From patchwork Mon Mar 16 09:28:20 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83503 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D720F46429 for ; Mon, 16 Mar 2026 09:30:08 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46599.1773653403841933541 for ; Mon, 16 Mar 2026 02:30:04 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=RsSN92y4; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4853fd7b59aso26101295e9.2 for ; Mon, 16 Mar 2026 02:30:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653402; x=1774258202; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=HsVBEUxSPCCLsz0gonJ4BxfMg1QNkw3898ZbGdDiclQ=; b=RsSN92y4MKAn+Aoq3WBY5XnXEDG6mSR+L4Qdg73PYK07fqxU+r/PLHJc8FQhhEtNh1 aLfeoyt+595PVgT3o4mIT1I9YNHvj0QZKQaBMLY0mKqyuP3XuF2siu4hkFbXLodF9Rev 66Dcs3bxdVwirP7FAQzIpvfmrDbfg+4aM78So= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653402; x=1774258202; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=HsVBEUxSPCCLsz0gonJ4BxfMg1QNkw3898ZbGdDiclQ=; b=UcWVkpT1bVTMuaVDbMh9JMravxk6QFLXfvNNWkXAoM4omG28LOoBNvEynzluPrBRjQ 8xkIZSL8fazI5lQzTyG2iCk4l2NJyCj+g/lvAWp6dMgVln8xLaOoEra63ce3cAqiCXp7 sM7h3VIBhR9/QYZS/dUkTyPD+9kpEuPzDyB/fE/1L+akVteEhNpfEK+ZMFaldiI6wlkH Jt1df804L7udQBxDgHKi6LIGT5UgvJT+R25T1iPMFEXFluGbsGi1K35rsHjeLfTo3V4N JojXJ+8+wkZUKu5qpRpux8fjjWl4zt9XMYMw8Jv3PIOBg/P1DHsuKlPc9BnDBc8h7+sg agFw== X-Gm-Message-State: AOJu0YyntQuknUfCEX/qReZ7StTsFho1g/AwLHsFsD5kMG2qaNW7VktV rwunqkSegQUpXq91B01aNT23yu/u/PMxXVLwEAvQMYXcI7Mf4zKaQhafUqJu4h6NsLRVLIRdzT9 0JutM X-Gm-Gg: ATEYQzxTpw2FZlgHaBnPACHvRTMBxJ+l0CEXTNoR5GqT/cRikyIH21QyYxIKbRw0s5K gx4IA34CrSL1KG2c0OqoAbkH0Di/oct5hJULxZq6ntMBTDCVh9J2TLNWoTnoGmLcvdQ1JN0+w4A pxKHFo6ROLqGrsHn4IIgLnnAbXSMpPo+zVSifYJvoTO2HOS9Q1OeFFNc2tiNUdVc342i6l4o+8W 1Nzg/xh86ubGq+mS87z9su58Hd70Q4ANyV6C/8khF/Rghwju9b/rX5zoOuxL+9tTtZpXgukEWfO zKpQpgB0KMJlFVuW345vLhLMqZXS/W7YzCl4DuyHY8Aa4uccs2aVRLrXUZ2rXh18TdZl6OZ6Vel 97SlR7OXufeennxn6x+jJClvtsp+W6ya4aEnG647TIM5OImLZ48DvlYR/+BQfn5PMn3QHlajp+I LP3TqM3aq0H5MvfB1DFrpalYFo7eRovUJtItoPp/4Q8Nd2/3vBTawgLsek9PFrmMuKf/EYiptdG wu5RByldvn6cOsGghctx/xMwut+9QdNYQ== X-Received: by 2002:a05:600c:4592:b0:485:3dfc:57a with SMTP id 5b1f17b1804b1-4855671044fmr206148255e9.32.1773653401936; Mon, 16 Mar 2026 02:30:01 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:01 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 01/17] libtheora: set CVE_PRODUCT Date: Mon, 16 Mar 2026 10:28:20 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233223 From: Ken Kurematsu In the NVD database, the product name of libtheora is theora. This was set to ensure that cve-check works correctly. Signed-off-by: Ken Kurematsu Signed-off-by: Mathieu Dubois-Briand Signed-off-by: Richard Purdie (cherry picked from commit a8ddda60332e2a3219e905c1545b5da917f855c6) Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb b/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb index 178e1a9240f..ad0be85559b 100644 --- a/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb +++ b/meta/recipes-multimedia/libtheora/libtheora_1.1.1.bb @@ -17,6 +17,8 @@ SRC_URI[sha256sum] = "b6ae1ee2fa3d42ac489287d3ec34c5885730b1296f0801ae577a35193d UPSTREAM_CHECK_REGEX = "libtheora-(?P\d+(\.\d)+)\.(tar\.gz|tgz)" +CVE_PRODUCT = "theora" + inherit autotools pkgconfig EXTRA_OECONF = "--disable-examples" From patchwork Mon Mar 16 09:28:21 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83506 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA633F4642B for ; Mon, 16 Mar 2026 09:30:08 +0000 (UTC) Received: from mail-wm1-f51.google.com (mail-wm1-f51.google.com [209.85.128.51]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46600.1773653404858004976 for ; Mon, 16 Mar 2026 02:30:05 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=DRrqfs3W; spf=pass (domain: smile.fr, ip: 209.85.128.51, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f51.google.com with SMTP id 5b1f17b1804b1-48541edecf9so47154805e9.1 for ; Mon, 16 Mar 2026 02:30:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653403; x=1774258203; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=yXe27FB84aZ9Kiga/7Pt5A5u0jddt07q6bvuqLBq8jU=; b=DRrqfs3W1kR8FHLY7dh566DmXHdly8HHCzkZ+dGFnTmxKgaofKa8aB+d85sCFWPVGO jQU6KLCAOLC1If5/MfsKCbqBMJqctmCRTkr2S5d7Nyh70/HASowkAlHb8lHZ/g49ASj2 mra14tzNvVI2kRbYyvlxBZN7IO4SjgBuAeXtU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653403; x=1774258203; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=yXe27FB84aZ9Kiga/7Pt5A5u0jddt07q6bvuqLBq8jU=; b=Yp0HqBUN2NJUSpNU8Dy6FsbAhTGpOh2TixsqNh+P8IcW0dCYIfA2TknDlWCMJDSgTz IMiInxmai+XnfD4EQukFIMoUqDD8xsOjClRy8+w93BWeCTawiBOqClc/TrZlhMmLrZVI H+m+s4eWEtcUQWTW9Db6vm8PmkM8KPjf2edgX+QReHobRT2vgI9K7Tk6OL2KkBkWeEsU GXWsxjtpTCvoNNKDNBB//dwZ153kQ+D155TX+kb7vSOj4eOTW1+pDMcsxxGVOjbvrsHs BotLDZmrRdT2IEZbbmHEEUt0DM+v3XHq/5JpbQZGPHL4lp2lRVU99Rb4Xk/hKnAJKQ3Z 8G3w== X-Gm-Message-State: AOJu0Yz6v71OvGKp/j3gNAXDEGEv/FFbhHm247KP2re08yemGNe0PQqE /UJXK32j1/CTx1WycoU5p4ezQCVd2DHNnLsikaBqR9y929neZkVDuzVh3pOTPVXO5ce8Ib2LQwe y8liJ X-Gm-Gg: ATEYQzxch+6sVviWkKPQETe8e94iAYNNDTMbResLQlZfeVExdMtPAdq7q/Uc6oT/+kT dV2AMbnda7nfPpdGv5x93PleYf2KxvvuWruKeQhaSbl7N0MhxlmML3bobQ4nUMria/G3khbJw4T MfkQtNN5f5FaB7s1QRfFKzhqSBtneSIfoWktprmX5ben0uKAiZY/5mpB00baU93q6tClxm2woaf Nz/4TQ3V3U5ykdn4qP14M1f/kbU+Jb9xpydEEXCuW5D2BJuI0mC1FDckmevRd/vjgjJayIGcMrv z2MTdi2p5bCypzf0sCNpQlpJwYQZ7WoWt/7Sc6Nj129QwE7u/ml1abbnB3pm/45lhMzdMvtnTSd V8hU/++hsJOCXbs7MXjrBTrKcix8ZqioJIGKIMMCCLrZBTgySQ258cC1oazAgbDt/abdQSIErXk XiT7cb2FPZE5EKz6u75ojMD7T3Qfm2eAYehB33d+Dybedh+OAY7rvltpgEKJcd4qicYDqci/FhV v6BM7GVjVI1vMfv4e4dGDpqCPfTkf5XUA== X-Received: by 2002:a05:600c:8489:b0:482:eec4:76d with SMTP id 5b1f17b1804b1-485566f7a2amr213182625e9.17.1773653402914; Mon, 16 Mar 2026 02:30:02 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:02 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 02/17] alsa-lib: patch CVE-2026-25068 Date: Mon, 16 Mar 2026 10:28:21 +0100 Message-ID: <70145115785c63596ea997e0cf6577c43c4bedef.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233224 From: Peter Marko Pick patch mentioned in NVD report. It also includes CVE ID in commit message. Use older SNDERR funtion as new one is not yet available. This was copied from Debian patch. Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- .../alsa/alsa-lib/CVE-2026-25068.patch | 34 +++++++++++++++++++ .../alsa/alsa-lib_1.2.6.1.bb | 1 + 2 files changed, 35 insertions(+) create mode 100644 meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch diff --git a/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch new file mode 100644 index 00000000000..edc22fd62bc --- /dev/null +++ b/meta/recipes-multimedia/alsa/alsa-lib/CVE-2026-25068.patch @@ -0,0 +1,34 @@ +From 5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40 Mon Sep 17 00:00:00 2001 +From: Jaroslav Kysela +Date: Thu, 29 Jan 2026 16:51:09 +0100 +Subject: [PATCH] topology: decoder - add boundary check for channel mixer + count + +Malicious binary topology file may cause heap corruption. + +CVE: CVE-2026-25068 + +Signed-off-by: Jaroslav Kysela + +Upstream-Status: Backport [https://github.com/alsa-project/alsa-lib/commit/5f7fe33002d2d98d84f72e381ec2cccc0d5d3d40] +Signed-off-by: Peter Marko +--- + src/topology/ctl.