzip: Fix configure tests to use modern CKhem Raj
Newer compilers end up with errors while compiling these test snippets and build results in failures. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-06-25unzip: Port debian fixes for two CVEsRichard Purdie
Add two fixes from debian for two CVEs. From: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1010355 I wans't able to get the reproducers to work but the added error checking isn't probably a bad thing. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-27zip/unzip: mark all submittable patches as Inactive-UpstreamAlexander Kanavin
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-04unzip: fix CVE-2021-4217Joe Slater
Avoid a null pointer dereference. Signed-off-by: Joe Slater <joe.slater@windriver.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2022-03-11unzip: Pass LDFLAGS to configure testsKhem Raj
Ensures the configure time tests are compiled/linked with the Options that it will be using to build. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-02-21meta/scripts: Automated conversion of OE renamed variablesRichard Purdie
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-11-21unzip/zip: mark all patches as non-upstreamableAlexander Kanavin
While upstream is not technically dead as of today [1], it has not made a release in over a decade, and there is no source code repo to rebase the patches on. If/when a new release ever comes, or someone takes over the maintenance, we can reassess the situation with these patches. [1] Discussion in https://sourceforge.net/p/infozip/bugs/53/ Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-07-30Convert to new override syntaxRichard Purdie
This is the result of automated script conversion: scripts/contrib/convert-overrides.py <oe-core directory> converting the metadata to use ":" as the override character instead of "_". Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-05-12unzip: Exclude CVE-2008-0888 from cve-checkRichard Purdie
The patch mentioned as the fix for the CVE is applied to the 6.0 source code. Zip versioning makes CPE entry changes hard. Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-04-24unzip: use optimization from bitbakeMikko Rapeli
Build with bitbake default optimizations, e.g. O2, instead of custom O3. Reduces unzip binary package size from 304401 to 283921 bytes, and enables building with Os to even further reduce binary size if needed and configured for the whole system. Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2021-03-06meta/recipes-extended: Add HOMEPAGE / DESCRIPTIONDorinda
Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] Signed-off-by: Dorinda Bassey <dorindabassey@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-09-27unzip: Fix CVE-2019-13232Dan Tran
Signed-off-by: Dan Tran <dantran@microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-22Revert "unzip: fix CVE-2019-13232"Khem Raj
See [1] This reverts commit 4df4de2ac8bc0e80446e1ad0ce67eb244e2d2a32. [1] http://lists.openembedded.org/pipermail/openembedded-core/2019-July/284859.html Signed-off-by: Khem Raj <raj.khem@gmail.com> Cc: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2019-07-19unzip: fix CVE-2019-13232Anuj Mittal
Include the fix by Mark Adler which has also been adopted by Debian. Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-09unzip: actually apply CVE-2018-18384Ross Burton
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06unzip: fix for CVE-2018-18384Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-20unzip: add nativesdk supportAndrej Valek
Signed-off-by: Andrej Valek <andrej.valek@siemens.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-08-20unzip: fix CVE-2018-1000035Changqing Li
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-30unzip: fix symlink problemRoss Burton
Large zip files can cause unzip to crash, take a patch from Fedora to fix it. Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-03-07unzip: refresh patchesRoss Burton
The patch tool will apply patches by default with "fuzz", which is where if the hunk context isn't present but what is there is close enough, it will force the patch in. Whilst this is useful when there's just whitespace changes, when applied to source it is possible for a patch applied with fuzz to produce broken code which still compiles (see #10450). This is obviously bad. We'd like to eventually have do_patch() rejecting any fuzz on these grounds. For that to be realistic the existing patches with fuzz need to be rebased and reviewed. Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-08-16selftest: fix distrodata.py to use per-recipe UPSTREAM_VERSION_UNKNOWN settingAlexander Kanavin
... instead of a global exception list which was problematic. [YOCTO #11896] Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-04-13unzip: add missing CVE headers to patchesRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01unzip: CVE-2014-9913 CVE-2016-9844Zhixiong Chi
Backport the patches for CVE-2014-9913 CVE-2016-9844 CVE-2016-9844: Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header. CVE-2014-9913: Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method. Patches come from: https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/archivers/unzip/ or https://release.debian.org/proposed-updates/stable_diffs/unzip_6.0-16+deb8u3.debdiff Bug-Debian: https://bugs.debian.org/847486 Bug-Ubuntu: https://launchpad.net/bugs/1643750 (LOCAL REV: NOT UPSTREAM) --send to oe-core on 20170222 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-09-03unzip: fixes strange outputEdwin Plauchu
This fixes commit 763a3d424bccf559a8d6add3dc1f2746c82f2933 Output was strange when using unzip to extract zip file. This patch fixed so. [YOCTO #9551] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-06-01unzip: fix security issuesEdwin Plauchu
