| Message ID | 4e5d0d595f713a4a5cff72f389aa9cac07fe5d14.1784567958.git.yoann.congal@smile.fr |
|---|---|
| State | New |
| Headers | show |
| Series | [scarthgap,01/33] create-spdx-image-3.0: correct SSTATE_SKIP_CREATION key for do_create_image_sbom_spdx | expand |
On Mon, 2026-07-20 at 19:22 +0200, Yoann Congal via lists.openembedded.org wrote: > From: Hongxu Jia <hongxu.jia@windriver.com> > > According to [1] > > As of the current version 1.0.8, bzip2 --version will print version > info but it will also continue compressing stdin: > > $ ./bzip2 --version > bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019. > > Copyright (C) 1996-2019 by Julian Seward. > > This program is free software; [...] > > bzip2: I won't write compressed data to a terminal. > bzip2: For help, type: `bzip2 --help'. > > Debian (and its downstreams like Ubuntu) will patch this out [2], > making the < /dev/null unnecessary, port a part of debian patch > to fix the issue > > [1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2 > [2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/ > > Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> > Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> > (cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b) > Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> > Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Hi Jaipaul, What's the motivation for backporting this now? Applying this to scarthgap will change the behaviour of bzip2 on a stable branch, so we'd need a strong reason to do that. Best regards,
Hi Paul, I noticed this while working on the bzip2 CVE-2026-42250 fix for scarthgap — master, wrynose already have this bug fix on the same bzip2 1.0.8, so I figured it made sense to bring scarthgap in line. It's a bug fix — bzip2 --version hangs when output is redirected because it falls through to reading stdin. The patch is minimal and only affects --version exit behaviour. Best regards, Jaipaul On 2026-07-20, 21:14, "Paul Barker" <paul@pbarker.dev> wrote: On Mon, 2026-07-20 at 19:22 +0200, Yoann Congal via lists.openembedded.org wrote: > From: Hongxu Jia <hongxu.jia@windriver.com<mailto:hongxu.jia@windriver.com>> > > According to [1] > > As of the current version 1.0.8, bzip2 --version will print version > info but it will also continue compressing stdin: > > $ ./bzip2 --version > bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019. > > Copyright (C) 1996-2019 by Julian Seward. > > This program is free software; [...] > > bzip2: I won't write compressed data to a terminal. > bzip2: For help, type: `bzip2 --help'. > > Debian (and its downstreams like Ubuntu) will patch this out [2], > making the < /dev/null unnecessary, port a part of debian patch > to fix the issue > > [1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2 > [2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/ > > Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com<mailto:hongxu.jia@windriver.com>> > Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com<mailto:mathieu.dubois-briand@bootlin.com>> > Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org<mailto:richard.purdie@linuxfoundation.org>> > (cherry picked from commit ae4fe4263ba9d372f9b9e80df4ec4697b51c1f9b) > Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech<mailto:jaipaul.cheernam@est.tech>> > Signed-off-by: Yoann Congal <yoann.congal@smile.fr<mailto:yoann.congal@smile.fr>> Hi Jaipaul, What's the motivation for backporting this now? Applying this to scarthgap will change the behaviour of bzip2 on a stable branch, so we'd need a strong reason to do that. Best regards, -- Paul Barker Regards, Jaipaul Cheernam
diff --git a/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch b/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch new file mode 100644 index 00000000000..84206b2a4d0 --- /dev/null +++ b/meta/recipes-extended/bzip2/bzip2/0001-fix-bzip2-version-tmp-aaa-will-hang.patch @@ -0,0 +1,62 @@ +From a9dd6acbaca836fc4e943e69a31b2e7acda32045 Mon Sep 17 00:00:00 2001 +From: Hongxu Jia <hongxu.jia@windriver.com> +Date: Wed, 13 Nov 2024 19:49:23 +0800 +Subject: [PATCH] fix 'bzip2 --version > /tmp/aaa 2>&1' hang + +According to [1] + +As of the current version 1.0.8, bzip2 --version will print version +info but it will also continue compressing stdin: + + $ ./bzip2 --version + bzip2, a block-sorting file compressor. Version 1.0.8, 13-Jul-2019. + + Copyright (C) 1996-2019 by Julian Seward. + + This program is free software; [...] + + bzip2: I won't write compressed data to a terminal. + bzip2: For help, type: `bzip2 --help'. + +Debian (and its downstreams like Ubuntu) will patch this out [2], +making the < /dev/null unnecessary: + +[1] https://stackoverflow.com/questions/59757176/why-using-dev-null-with-a-program-like-bzip2 +[2] https://sources.debian.org/src/bzip2/1.0.8-6/debian/patches/20-legacy.patch/ + +Upstream-Status: Submitted [bzip2-devel@sourceware.org] + +Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> +--- + bzip2.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/bzip2.c b/bzip2.c +index d95d280..6ec9871 100644 +--- a/bzip2.c ++++ b/bzip2.c +@@ -1890,7 +1890,9 @@ IntNative main ( IntNative argc, Char *argv[] ) + case '8': blockSize100k = 8; break; + case '9': blockSize100k = 9; break; + case 'V': +- case 'L': license(); break; ++ case 'L': license(); ++ exit ( 0 ); ++ break; + case 'v': verbosity++; break; + case 'h': usage ( progName ); + exit ( 0 ); +@@ -1916,8 +1918,8 @@ IntNative main ( IntNative argc, Char *argv[] ) + if (ISFLAG("--keep")) keepInputFiles = True; else + if (ISFLAG("--small")) smallMode = True; else + if (ISFLAG("--quiet")) noisy = False; else +- if (ISFLAG("--version")) license(); else +- if (ISFLAG("--license")) license(); else ++ if (ISFLAG("--version")) { license(); exit ( 0 ); } else ++ if (ISFLAG("--license")) { license(); exit ( 0 ); } else + if (ISFLAG("--exponential")) workFactor = 1; else + if (ISFLAG("--repetitive-best")) redundant(aa->name); else + if (ISFLAG("--repetitive-fast")) redundant(aa->name); else +-- +2.34.1 + diff --git a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb index b661bc95465..6c02dc3ed06 100644 --- a/meta/recipes-extended/bzip2/bzip2_1.0.8.bb +++ b/meta/recipes-extended/bzip2/bzip2_1.0.8.bb @@ -27,6 +27,7 @@ SRC_URI = "https://sourceware.org/pub/${BPN}/${BPN}-${PV}.tar.gz \ file://Makefile.am;subdir=${BP} \ file://run-ptest \ file://CVE-2026-42250.patch;subdir=${BP} \ + file://0001-fix-bzip2-version-tmp-aaa-will-hang.patch;subdir=${BP} \ " SRC_URI[md5sum] = "67e051268d0c475ea773822f7500d0e5" SRC_URI[sha256sum] = "ab5a03176ee106d3f0fa90e381da478ddae405918153cca248e682cd0c4a2269"