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/src/topology/ctl.c b/src/topology/ctl.c +index a0c24518..322c461c 100644 +--- a/src/topology/ctl.c ++++ b/src/topology/ctl.c +@@ -1246,6 +1246,11 @@ int tplg_decode_control_mixer1(snd_tplg_t *tplg, + if (mc->num_channels > 0) { + map = tplg_calloc(heap, sizeof(*map)); + map->num_channels = mc->num_channels; ++ if (map->num_channels > SND_TPLG_MAX_CHAN || ++ map->num_channels > SND_SOC_TPLG_MAX_CHAN) { ++ SNDERR("mixer: unexpected channel count %d", map->num_channels); ++ return -EINVAL; ++ } + for (i = 0; i < map->num_channels; i++) { + map->channel[i].reg = mc->channel[i].reg; + map->channel[i].shift = mc->channel[i].shift; diff --git a/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb b/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb index ca6bedae976..8c91863ad1f 100644 --- a/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb +++ b/meta/recipes-multimedia/alsa/alsa-lib_1.2.6.1.bb @@ -10,6 +10,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=a916467b91076e631dd8edb7424769c7 \ " SRC_URI = "https://www.alsa-project.org/files/pub/lib/${BP}.tar.bz2" +SRC_URI += "file://CVE-2026-25068.patch" SRC_URI[sha256sum] = "ad582993d52cdb5fb159a0beab60a6ac57eab0cc1bdf85dc4db6d6197f02333f" inherit autotools pkgconfig From patchwork Mon Mar 16 09:28:22 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83505 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BCEAF4642D for ; Mon, 16 Mar 2026 09:30:09 +0000 (UTC) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46889.1773653405926450103 for ; Mon, 16 Mar 2026 02:30:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=oP2mJfRb; spf=pass (domain: smile.fr, ip: 209.85.128.50, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4852e09e23dso36280655e9.0 for ; Mon, 16 Mar 2026 02:30:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653404; x=1774258204; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=S3t9d73Cb9wx5La5JQfPmj5WjhX8kKQ24vhUkZpQLu8=; b=oP2mJfRbKnnqEZzOsMppFFXENCGzOCiEj1VMAwxs9KhEz4qX6kRmd0mMhAcWKLKcNG xJKAO4wrquk5TJBCbMurg78V4ufKxXxLjuoipfC+wnPjg8vBD1jvT5GLQKE+L6MUzEXt M5yOLpqQ33vDHxC/fGZUAVj2X08t9kyATT2q4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653404; x=1774258204; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=S3t9d73Cb9wx5La5JQfPmj5WjhX8kKQ24vhUkZpQLu8=; b=MG//IXFBGinrZuQc68bWX8ct8R6Cr1u4lN/TV2pmnOyYfwHeY3UHHN6xHnOciFSziZ CGFjhxnotfEhsq3HVom+d7gEEU9/dNvpdTDD/HsKLCuL7aTCu9/CLwqDim4TkMqEqdBP DiczfsFwwUW4CR2tI3TR7i0umHNObWngAPbgf2Xv/CfQky4dVCSB0f9IH/9Ba4w8HbVC szALMfEC36+zA3vaTsOTI+G3uRjbSq1lhr3xLtkLkXggNJRpgUWI4P8KOSWbxhld9oPx rdTfv0/WOUCUfmqLQu178DP2xeN8RFp/LYuHV52BvKlPkbky4cSuEGbB9eR3Y73jwKv1 9jtg== X-Gm-Message-State: AOJu0YyU7Xrl9scoh0rh8WeOdTgA7fiznArvmIF7i7Ym7nE56CMZ6xBP C83USGYN5gyLjFoEtO1hLhhXU1j6Fq7MXll1kvdXOKyRv8pXvoGq7uJ/Rx1PViSGKA5L8O1qqIV f6sN7 X-Gm-Gg: ATEYQzzsC4xonJ3EIb/0o1OZ3Xn5EvjnliAaq0W6YXGQ/rznaeHGwcXi4ETQn4gSQG1 1lSA3JyKXEm5fxQrd5l2oipLfxLztz98IdSqZexSbAsptCZVByMFnenKuI7s1yH2MgrrJ8/yd2A o1VrMZL10v1R+ojzmlmti8ZZdCl5hCGIeRbbVU8oUaEzAn7jyIWPxdkB5cBtuDFruwTCCjO8jhO vFNE/ooeIsIXyeMcA+rry+v+212ma7B0YXXJJ77ydHzyW8f6XIB/t9bWnnAV4j+oNJ1y4WNh8qJ zQVzRHuArAmwtCMXr7Dt5XqWjiBULgu77aXSli+mKQr2ZV8Jsi+hHA3JC9O1nkpvzJR0yTukLM6 zIrhKPw8mCSP/gO6xT7kYhuS0erGC5G0Hii6tUbA4jdN14/+81CFOFYAlO+YgAdk0FLsaHL/MeX TUUpNg+0RANkOfHBwEokCCxaVd9yvxVW97B+fv29gQf+k1d0AXtB0qUtrLYws3jqczWP7rPAr06 hy3hvBOpOBdMvqx0rwgT2Krrq2iRLt5dH6itP+i8QEn X-Received: by 2002:a05:600c:4fc6:b0:485:365f:b4e7 with SMTP id 5b1f17b1804b1-485566d2c9dmr198517295e9.14.1773653403907; Mon, 16 Mar 2026 02:30:03 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.03 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:03 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 03/17] gdk-pixbuf: Fix CVE-2025-6199 Date: Mon, 16 Mar 2026 10:28:22 +0100 Message-ID: <2777c230d705963db8ff95de27de979f0ba51cd0.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233225 From: Shaik Moin Backport the fix for CVE-2025-6199 Add below patch to fix CVE-2025-6199.patch Reference: In Ubuntu and debian, fixed patch is given -> [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] Signed-off-by: Shaik Moin Signed-off-by: Fabien Thomas [YC: removed the extra ".patch" in patches Backport URL] Signed-off-by: Yoann Congal --- .../gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch | 36 +++++++++++++++++++ .../gdk-pixbuf/gdk-pixbuf_2.42.10.bb | 1 + 2 files changed, 37 insertions(+) create mode 100644 meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch new file mode 100644 index 00000000000..1952e3ceaf5 --- /dev/null +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-6199.patch @@ -0,0 +1,36 @@ +From 140200be0b4d5355aab76a6fd474e17d117045ca Mon Sep 17 00:00:00 2001 +From: lumi +Date: Sat, 7 Jun 2025 22:27:06 +0200 +Subject: [PATCH] lzw: Fix reporting of bytes written in decoder + +When the LZW decoder encounters an invalid code, it stops +processing the image and returns the whole buffer size. +It should return the amount of bytes written, instead. + +Fixes #257 + +CVE: CVE-2025-6199 + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/c4986342b241cdc075259565f3fa7a7597d32a32] + +Signed-off-by: Shaik Moin +--- + gdk-pixbuf/lzw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gdk-pixbuf/lzw.c b/gdk-pixbuf/lzw.c +index 15293560b..4f3dd8beb 100644 +--- a/gdk-pixbuf/lzw.c ++++ b/gdk-pixbuf/lzw.c +@@ -208,7 +208,7 @@ lzw_decoder_feed (LZWDecoder *self, + /* Invalid code received - just stop here */ + if (self->code >= self->code_table_size) { + self->last_code = self->eoi_code; +- return output_length; ++ return n_written; + } + + /* Convert codeword into indexes */ +-- +2.34.1 + diff --git a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb index 471d72d8ddf..122cd598fc2 100644 --- a/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb +++ b/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.10.bb @@ -21,6 +21,7 @@ SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \ file://fatal-loader.patch \ file://0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch \ file://CVE-2025-7345.patch \ + file://CVE-2025-6199.patch \ " SRC_URI[sha256sum] = "ee9b6c75d13ba096907a2e3c6b27b61bcd17f5c7ebeab5a5b439d2f2e39fe44b" From patchwork Mon Mar 16 09:28:23 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83508 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6246EF4642E for ; Mon, 16 Mar 2026 09:30:09 +0000 (UTC) Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46890.1773653406670551568 for ; Mon, 16 Mar 2026 02:30:06 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=FFtv6dV7; spf=pass (domain: smile.fr, ip: 209.85.128.49, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-48534237460so48096705e9.3 for ; Mon, 16 Mar 2026 02:30:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653405; x=1774258205; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=mgDj4GsYwW1svVHTakXHoT8o1nrjyimtmjEavzLF0WA=; b=FFtv6dV74Y1ssf2JYYJSHJsP1rDovfVYEOC6xaUVhJKgcVhEwZjisghCS4vHNV/tz4 qPlPBvqk6/xtaBL+ey9TudM/fFdDxXpM8jzBt0EG18R6yQFYvVdvlNMvfEvfB+Jewk/q YD/DwC9B1CNBuzzv6uIBhqS56bwnXxXvKbMH0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653405; x=1774258205; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=mgDj4GsYwW1svVHTakXHoT8o1nrjyimtmjEavzLF0WA=; b=gxwLZj64bq+wqLFd5KWY+p9bsXHjQUY1UDD5WTwXl6pD4mYM1F9xSGKIrzjVniTY+s LvEVk82xN3I1M3WpAab+SfFPKyPf/n0/Z0qzUFRZaRXqwEXyQTydb2UthjcdyX64N1Gm vObrwUjKvIVWIURqY/Asx01cDPv/bmxBZpsjhVY2XJCFB6vA+i9If2X/oplFc4plqXsx bLVcB3UOhZX86N6bkSorD80AHiX92eGYk78CAekLZQQPgB0uWO/w2q9tdQ3xlBTB8YmM iuBDi8WFn+d2qpeWMkoE//RSm/FftJsajry+WDbDVHHn6kTqEbAJDDgd6im4iCP/da/O u6yw== X-Gm-Message-State: AOJu0YxKiQ4Wv9/8GcyTU+ncMZGp3496YvYMKwtzP8o14nzP1/3ciMpL TUCAN69dtZwJ1wYM9OAiYmVHEvvi0ua3aSplqOWvfA8POxXCNjUjb0t6J/mO9RWKJ7qM8mB2vai VvJqU X-Gm-Gg: ATEYQzyGz5T/bY1ZOXA8EyNC504uAA+330RdzyUwhA098b1Vr+422zumm44p9epV7DH XXbQ+D2hYc6s944osQs18k/3Likwy/MJVCrf1hTbTIXQezUrLkCT9Cj7Icni0re5YBm0by16Du9 1yT5xoQsuV811lSfHrFofClF6ZQkz8QcPN1jO7opPWycvCOIVPw58DVpjNUi0zhzbnV1GBfY/SG J10YkLgbf8DMGOrDPKhtRozDjrhB2nCGU33RuYearDcJaCfFfgW84yX6UlmqaYgBZbiJfXiBGsJ N3/kWACxflqH34+fvRMsVQLcWuTfN5015XtexH0UhSR2vKi60CuaYbXrfmCeGDIxkXeWJXX+/WM LDwOwFMRmmXEFXhY0Ga2OosQDFYH+Aoq9+Or3pVpwIsXhhtTlyFadgwoepXxJQBd3mbEvxnIM5W 7tQYYnkC2J+cV5hGcoegf+38VvZrV7S8/RKWgSr6ITBAnwaH2b6L1tog/Ttm0pr+R7RWSfWjRvD S0qRusTdWrj6TbsjzWX66UR3D1yqx5N7A== X-Received: by 2002:a05:600c:a4a:b0:477:76bf:e1fb with SMTP id 5b1f17b1804b1-485566f7bd0mr199474985e9.16.1773653404575; Mon, 16 Mar 2026 02:30:04 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 04/17] ffmpeg: patch CVE-2025-10256 Date: Mon, 16 Mar 2026 10:28:23 +0100 Message-ID: <2fbcad701a42773e8643abb69b0d3e64a74049d5.