This patch avoids unzip fails to compile with compiler flags which elevate common string formatting issues into an error (-Wformat -Wformat-security -Werror=format-security). [YOCTO #9551] Signed-off-by: Edwin Plauchu <edwin.plauchu.camacho@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-19unzip: update SRC_URIRoss Burton
The infozip FTP server appears to have been taken down, so change the SRC_URI to point at their SourceForge project. [ YOCTO #9655 ] Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-10unzip: Explicitly set EXTRA_OEMAKE as requiredMike Crowe
This recipe currently relies on EXTRA_OEMAKE having been set to "-e MAKEFLAGS=" in bitbake.conf to operate. It is necessary to make this explicit so that the default in bitbake.conf can be changed. Signed-off-by: Mike Crowe <mac@mcrowe.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-01-11Add "CVE:" tag to current patches in OE-coreMariano Lopez
The currnet patches in OE-core doesn't have the "CVE:" tag, now part of the policy of the patches. This is patch add this tag to several patches. There might be patches that I miss; the tag can be added in the future. Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-12-08package_regex.inc: split entries which blacklist specific versions to their ↵Alexander Kanavin
recipes Signed-off-by: Alexander Kanavin <alexander.kanavin@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-16unzip: rename patch to reflect CVE fixRoss Burton
Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-11-02unzip: CVE-2015-7696, CVE-2015-7697Tudor Florea
CVE-2015-7696: Fixes a heap overflow triggered by unzipping a file with password CVE-2015-7697: Fixes a denial of service with a file that never finishes unzipping References: http://www.openwall.com/lists/oss-security/2015/10/11/5 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7696 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7697 Signed-off-by: Tudor Florea <tudor.florea@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-07-01unzip: drop 12-cve-2014-9636-test-compr-eb.patchRoy Li
12-cve-2014-9636-test-compr-eb.patch is same as unzip-6.0_overflow3.diff, is to fix CVE-2014-9636 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-06-26unzip: fix four CVE defectsRoy Li
Port four patches from unzip_6.0-8+deb7u2.debian.tar.gz to fix: cve-2014-8139 cve-2014-8140 cve-2014-8141 cve-2014-9636 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-05-14unzip: Security Advisory -CVE-2014-9636 and CVE-2015-1315Roy Li
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9636 unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1315 Buffer overflow in the charset_to_intern function in unix/unix.c in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string, as demonstrated by converting a string from CP866 to UTF-8. Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-03-20unzip: Add ALTERNATIVE configurationSaul Wold
Since busybox also provides the unzip command use the update-alternatives mechanism to address this. [YOCTO #7446] Signed-off-by: Saul Wold <sgw@linux.intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2014-01-29unzip: Pass LDFLAGS to the linkerMikhail Durnev
Change Makefile to use LDFLAGS Signed-off-by: Mikhail Durnev <Mikhail_Durnev@mentor.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2014-01-02Replace one-line DESCRIPTION with SUMMARYPaul Eggleton
A lot of our recipes had short one-line DESCRIPTION values and no SUMMARY value set. In this case it's much better to just set SUMMARY since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY is at least useful. I also took the opportunity to fix up a lot of the new SUMMARY values, making them concisely explain the function of the recipe / package where possible. Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
2012-11-24unzip: pay some attention to our CFLAGSJoe Slater
Makefile makes use of CFLAGS_NOOPT. If we set that when calling make we can enable options like -g. The Makefile will override any optimization to -O3. Signed-off-by: Joe Slater <jslater@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-11-02recipes-extended: replace virtclass-native(sdk) with class-native(sdk)Robert Yang
The overrides virtclass-native and virtclass-nativesdk are deprecated, which should be replaced by class-native and class-nativesdk. [YOCTO #3297] Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Saul Wold <sgw@linux.intel.com>
2012-03-16unzip: Fix unpackaged files warningsRichard Purdie
WARNING: For recipe unzip, the following files/directories were installed but not shipped in any package: WARNING: /usr/man Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2011-12-15Patch Upstream Status UpdatesSaul Wold
Signed-off-by: Saul Wold <sgw@linux.intel.com>
2011-12-08OECore license fixes: meta/*Elizabeth Flanagan
This is a quick audit of only the most obviously wrong licenses found within OECore. These fixes fall into four areas: - LICENSE field had incorrect format so that the parser choked - LICENSE field has a license with no version - LICENSE field was actually incorrect - LICENSE field has an imaginary license that didn't exist This fixes most of the LICENSE warnings thrown, along with my prior commit adding additional licenses to common-licenses and additional SPDXLICENSEMAP entries. HOWEVER..... there is much to be done on the license front. For a list of recipes with licenses that need obvious fixing see: https://wiki.yoctoproject.org/wiki/License_Audit That said, I would suggest another license audit as I've found enough inconsistencies. A good suggestion is when in doubt, look at how openSuse or Gentoo or Debian license the package. Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com>
2011-06-23unzip: Avoid stripping binariesMark Hatle
Not only do we have to override things on the make line, but we need to hack on configure as well to avoid certain behavior. Signed-off-by: Mark Hatle <mark.hatle@windriver.com>
2010-12-09SRC_URI Checksums AdditionalsSaul Wold
Signed-off-by: Saul Wold <sgw@linux.intel.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-07 14:40:12 +0000