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233226 From: Peter Marko Pick patch metioned in NVD report. Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- .../ffmpeg/ffmpeg/CVE-2025-10256.patch | 31 +++++++++++++++++++ .../recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb | 1 + 2 files changed, 32 insertions(+) create mode 100644 meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-10256.patch diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-10256.patch b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-10256.patch new file mode 100644 index 00000000000..6c5f98efe2f --- /dev/null +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg/CVE-2025-10256.patch @@ -0,0 +1,31 @@ +From a25462482c02c004d685a8fcf2fa63955aaa0931 Mon Sep 17 00:00:00 2001 +From: Jiasheng Jiang +Date: Wed, 6 Aug 2025 16:39:47 +0000 +Subject: [PATCH] libavfilter/af_firequalizer: Add check for av_malloc_array() + +Add check for the return value of av_malloc_array() to avoid potential NULL pointer dereference. + +Fixes: d3be186ed1 ("avfilter/firequalizer: add dumpfile and dumpscale option") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Michael Niedermayer + +CVE: CVE-2025-10256 +Upstream-Status: Backport [https://github.com/FFmpeg/FFmpeg/commit/a25462482c02c004d685a8fcf2fa63955aaa0931] +Signed-off-by: Peter Marko +--- + libavfilter/af_firequalizer.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/libavfilter/af_firequalizer.c b/libavfilter/af_firequalizer.c +index 38663200eb..f14983b431 100644 +--- a/libavfilter/af_firequalizer.c ++++ b/libavfilter/af_firequalizer.c +@@ -793,6 +793,8 @@ static int config_input(AVFilterLink *inlink) + if (s->dumpfile) { + s->analysis_rdft = av_rdft_init(rdft_bits, DFT_R2C); + s->dump_buf = av_malloc_array(s->analysis_rdft_len, sizeof(*s->dump_buf)); ++ if (!s->dump_buf) ++ return AVERROR(ENOMEM); + } + + s->analysis_buf = av_malloc_array(s->analysis_rdft_len, sizeof(*s->analysis_buf)); diff --git a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb index 4793035eb72..f89fb2d0d78 100644 --- a/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb +++ b/meta/recipes-multimedia/ffmpeg/ffmpeg_5.0.3.bb @@ -53,6 +53,7 @@ SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz \ file://CVE-2023-6602-CVE-2023-6604-CVE-2023-6605-0002.patch \ file://CVE-2023-6602-CVE-2023-6604-CVE-2023-6605-0003.patch \ file://CVE-2025-1594.patch \ + file://CVE-2025-10256.patch \ " SRC_URI[sha256sum] = "04c70c377de233a4b217c2fdf76b19aeb225a287daeb2348bccd978c47b1a1db" From patchwork Mon Mar 16 09:28:24 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83509 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A02E6F46433 for ; Mon, 16 Mar 2026 09:30:09 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46601.1773653407249295582 for ; Mon, 16 Mar 2026 02:30:07 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=KHmlcNx2; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4852f8ac7e9so51650365e9.1 for ; Mon, 16 Mar 2026 02:30:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653405; x=1774258205; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=qQNIJ+4apFeSkKoE2KIKlfCENN1+qzqm+9JbtTU2HFg=; b=KHmlcNx2MxSNSABRsTYzDA6tYx7FpnkpwUD4Z8DuMqCYZ2KMKRZ2T5s/4bedEP9j1s 4x3dx8FmpuTRycVcZMJunkVnlS8KiR1gs2zDwBwviEu908xYZEdQYeX5UUiNuQTmn0ro jHnEA/vHJkAIOmZWTKvsUMmze6R45zU1XupU0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653405; x=1774258205; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=qQNIJ+4apFeSkKoE2KIKlfCENN1+qzqm+9JbtTU2HFg=; b=hV3L6XFUGb811HqTbxqbMjhVVVNzX39zcDVX2FNRYde1grJiCUNaBtathsEUax8Ir0 GL/HaEkwhRhy3YpjCT3IXtWiEtGH+QabDQRRphe9YQSa9pHTjdUzBCpqdz1sL0UDIOM3 +rcb/FgHi4dLOW1B/BNzT6VKIZcwMwzLC2h6Sbo16lH3XhV0YMhEj/4923IV14D4fHvk KP+SFZIeylJG2CEPXkbddb+akbvBWiY7STlUV0jeH7vy1pfV7DNy8gtgM/M5lGNx2jej tqZr37yn2tdltzioPUcpnvlG6qDB8jrdufkGDVrwFw/o/kDAz+LTVDXAMSYX15XZrhYW xe+g== X-Gm-Message-State: AOJu0YzUcx9vrDevX5ERXnUPriyAcTaNoDeuDUTKzHjKS6B5/cIZwFbt s+ze6q9uwQ1Nllb8IOQ7LhaCqCUQ7v8x0FiUYSaVSJ7HwZungA/70rhZRNab1474r0ianQp8wz5 PmXnc X-Gm-Gg: ATEYQzyVyBLmuL8Em6AbpUe7LJNLlJFWMi1jfkfZpLYnFIK1wK/TCwYj3zx5d3gyvz3 lLqszv8fxhd8dVEmwBQg/+bNdsB46hiYqb5O5sw+nOflZUjl0gZM86nTcZrHCFVBswg9WBULsnE lYNFPqCglogsDmpElcNy/IaILy781TUxI7t3QwWHWzLJB4AIOW1LXrbMCvg3d0c93X99jWEDzFs wmd1ituM16QnXeHn8gpPckDrd6EgN2thdb+BT9IPjwqhEySad6KS3EL9F+1a9xFejFYW3ZJYE56 cdQQcdywOdOOEZm90Rljs2TotXG7SaNzlDXvohwrogVX89PVGwPgEW51GUuv93fLit4Pf8aZ3Nh EmpOzsKMpFc16v+BcIH+Tymsj/XTnFhkqS7gdij6YMEPIaxzVmGr+OA5vsQR+1HZvNAgoBg+WWw SjiBxsAkImoSIeCHJOnp7YrR+gScmfpMLtv2zHFgK5u0Z36H7f+6P8BImjV44H4qisixT7IRmq7 8FzQhAFCgJqxbM998j5O7SuFI5V1jrjlg== X-Received: by 2002:a05:600c:4f54:b0:485:353f:c651 with SMTP id 5b1f17b1804b1-48556702b4dmr202764035e9.22.1773653405147; Mon, 16 Mar 2026 02:30:05 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.04 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:04 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 05/17] inetutils: patch CVE-2026-28372 Date: Mon, 16 Mar 2026 10:28:24 +0100 Message-ID: <3f103e7164526c109bd9e5426026540d525eb5fd.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233227 From: Peter Marko Pick patch according to [1] (equivalent to patch from [2]). This CVE is needed if util-linux >= 2.40 is used which is not the case in Yocto kirkstone, however it's always possible that users update packages in their layers. [1] https://security-tracker.debian.org/tracker/CVE-2026-28372 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-28372 Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- .../inetutils/inetutils/CVE-2026-28372.patch | 86 +++++++++++++++++++ .../inetutils/inetutils_2.2.bb | 1 + 2 files changed, 87 insertions(+) create mode 100644 meta/recipes-connectivity/inetutils/inetutils/CVE-2026-28372.patch diff --git a/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-28372.patch b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-28372.patch new file mode 100644 index 00000000000..b0038ab90f9 --- /dev/null +++ b/meta/recipes-connectivity/inetutils/inetutils/CVE-2026-28372.patch @@ -0,0 +1,86 @@ +From 4db2f19f4caac03c7f4da6363c140bd70df31386 Mon Sep 17 00:00:00 2001 +From: Erik Auerswald +Date: Sun, 15 Feb 2026 15:38:50 +0100 +Subject: [PATCH] telnetd: don't allow systemd service credentials + +The login(1) implementation of util-linux added support for +systemd service credentials in release 2.40. This allows to +bypass authentication by specifying a directory name in the +environment variable CREDENTIALS_DIRECTORY. If this directory +contains a file named 'login.noauth' with the content of 'yes', +login(1) skips authentication. + +GNU Inetutils telnetd supports to set arbitrary environment +variables using the 'Environment' and 'New Environment' +Telnet options. This allows specifying a directory containing +'login.noauth'. A local user can create such a directory +and file, and, e.g., specify the user name 'root' to escalate +privileges. + +This problem was reported by Ron Ben Yizhak in +. + +This commit clears CREDENTIALS_DIRECTORY from the environment +before executing login(1) to implement a simple fix that can +be backported easily. + +* NEWS.md: Mention fix. +* THANKS: Mention Ron Ben Yizhak. +* telnetd/pty.c: Clear CREDENTIALS_DIRECTORY from the environment +before executing 'login'. + +CVE: CVE-2026-28372 +Upstream-Status: Backport [https://cgit.git.savannah.gnu.org/cgit/inetutils.git/commit/?id=4db2f19f4caac03c7f4da6363c140bd70df31386] +Signed-off-by: Peter Marko +--- + NEWS | 5 +++++ + THANKS | 1 + + telnetd/pty.c | 8 ++++++++ + 3 files changed, 14 insertions(+) + +diff --git a/NEWS b/NEWS +index 877ca53b..f5172a71 100644 +--- a/NEWS ++++ b/NEWS +@@ -1,5 +1,10 @@ + GNU inetutils NEWS -- history of user-visible changes. + ++** Prevent privilege escalation via telnetd abusing systemd service ++credentials support added to the login(1) implementation of util-linux ++in release 2.40. Reported by Ron Ben Yizhak in ++. ++ + * Noteworthy changes in release 2.2 (2021-09-01) [stable] + + ** ftp +diff --git a/THANKS b/THANKS +index 8d1d3dbb..ef5f6063 100644 +--- a/THANKS ++++ b/THANKS +@@ -9,6 +9,7 @@ In particular: + NIIBE Yutaka (Security fixes & making talk finally work) + Nathan Neulinger (tftpd) + Thomas Bushnell (sockaddr sin_len field) ++ Ron Ben Yizhak (reported privilege escalation via telnetd) + + Please see version control logs and ChangeLog.? for full credits. + +diff --git a/telnetd/pty.c b/telnetd/pty.c +index c727e7be..f3518049 100644 +--- a/telnetd/pty.c ++++ b/telnetd/pty.c +@@ -132,6 +132,14 @@ start_login (char *host, int autologin, char *name) + if (!cmd) + fatal (net, "can't expand login command line"); + argcv_get (cmd, "", &argc, &argv); ++ ++ /* util-linux's "login" introduced an authentication bypass method ++ * via environment variable "CREDENTIALS_DIRECTORY" in version 2.40. ++ * Clear it from the environment before executing "login" to prevent ++ * abuse via Telnet. ++ */ ++ unsetenv ("CREDENTIALS_DIRECTORY"); ++ + execv (argv[0], argv); + syslog (LOG_ERR, "%s: %m\n", cmd); + fatalperror (net, cmd); diff --git a/meta/recipes-connectivity/inetutils/inetutils_2.2.bb b/meta/recipes-connectivity/inetutils/inetutils_2.2.bb index 9f4e1a82e1b..c6e99ab09b3 100644 --- a/meta/recipes-connectivity/inetutils/inetutils_2.2.bb +++ b/meta/recipes-connectivity/inetutils/inetutils_2.2.bb @@ -26,6 +26,7 @@ SRC_URI = "${GNU_MIRROR}/inetutils/inetutils-${PV}.tar.xz \ file://0002-CVE-2023-40303-Indent-changes-in-previous-commit.patch \ file://CVE-2026-24061-01.patch \ file://CVE-2026-24061-02.patch \ + file://CVE-2026-28372.patch \ " inherit autotools gettext update-alternatives texinfo From patchwork Mon Mar 16 09:28:25 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83504 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D6EFF46424 for ; Mon, 16 Mar 2026 09:30:08 +0000 (UTC) Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46891.1773653407993128991 for ; Mon, 16 Mar 2026 02:30:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=ab9gQFvI; spf=pass (domain: smile.fr, ip: 209.85.221.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-439bcec8613so3225936f8f.3 for ; Mon, 16 Mar 2026 02:30:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653406; x=1774258206; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=DALSIL65ET3TAZzCzUr1bgykz9sdlTlDxpKZydIBsV0=; b=ab9gQFvILw6S6FC+WatrvLuykVH2xhVNBCsgsOjTN8rlerN1fu2xZJOs0WiRlPrCOS GwKQgQoDKJ5c0ojw7TqicYCtXYbJ7m8hbd5ZYnIvceLk9AvEc6ThWWzKIH9HmQOVkT5z Q8QgB5WznV/lg7x6tQ/oXN1fECKRpfdJWzsVw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653406; x=1774258206; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=DALSIL65ET3TAZzCzUr1bgykz9sdlTlDxpKZydIBsV0=; b=SK40r5AHM5KoSX6/YRmWKxcufO8jHTN2+aQ3Lm2sn1C6ilYiwEd1/29qH2/6iuM1dM W8dTQuViap7caEIS7ZPEhBpGS8ybuvqplfq5jDRDNCeK90iVPnWzZ0CJaTHCtbDkrhgZ lO2kOLEpj/WYh0Pg14TrSw+zIPJgjoOwJyvrWztG1iJeBvVKN4GcfaSlVwfxyRXIZN9f O2XIi65xeXoKx8wfR5mEj9FkZMr+NxPiC0zr/tut1SK9F42V5ZgY897nV1WMuYddl4W6 VDrqz8sGpX2nAisbJxr9e9XNcrDYCN7ABjmrXEmhxJRfk8mZax156wlAvy7ocF1y+pS8 SyCw== X-Gm-Message-State: AOJu0YxZ+ATpsKo6jUJo84yzMwGHdwTp25gIR6fkKwYgIA2vOIdPINYR oVF5Y2mMZKrQxGNrLh4mQRW02pRzMoUbC5QOOrZ7kUpggBTMjm+CEhPB1xAsZLNjFupjl1Po6EE OdKDI X-Gm-Gg: ATEYQzxSI6IV238AC4WycAvGDNQZ6qgtcj9yrhpA8kU8AmZts4tYdQi8lMxoA9XpvPS uTY5z44M+tW9uJSU3lGcJTI9pNX/aubBT1pmaR4vMHUKU+qcOc4d+nwb3rySbktV9Oh7bKUQMvX KZATeyT7Gn/mAJoopavbwnl65jtmZWDrmhJFUYv0wMjGcvFy2lFH0D8NTHd3BEvdB71L16xILZh V5m0A6VedG3YrQNUlZFc/L35dnbz+DaP0e+qgX38LnxfmpH2TVlCP8LhDtu7ezSdLTTzSskrKRT 1VajLN9HhP9BnhjACYBr6T9ke9xElzBVB58rktn8gtLWwQOaLF4ifmLkP/RZ8Guvg/93maSH7ha vB4K4H050TGvoKP+nbcIcMhVR97aZrJ4TStWwR7meopVC1w4SXLuLIzezuxeLdm7hRb6v3hZIFd GQ5Lgj25IifJ7Juo80sJlVm2LtHK8q91tql9YJ//yN7vwb0UZ2BFNImV5HMc4io5gytnm8qQ57D bxf3fE/GzqpzQt8Az20tIwGUEae16KPhUU8jk+qYCDq X-Received: by 2002:a05:600c:8b46:b0:485:34b3:858a with SMTP id 5b1f17b1804b1-485566d2d66mr200290765e9.11.1773653405868; Mon, 16 Mar 2026 02:30:05 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:05 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 06/17] busybox: patch CVE-2025-60876 Date: Mon, 16 Mar 2026 10:28:25 +0100 Message-ID: <22440b3e1fa36ade36f5cf754d25104afab308e1.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233228 From: Peter Marko Although the patch was not merged yet, Debian already took it ([1]). Since busybox CVE handling is slow, follow Debian decision. [1] https://sources.debian.org/src/busybox/1:1.37.0-10.1/debian/patches/wget-disallow-control-chars-in-URLs-CVE-2025-60876.patch Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas [YC: fixed weird encoding in URL, added "CVE-" to subject] Signed-off-by: Yoann Congal --- .../busybox/busybox/CVE-2025-60876.patch | 38 +++++++++++++++++++ meta/recipes-core/busybox/busybox_1.35.0.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta/recipes-core/busybox/busybox/CVE-2025-60876.patch diff --git a/meta/recipes-core/busybox/busybox/CVE-2025-60876.patch b/meta/recipes-core/busybox/busybox/CVE-2025-60876.patch new file mode 100644 index 00000000000..72d7020f625 --- /dev/null +++ b/meta/recipes-core/busybox/busybox/CVE-2025-60876.patch @@ -0,0 +1,38 @@ +From 32c0f6f240fcb041ae7df44a9bbf958d627a8212 Mon Sep 17 00:00:00 2001 +From: Radoslav Kolev +Date: Fri, 21 Nov 2025 11:21:18 +0200 +Subject: [PATCH] wget: don't allow control characters or spaces in the URL + +Fixes CVE-2025-60876 malicious URL can be used to inject +HTTP headers in the request. + +Signed-off-by: Radoslav Kolev +Reviewed-by: Emmanuel Deloget + +CVE: CVE-2025-60876 +Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2025-November/091840.html] +Signed-off-by: Peter Marko +--- + networking/wget.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/networking/wget.c b/networking/wget.c +index 9ec0e67..7602563 100644 +--- a/networking/wget.c ++++ b/networking/wget.c +@@ -536,6 +536,15 @@ static void parse_url(const char *src_url, struct host_info *h) + { + char *url, *p, *sp; + ++ /* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */ ++ /* otherwise a malicious URL can be used to inject HTTP headers in the request */ ++ const unsigned char *u = (void *) src_url; ++ while (*u) { ++ if (*u <= ' ') ++ bb_simple_error_msg_and_die("Unencoded control character found in the URL!"); ++ u++; ++ } ++ + free(h->allocated); + h->allocated = url = xstrdup(src_url); + diff --git a/meta/recipes-core/busybox/busybox_1.35.0.bb b/meta/recipes-core/busybox/busybox_1.35.0.bb index 57a5747a489..0b5ac220f5f 100644 --- a/meta/recipes-core/busybox/busybox_1.35.0.bb +++ b/meta/recipes-core/busybox/busybox_1.35.0.bb @@ -61,6 +61,7 @@ SRC_URI = "https://busybox.net/downloads/busybox-${PV}.tar.bz2;name=tarball \ file://CVE-2023-39810.patch \ file://CVE-2025-46394-01.patch \ file://CVE-2025-46394-02.patch \ + file://CVE-2025-60876.patch \ " SRC_URI:append:libc-musl = " file://musl.cfg " From patchwork Mon Mar 16 09:28:26 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83510 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3333F46435 for ; Mon, 16 Mar 2026 09:30:09 +0000 (UTC) Received: from mail-wm1-f48.google.com (mail-wm1-f48.google.com [209.85.128.48]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46892.1773653408651982555 for ; Mon, 16 Mar 2026 02:30:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=RyyfjXzP; spf=pass (domain: smile.fr, ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f48.google.com with SMTP id 5b1f17b1804b1-48541edecf9so47155405e9.1 for ; Mon, 16 Mar 2026 02:30:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653407; x=1774258207; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=QAtv6vR8EZH3EXwedp3FkGUvYBMCtzz2v1RHK6PD5GY=; b=RyyfjXzPYqq/11X2rcfXdZ+7VuswkdPIlG0s+sXFusuR69+JSrMnFkK4ZTKL3ZPyNI yRs2duMxkjCp6Sn27j77q5PpfHQpbL6ul2CyfG1hs8VHBg0gu+/lUdEbW3TsJp2rFE8S 85deQKdQijVjBD3S/nidInJ0fuol82gKjAbos= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653407; x=1774258207; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=QAtv6vR8EZH3EXwedp3FkGUvYBMCtzz2v1RHK6PD5GY=; b=nUfo5gVpDCCXRRmG6Wap3s+NEGPqGa/wxrx548dR9gAOBDE3QIuKLNW8JZHOs+8flM k9WJCApb4cIT2JVdlwW2gY4pJlXQNiqKiSx50afvvotD/Wq/ktYT7TS7ddwCof83YVWa j6PA6wyjx5k+T95JPKliAsxELNHEx6AnCx3bqqPMtFsW39QjfLdb6vuz13/0GkM632Qf b/HroFQQGoMVpfOn5GTWzjnbmcD1ZRkUbFFcBIVz4R5/FGiNgHE2x+ti4TF0H3hkiD69 nxwkheISCiEw4TimAv78SVJyN4OP031iv+MFSBLHNEi7rFL3oyLAxIUCuy4Sk9ZhUVQi 6c6Q== X-Gm-Message-State: AOJu0YwqRP9mGZx/qrL3YyJS/QU+IoNIY2HWjAA4MbD6OYDZiw4fw1kR fnhCi6dwgSe98hZ40QpaExApXZm6/OK/a892TbJb6SNFu36iQc1JX2QFQAotJEbThTanhAmytxw 5+lE/ X-Gm-Gg: ATEYQzziZsNuYCVsFU2r79JO3iZk2ESA6qadpm6QTzZ2fIAuZcGd/eb9OGLmDcHzUND iO3Cu1BTWEBKiavGBWv9Komdy0ewCCZCxb0UKdBTfmfl3gP+ozjPLp5nqv+WBrpURxNofIuu7ev l1se7cACtxIRkyuQ8Gp5TJ2ti8gx+iLQWImp+zlQH4YXx7MfXBN+CpkjSYebkMyL+C67NkieTIX zy2nlbIGdg9Wa61NQis6poFXhRA84YtHNm7Ol7bZJgQSDiBykQZ1h9G+/+/O7APKYz0QN70Cv07 KqjByM8BmST2VIc1HPkRa1pPrsPGg0UntWy/HKSmecLUNuNXE1UHDuelKOT9B18iHavoJXeBK9x xZft3k7ccm7JBERermuTG9miz6F1Aga1mw/z0WrnoPzY2bwRVpRYseOuQvcUM75MeemNlGXWLIW YvJM2scxEWGQ/7Lwaak9BCV+8JnoWXhCP7VmSjBhBVFYbYL90YAF5xzl8sjcKoqkNsBqz9nm5mL UN08fZ/a6xPJi1JLA74qtueAbjIww45nw== X-Received: by 2002:a05:600c:49a1:b0:485:4bd1:4c74 with SMTP id 5b1f17b1804b1-4855670c0damr126976955e9.32.1773653406563; Mon, 16 Mar 2026 02:30:06 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:06 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 07/17] tiff: patch CVE-2025-61143 Date: Mon, 16 Mar 2026 10:28:26 +0100 Message-ID: <944f481d214bebeaf51769d77fe16cd93cbff351.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:09 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233229 From: Peter Marko Pick patch from merge request mentioned in NVD report. Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- .../libtiff/tiff/CVE-2025-61143.patch | 44 +++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 + 2 files changed, 45 insertions(+) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-61143.patch diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61143.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61143.patch new file mode 100644 index 00000000000..ed0438fec97 --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61143.patch @@ -0,0 +1,44 @@ +From 4d28af5fe61b1760f10981f5072ff1e6fd44f210 Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Fri, 5 Sep 2025 21:44:49 +0000 +Subject: [PATCH] tiffcrop: avoid nullptr dereference + +Fixes #734 + +CVE: CVE-2025-61143 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/4d28af5fe61b1760f10981f5072ff1e6fd44f210] +Signed-off-by: Peter Marko +--- + tools/tiffcrop.c | 2 +- + tools/tiffdither.c | 5 +++++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index ae414efc..1cbb49b6 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -2561,7 +2561,7 @@ main(int argc, char* argv[]) + + if (dump.outfile != NULL) + { +- dump_info (dump.outfile, dump.format, "", "Completed run for %s", TIFFFileName(out)); ++ dump_info (dump.outfile, dump.format, "", "Completed run for %s", out ? TIFFFileName(out) : "(not opened)"); + fclose (dump.outfile); + } + } +diff --git a/tools/tiffdither.c b/tools/tiffdither.c +index 3c64fdc0..405527c7 100644 +--- a/tools/tiffdither.c ++++ b/tools/tiffdither.c +@@ -84,6 +84,11 @@ fsdither(TIFF* in, TIFF* out) + fprintf(stderr, "Out of memory.\n"); + goto skip_on_error; + } ++ if (imagewidth > TIFFScanlineSize(in)) ++ { ++ fprintf(stderr, "Image width exceeds scanline size.\n"); ++ goto skip_on_error; ++ } + + /* + * Get first line diff --git a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb index 84c3028b458..4c2b0a800b4 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb @@ -65,6 +65,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2025-9900.patch \ file://CVE-2025-8961.patch \ file://CVE-2025-9165.patch \ + file://CVE-2025-61143.patch \ " SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8" From patchwork Mon Mar 16 09:28:27 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83519 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AE04F4643A for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46603.1773653409170073670 for ; Mon, 16 Mar 2026 02:30:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Xw1vJPas; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-48534237460so48097225e9.3 for ; Mon, 16 Mar 2026 02:30:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653407; x=1774258207; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=ZzODoNZ0LEZvb5agjHiAOyVWWEDQjCSSibFFO1d+rrg=; b=Xw1vJPaspr2/HiSpSwGwWIJLPMziR1okVyWVZPb8EV9kb6V+bJjd/DCSUTijxTZHjv w0/lggYWlbAcR4GGD3E8t2/KY8gHfqyjE8aorogWg/drLv/JgS8oX+lt5jmdarWLoE3K jj6lcroNVpztUWZxxyvdvIvDDEt7aNfpJe70g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653407; x=1774258207; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=ZzODoNZ0LEZvb5agjHiAOyVWWEDQjCSSibFFO1d+rrg=; b=l33U6gH1tQ7TybJP4K7/VMGVa1fq4UWCH1ovMBT8lcAVpSirjXZUGgnfYk7JOSqhO5 VXhdLktaKJFieId4FtQzd3Y5r/rgtHfeZaKE15dQstInjiFQnajE59Wzb1NY9eKbJ8Yg UJ+nUMzeSbiHrDpjrzGMR1hSXv0xBhREnwOUkuZs07qiAO+PhQqEcR3oej3BP1Rn3NkJ lKPIc9vZNxzM82fAzNgpOo5EK+LP2PR9ferA/NTMqkFck2FumiRL1LekJMuCqgazEAs/ T7LCHPmsa+28r2FnQeeDfb0ZGVLztpOlUFDI1NxVlFAGjzKpWHCf5tocPwyaS2cRCVcT QU4Q== X-Gm-Message-State: AOJu0YwQulY8ZJL34fcxk9uoCQADB+S3oefjbuPAoPtclWXGEJ95FMPG q+P5yg7QjPlZJVLRIfFguPjpz44uVwxe56e+e6dkNTP5Lg1ek+PXmEZ9IG+9qI8kFm0KSyUoBz9 c2mjF X-Gm-Gg: ATEYQzzcEpqBOKR3toxuMcv2ahhopgVa1wbHet1OVa27WRcmT1lZkhV3HVTQ2c6pp85 DcHmEUD0U+YY0x6lpWqvPVL3N0Lb0EqxDQwb6apV6ZLCpmJkIF8svPfEay+QFbWAkM6ppdx/poH Dkxo25inMXiT3KYW7eCWVZwH+B/Vnp7EZHJ68OoZyOM9Cx9vtypt1ZZAliNN8C+n98pCsfqPGQm ebyJurLJkePI9oDgYZNtL86u//C4y6OuvQROOnkAJ0EBPjI+TOXZhnQE2UjOFR2IDBLhhdg08Pt ZdXoEc9r/3voXNOJ138rncnmOOIO5dVw0WtD+uZAlSHi3T2tj5mS0UTRb/Kq1KNPaFziUzrXEPr +q71avR3k1ElNMoSfvUeldwLfY9hbLz0+VkyXoJvYak5k1E966gMLRJl7UhFoEnC2kt3EvelEEL wuhDjlqRumBYAUVEFHf+eoXZUrnWbSNEoy5vwsA8x+ShvFRz3cn+lFtLYUsURON4TLzQZAC5y9O MTOo/ksa+z8/vGt4BBjVd61V4uJvBQUog== X-Received: by 2002:a05:600c:81c5:b0:485:3812:36da with SMTP id 5b1f17b1804b1-485566cf00bmr184965645e9.9.1773653407137; Mon, 16 Mar 2026 02:30:07 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.06 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:06 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 08/17] tiff: patch CVE-2025-61144 Date: Mon, 16 Mar 2026 10:28:27 +0100 Message-ID: <017b7ae54e55e24777a9b6033032911701b19b62.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233230 From: Peter Marko Pick patch from merge request mentioned in NVD report. Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- .../libtiff/tiff/CVE-2025-61144.patch | 27 +++++++++++++++++++ meta/recipes-multimedia/libtiff/tiff_4.3.0.bb | 1 + 2 files changed, 28 insertions(+) create mode 100644 meta/recipes-multimedia/libtiff/tiff/CVE-2025-61144.patch diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61144.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61144.patch new file mode 100644 index 00000000000..8b25cdfab9e --- /dev/null +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-61144.patch @@ -0,0 +1,27 @@ +From 88cf9dbb48f6e172629795ecffae35d5052f68aa Mon Sep 17 00:00:00 2001 +From: Lee Howard +Date: Fri, 5 Sep 2025 21:46:03 +0000 +Subject: [PATCH] tiffcrop: avoid buffer overflow + +Fixes #740 + +CVE: CVE-2025-61144 +Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/88cf9dbb48f6e172629795ecffae35d5052f68aa] +Signed-off-by: Peter Marko +--- + tools/tiffcrop.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c +index ae414efc..afa1cce5 100644 +--- a/tools/tiffcrop.c ++++ b/tools/tiffcrop.c +@@ -3913,7 +3913,7 @@ combineSeparateSamplesBytes (unsigned char *srcbuffs[], unsigned char *out, + { + if ((dumpfile != NULL) && (level == 2)) + { +- for (s = 0; s < spp; s++) ++ for (s = 0; (s < spp) && (s < MAX_SAMPLES); s++) + { + dump_info (dumpfile, format, "combineSeparateSamplesBytes","Input data, Sample %"PRIu16, s); + dump_buffer(dumpfile, format, 1, cols, row, srcbuffs[s] + (row * src_rowsize)); diff --git a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb index 4c2b0a800b4..02fc956c232 100644 --- a/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb +++ b/meta/recipes-multimedia/libtiff/tiff_4.3.0.bb @@ -66,6 +66,7 @@ SRC_URI = "http://download.osgeo.org/libtiff/tiff-${PV}.tar.gz \ file://CVE-2025-8961.patch \ file://CVE-2025-9165.patch \ file://CVE-2025-61143.patch \ + file://CVE-2025-61144.patch \ " SRC_URI[sha256sum] = "0e46e5acb087ce7d1ac53cf4f56a09b221537fc86dfc5daaad1c2e89e1b37ac8" From patchwork Mon Mar 16 09:28:28 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83511 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2585F4642B for ; Mon, 16 Mar 2026 09:30:19 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46894.1773653409770441433 for ; Mon, 16 Mar 2026 02:30:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Xi2HXYJb; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4853aec185aso35590875e9.1 for ; Mon, 16 Mar 2026 02:30:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653408; x=1774258208; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=uaMhNdICFOrDlMBNga1IjZfuwrgqlKcD+qiepACoglU=; b=Xi2HXYJbau/djEfQ0vG//ya2x1UlMxIG77UQ+7jbA5mHfN7fgB37BIhkUVzxi1x06n AUrUOo2H6emtMCuJnnCv7rIH0fOYmbMf2i1814+mFs1/8L9ryUde2W/5IVVo5xHq6jEU ERHHa7qxlfznB5fP+zggbGFyk8XjKAkdt4Nh8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653408; x=1774258208; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=uaMhNdICFOrDlMBNga1IjZfuwrgqlKcD+qiepACoglU=; b=VBTNPW33pKK/YxiGrv+udcKIvcMoM79e1B7CEHIiKHtO+p9mPCgD1hy1sEmfagnzD/ pFpIAAnT3zLdP1Cgp/5+pLoHbpV7rcKXsfbYdqYmXbHXgzfsSuTYCV9p1nO+rWVJrYTQ 2NcB+KCSiYZNlgck4K1i9ym6mPV8VRAhuRqLduOYTWR8oKYRhpGpDwAqIVAk0mGl29Aa WpGUh1XC+X/Ss0+XUBnEk5dSl8WndaDC5LM1DzjZfADojTYMKJo+rOfKlYekddN8FhG4 6KoLqld6F5cmElSco2Hl/H40urxaehL/FzlMiKQKIORca7IVGez7AszSerydNBZ4Jcly UjlA== X-Gm-Message-State: AOJu0YzbggJXq+/k9w8ER+nvZoc40AHQlE4E5xp/6dkpGoPw1GNp1j5d 7CSnRY967KXqhCwrvMJcl1agOzZNmP2k5sKYksswcOugWna+mOVRsUZq/fYpGxePt6aNfDTT7HC aK694 X-Gm-Gg: ATEYQzwItivuyC9ks4ZmAMvDZ1m4aIxaYzVt1zbSKvDE3RfXk/cEVcPbIMiPxM/gA/x ewQGsOix+or0cNQQVNgQzb7YtSXcE1SZVtknyy2p6Jo+hgq239T/boiuX4poQs4vSRyx800njio 2IqUrOlZUx6ITD+yMCycX4M4QiHMOVwTutrmdh1MnpGizTgZxd4Iyi8nwrYxkvMnRWr4ji4odkn FMV1fvvUBfDU1ahjJN1CegR0MW89P7rOyIsLlh72K7+0YQEOk1Kwkvrvb7QRMOIN0fmZKl9dYau 1c2xsv1Zo7xDrKAIA9b8Otw8oHmR4b7k9iCGCxPkLKFrVYeOCloZUpXV0Hxxe/XmwjrhNL8c/4O CvhlNQG3XN6DY0dQLZOB6EjRfT8xF1esw1F+tq+Jl6hHQi5LjDLEEkeg0CW/Aa0T3zhak3XDcuo bDStJDUBuVlap4FscajcrSjAt7EHQIH6vALuOypjy9FPvkHzCLoVCwPCcCMNY/d+kdXkxaRvj+C f9dSRy1MUzum4p08CH60AhT38q3ghuC7w== X-Received: by 2002:a05:600c:4753:b0:485:3fe6:2209 with SMTP id 5b1f17b1804b1-485566d516dmr196522565e9.11.1773653407723; Mon, 16 Mar 2026 02:30:07 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 09/17] tiff: set status of CVE-2025-61145 as fixed by patch for CVE-2025-8961 Date: Mon, 16 Mar 2026 10:28:28 +0100 Message-ID: <9341a9be6f5995bd8810288b4118365aa9833364.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233231 From: Peter Marko Gitlab issues for these two CVEs mentioned in NVD inks lead to the same merge request. Signed-off-by: Peter Marko Signed-off-by: Fabien Thomas Signed-off-by: Yoann Congal --- meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch | 1 + 1 file changed, 1 insertion(+) diff --git a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch index 05b11a866e7..f87eaeb1084 100644 --- a/meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch +++ b/meta/recipes-multimedia/libtiff/tiff/CVE-2025-8961.patch @@ -6,6 +6,7 @@ Subject: [PATCH] tiffcrop: fix double-free and memory leak exposed by issue Upstream-Status: Backport [https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5] CVE: CVE-2025-8961 +CVE: CVE-2025-61145 Signed-off-by: Vijay Anusuri --- tools/tiffcrop.c | 8 +++++++- From patchwork Mon Mar 16 09:28:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83514 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1060AF46437 for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46604.1773653410445192091 for ; Mon, 16 Mar 2026 02:30:10 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=eFp6vS/a; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4852f8ac7e9so51651565e9.1 for ; Mon, 16 Mar 2026 02:30:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653409; x=1774258209; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=xxx/93fBMlBySIZOYqG6L7md5pZNAhzwjkaewOMF9zE=; b=eFp6vS/anPg9ATPECu6Xok4fnWXZ/VTBnkFnIeB+WeupgMj9jju1EIHpvT47/znpG5 hr9mBk3veKU44WQvzPC2Qa7qoiM1DwHHqCL7Sv0ncdTQE/GtoU5X2nIfxRZ7CqD3LjYO +JlyawNsqs9A2ADfQsAvqPdt6716Khee7lXwk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653409; x=1774258209; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=xxx/93fBMlBySIZOYqG6L7md5pZNAhzwjkaewOMF9zE=; b=gQ7lJQEkBc5t3QJn/8tFftYRf8WsYdA56lPG/0BhtyoF5cKjyUGNHTo5qIToIUIp66 NYIR3PHY4oye8hewZVb4mVKxA4SqtoKNqbRftFnviPLRHLhojYGePbGLRIQhnnDufXis coAK05hgM/zdLjes1jv8HG4uk30TfpQdh39+BYBEHXE0kR5FoyA31fxx8+ZBkN9rfibs 6nUn850PdVtrDuNMuQhrZQPAUBJwimoM8gYwJpnYXbFe3OAqEGEMOynC3U6cNnH/dBw6 hi5eA+zDkoyO1YNzHFirT4BgSes0OYa9HvRjZTSu3IIUGCE0XcSB2yaiSML8yQbowPGa PnKg== X-Gm-Message-State: AOJu0YzZraA26cUZWzCU97qlVtBuBGTAsCl53WyyC4+7ZRa1HxTx+AU/ DXM0B1dUVzIqpOSc///manBpMrgBRDke0Emc865ugTpnIB6zEo0TNzxsQmS3fnjHvv3vci2lLVF QmK3h X-Gm-Gg: ATEYQzxLxG0TeH4Wjo89+6nFqVZj9/Kfws61FBtPd7ZKkTQRe2c3FgJWqrYfeibqSdz MIWCMT05dgomIzTEE4DnYJARpkiQsSHBElFIhOz1kvee/u0m+yXGvwBq7O0UTqWoDaswTxF0nmL WUZPxlMPkpPrrXWbxZ5qvQKpJjHl4zj9WZ5+BqleY1zCF20pMXY9OS99CVwslk6rzOCedBtVKSU D7jY9+it0b+psyhww66cPvwqbZRErUyG7VW+kJ5CvzwAiR7h5jZ27IpCt4+5H7/YDQTjHsKnS3z 3pL5pQyTgiS6FygT7onrd7jNDY8hx7xwqXaFam/QMqajyEC3sZjdPxCvcr+cBl4sappOZ/vm+Fc bIDV2EgSGK2jv90zKFQA22SW9IpXfL7bpQA3eEnegv/kBwWRrA2qesbs9Ohr50uEy8U1u6CxSlX Mcv+m957SQKRmaGj4DjJ/912emIoBAYijoMeTbHou6xgiKx7MRPTlwfyjPEqj02GOxrLf8jYH19 gtadQxK5xYrd2kpDO8z3t6/1hjRMagGIw== X-Received: by 2002:a05:600c:354b:b0:483:2c98:4368 with SMTP id 5b1f17b1804b1-48556703401mr204012305e9.18.1773653408389; Mon, 16 Mar 2026 02:30:08 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.07 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:07 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 10/17] gtk+3: fix incompatible-pointer-types errors for native build on Fedora 41 Date: Mon, 16 Mar 2026 10:28:29 +0100 Message-ID: <0a82d5d0c0563905bad20d5479794ae84ef13cc8.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233232 From: Yoann Congal Backport 2 patchs to fix incompatible-pointer-types error when building gtk+3-native on Fedora 41 host: tests/testinput.c:197:79: error: passing argument 1 of ‘gdk_event_get_source_device’ from incompatible pointer type [-Wincompatible-pointer-types] gtk/gtklabel.c:4235:32: error: passing argument 1 of ‘gtk_widget_queue_resize’ from incompatible pointer type [-Wincompatible-pointer-types] On autobuilder: fedora41-vk-1:~$ gcc --version gcc (GCC) 14.3.1 20251022 (Red Hat 14.3.1-4) GCC 14 notoriously restricted how pointer types are converted: https://gcc.gnu.org/gcc-14/porting_to.html#incompatible-pointer-types Suggested-by: Fabien Thomas Signed-off-by: Yoann Congal --- ...-type-when-calling-GtkWidget-methods.patch | 28 +++++++++++ ...ests-Add-GdkEvent-casts-in-testinput.patch | 48 +++++++++++++++++++ meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb | 2 + 3 files changed, 78 insertions(+) create mode 100644 meta/recipes-gnome/gtk+/gtk+3/0001-Use-the-right-type-when-calling-GtkWidget-methods.patch create mode 100644 meta/recipes-gnome/gtk+/gtk+3/0002-tests-Add-GdkEvent-casts-in-testinput.patch diff --git a/meta/recipes-gnome/gtk+/gtk+3/0001-Use-the-right-type-when-calling-GtkWidget-methods.patch b/meta/recipes-gnome/gtk+/gtk+3/0001-Use-the-right-type-when-calling-GtkWidget-methods.patch new file mode 100644 index 00000000000..76de5630655 --- /dev/null +++ b/meta/recipes-gnome/gtk+/gtk+3/0001-Use-the-right-type-when-calling-GtkWidget-methods.patch @@ -0,0 +1,28 @@ +From a3e82f20a1a1e7d8ffbc960a8bb4aa65b0d151ee Mon Sep 17 00:00:00 2001 +From: Yoann Congal +Date: Tue, 6 Dec 2022 21:49:22 +0000 +Subject: [PATCH] Use the right type when calling GtkWidget methods + +From: Emmanuele Bassi + +Let's avoid complaints from the compiler. + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gtk/-/commit/a3e82f20a1a1e7d8ffbc960a8bb4aa65b0d151ee] +Signed-off-by: Yoann Congal +--- + gtk/gtklabel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/gtk/gtklabel.c b/gtk/gtklabel.c +index 7933ab2af73..40a569004b6 100644 +--- a/gtk/gtklabel.c ++++ b/gtk/gtklabel.c +@@ -4232,7 +4232,7 @@ gtk_label_style_updated (GtkWidget *widget) + if (change == NULL || gtk_css_style_change_affects (change, GTK_CSS_AFFECTS_FONT)) + { + gtk_label_clear_layout (GTK_LABEL (widget)); +- gtk_widget_queue_resize (label); ++ gtk_widget_queue_resize (widget); + } + + if (change == NULL || gtk_css_style_change_affects (change, GTK_CSS_AFFECTS_TEXT_ATTRS) || diff --git a/meta/recipes-gnome/gtk+/gtk+3/0002-tests-Add-GdkEvent-casts-in-testinput.patch b/meta/recipes-gnome/gtk+/gtk+3/0002-tests-Add-GdkEvent-casts-in-testinput.patch new file mode 100644 index 00000000000..c6ec597384e --- /dev/null +++ b/meta/recipes-gnome/gtk+/gtk+3/0002-tests-Add-GdkEvent-casts-in-testinput.patch @@ -0,0 +1,48 @@ +From 76bc2a57136fd6cf0374fa3f86a7ba646b779803 Mon Sep 17 00:00:00 2001 +From: Yoann Congal +Date: Fri, 19 Jan 2024 10:41:33 +0000 +Subject: [PATCH] tests: Add GdkEvent casts in testinput + +From: David King + +Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gtk/-/commit/76bc2a57136fd6cf0374fa3f86a7ba646b779803] +Signed-off-by: Yoann Congal +--- + tests/testinput.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tests/testinput.c b/tests/testinput.c +index b68552a4280..3d4d7f6f875 100644 +--- a/tests/testinput.c ++++ b/tests/testinput.c +@@ -194,7 +194,7 @@ button_press_event (GtkWidget *widget, GdkEventButton *event) + + print_axes (event->device, event->axes); + gdk_event_get_axis ((GdkEvent *)event, GDK_AXIS_PRESSURE, &pressure); +- draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device (event)), ++ draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device ((GdkEvent *)event)), + event->x, event->y, pressure); + + motion_time = event->time; +@@ -239,10 +239,10 @@ motion_notify_event (GtkWidget *widget, GdkEventMotion *event) + gdk_device_get_axis (event->device, events[i]->axes, GDK_AXIS_X, &x); + gdk_device_get_axis (event->device, events[i]->axes, GDK_AXIS_Y, &y); + gdk_device_get_axis (event->device, events[i]->axes, GDK_AXIS_PRESSURE, &pressure); +- draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device (event)), ++ draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device ((GdkEvent *)event)), + x, y, pressure); + +- print_axes (gdk_event_get_source_device (event), events[i]->axes); ++ print_axes (gdk_event_get_source_device ((GdkEvent *)event), events[i]->axes); + } + gdk_device_free_history (events, n_events); + } +@@ -252,7 +252,7 @@ motion_notify_event (GtkWidget *widget, GdkEventMotion *event) + + gdk_event_get_axis ((GdkEvent *)event, GDK_AXIS_PRESSURE, &pressure); + +- draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device (event)), ++ draw_brush (widget, gdk_device_get_source (gdk_event_get_source_device ((GdkEvent *)event)), + event->x, event->y, pressure); + } + motion_time = event->time; diff --git a/meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb b/meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb index e6c8e43923a..01677e33f8a 100644 --- a/meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb +++ b/meta/recipes-gnome/gtk+/gtk+3_3.24.34.bb @@ -7,6 +7,8 @@ SRC_URI = "${GNOME_MIRROR}/gtk+/${MAJ_VER}/gtk+-${PV}.tar.xz \ file://0003-Add-disable-opengl-configure-option.patch \ file://link_fribidi.patch \ file://CVE-2024-6655.patch \ + file://0001-Use-the-right-type-when-calling-GtkWidget-methods.patch \ + file://0002-tests-Add-GdkEvent-casts-in-testinput.patch \ " SRC_URI[sha256sum] = "dbc69f90ddc821b8d1441f00374dc1da4323a2eafa9078e61edbe5eeefa852ec" From patchwork Mon Mar 16 09:28:30 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83520 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 689E7F46441 for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f46.google.com (mail-wm1-f46.google.com [209.85.128.46]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46606.1773653412751042563 for ; Mon, 16 Mar 2026 02:30:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=uxppGvU5; spf=pass (domain: smile.fr, ip: 209.85.128.46, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f46.google.com with SMTP id 5b1f17b1804b1-4852b81c73aso38113595e9.3 for ; Mon, 16 Mar 2026 02:30:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653411; x=1774258211; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=aJ6orOidTAew6EIDHd2MIpYNo7EqFlydQHSY0hRuizs=; b=uxppGvU5OLLtmzcMY3RyxEt376WH0U72dpmklMqQEHJEW7lrwCD7xZuJFoB34ZKwWx wRL42mhbDRx30fefUK5nmi9lUhwkxsYj/dKlzs2JH8+MGQ0FNdpiM5JFNNR37M++wc/L sGT6I0yYK848HKELtKFg2OYPKtYVmIgfH+iS4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653411; x=1774258211; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=aJ6orOidTAew6EIDHd2MIpYNo7EqFlydQHSY0hRuizs=; b=Br4ko/seL0cMRGnBrAlbjsuwbcduXdfs4hxqBgeIJczu+zR1ajFi/cIk4+xF9rK63D SPS4FeYtcPMujdSAyAKgPFfCKQ3zUqeH2PmeiVdiyOpcBw7+R4meV+ZaBX6LCyGoF0V0 X7WLKkf+T///hFtavxN+QI7cycUr13kCeOc9jTLSIAVwqbiS0pHSmstNCA13+vmWHE2B nU2YvNvR/z31M6bb6ArTqKRSCNS838HBvizzRhbtKCqn8ujZyvVfqOepmYBMdZsOQrFT b8MGk3VpKj6z41kGOEa//5fnHB2wDt121oU0sKyovrebL8OSFh8Q4wbAvjmnBKpRGPzr HP0A== X-Gm-Message-State: AOJu0YwQWpGwQZl6rT9aiupxYJjN5mGCJ8gnv678j2LKZSy9H6J/RIYD sTBjzDxLBnxcsxXeujII2TVry2Aeu6sGDQCCLN7sp1Nu1zbnBejXE55BjT2i5fN4/Fvz8oXjnuA hbAwg X-Gm-Gg: ATEYQzyfE1YQlg+t5jGQZN6kwK/jU3fmX0PhZ67LTZXOyAGl8pyog+8AVZem4S2dyB3 QSmgouKSSHTtfZBUWkNRep7DkeLav8kp2oPVwnEsQ5/hrVO2/f8AaRWO+n6Ays0ZRusEDCL/j8J Xoep3OpApOaODdFGIP4AKkzNUZ20VThVDBlmvvGRS96fqF44kj3yA84M29ku/Nz0ucCr+A7NEJE jymApTtd00R/rBrhrTPqRPpYNQIHi+lODPtr6xt2bCo5a0ZIoUfWGKyBV7WU8tc1D8LfmhIfcyW YDG5g22kdb+wuyDPftlhi65PO8j3F6bbyUBjDZ2G5bmzpfC4kycxj9n7e6zqqN7co6RimQoHj93 to3TT/YlaF10jhhVIAdX6THML8yD2ZhnAVubPSxuvxP1bmSrh2D3gtxovyPcK37GILP4zRJhk3N eFamdrI/V5dJ5zwIzC80EWmBlLMI0jZfiyleUfv1A5wJnNXLmYO79ZMP7M/Ywh1dVsET8eTFp2u z43FBdsWYIToaGhxEc3d6VOi7iSUwTAEg== X-Received: by 2002:a05:600c:4583:b0:485:439b:683f with SMTP id 5b1f17b1804b1-48556700c23mr182234915e9.20.1773653408925; Mon, 16 Mar 2026 02:30:08 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:08 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 11/17] libpam: fix CVE-2024-10963 Date: Mon, 16 Mar 2026 10:28:30 +0100 Message-ID: <75786efd725b97928f0787896bc67a9465879e0b.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233235 From: Hitendra Prajapati Pick up "Mitigated by" patch from Debian security tracker. [0]: https://security-tracker.debian.org/tracker/CVE-2024-10963 patch[1] which fixes this vulnerability as mentioned in Debian report. [1] https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628 Signed-off-by: Hitendra Prajapati [YC: Debian security tracker: "The vulnerable code was introduced in 1.5.3" but the vulnerable code was backported in commit 399d4986a7 (libpam: fix CVE-2022-28321, 2022-10-28)] Signed-off-by: Yoann Congal --- .../pam/libpam/CVE-2024-10963.patch | 229 ++++++++++++++++++ meta/recipes-extended/pam/libpam_1.5.2.bb | 1 + 2 files changed, 230 insertions(+) create mode 100644 meta/recipes-extended/pam/libpam/CVE-2024-10963.patch diff --git a/meta/recipes-extended/pam/libpam/CVE-2024-10963.patch b/meta/recipes-extended/pam/libpam/CVE-2024-10963.patch new file mode 100644 index 00000000000..8f8e13f5e84 --- /dev/null +++ b/meta/recipes-extended/pam/libpam/CVE-2024-10963.patch @@ -0,0 +1,229 @@ +From f9ccee5c4c6cb0d4197b08ebeb36c1dceffe82e8 Mon Sep 17 00:00:00 2001 +From: Thorsten Kukuk +Date: Thu, 14 Nov 2024 10:27:28 +0100 +Subject: [PATCH] pam_access: rework resolving of tokens as hostname + +* modules/pam_access/pam_access.c: separate resolving of IP addresses + from hostnames. Don't resolve TTYs or display variables as hostname + (#834). + Add "nodns" option to disallow resolving of tokens as hostname. +* modules/pam_access/pam_access.8.xml: document nodns option +* modules/pam_access/access.conf.5.xml: document that hostnames should + be written as FQHN. + +CVE: CVE-2024-10963 +Upstream-Status: Backport [https://github.com/linux-pam/linux-pam/commit/940747f88c16e029b69a74e80a2e94f65cb3e628] +Signed-off-by: Hitendra Prajapati +--- + modules/pam_access/access.conf.5.xml | 4 ++ + modules/pam_access/pam_access.8.xml | 46 ++++++++++++------ + modules/pam_access/pam_access.c | 72 +++++++++++++++++++++++++++- + 3 files changed, 105 insertions(+), 17 deletions(-) + +diff --git a/modules/pam_access/access.conf.5.xml b/modules/pam_access/access.conf.5.xml +index 8fdbc31..dc505a6 100644 +--- a/modules/pam_access/access.conf.5.xml ++++ b/modules/pam_access/access.conf.5.xml +@@ -226,6 +226,10 @@ + item and the line will be most probably ignored. For this reason, it is not + recommended to put spaces around the ':' characters. + ++ ++ Hostnames should be written as Fully-Qualified Host Name (FQHN) to avoid ++ confusion with device names or PAM service names. ++ + + + +diff --git a/modules/pam_access/pam_access.8.xml b/modules/pam_access/pam_access.8.xml +index 9a6556c..eab9d9f 100644 +--- a/modules/pam_access/pam_access.8.xml ++++ b/modules/pam_access/pam_access.8.xml +@@ -25,11 +25,14 @@ + + debug + ++ ++ noaudit ++ + + nodefgroup + + +- noaudit ++ nodns + + + accessfile=file +@@ -112,6 +115,33 @@ + + + ++ ++ ++ nodefgroup ++ ++ ++ ++ User tokens which are not enclosed in parentheses will not be ++ matched against the group database. The backwards compatible default is ++ to try the group database match even for tokens not enclosed ++ in parentheses. ++ ++ ++ ++ ++ ++ ++ nodns ++ ++ ++ ++ Do not try to resolve tokens as hostnames, only IPv4 and IPv6 ++ addresses will be resolved. Which means to allow login from a ++ remote host, the IP addresses need to be specified in access.conf. ++ ++ ++ ++ + + + +@@ -153,20 +183,6 @@ + + + +- +- +- +- +- +- +- User tokens which are not enclosed in parentheses will not be +- matched against the group database. The backwards compatible default is +- to try the group database match even for tokens not enclosed +- in parentheses. +- +- +- +- + + + +diff --git a/modules/pam_access/pam_access.c b/modules/pam_access/pam_access.c +index bca424f..00a0a77 100644 +--- a/modules/pam_access/pam_access.c ++++ b/modules/pam_access/pam_access.c +@@ -92,6 +92,7 @@ struct login_info { + int debug; /* Print debugging messages. */ + int only_new_group_syntax; /* Only allow group entries of the form "(xyz)" */ + int noaudit; /* Do not audit denials */ ++ int nodns; /* Do not try to resolve tokens as hostnames */ + const char *fs; /* field separator */ + const char *sep; /* list-element separator */ + int from_remote_host; /* If PAM_RHOST was used for from */ +@@ -143,6 +144,8 @@ parse_args(pam_handle_t *pamh, struct login_info *loginfo, + loginfo->only_new_group_syntax = YES; + } else if (strcmp (argv[i], "noaudit") == 0) { + loginfo->noaudit = YES; ++ } else if (strcmp (argv[i], "nodns") == 0) { ++ loginfo->nodns = YES; + } else { + pam_syslog(pamh, LOG_ERR, "unrecognized option [%s]", argv[i]); + } +@@ -637,7 +640,7 @@ remote_match (pam_handle_t *pamh, char *tok, struct login_info *item) + if ((str_len = strlen(string)) > tok_len + && strcasecmp(tok, string + str_len - tok_len) == 0) + return YES; +- } else if (tok[tok_len - 1] == '.') { /* internet network numbers (end with ".") */ ++ } else if (tok[tok_len - 1] == '.') { /* internet network numbers/subnet (end with ".") */ + struct addrinfo hint; + + memset (&hint, '\0', sizeof (hint)); +@@ -712,6 +715,39 @@ string_match (pam_handle_t *pamh, const char *tok, const char *string, + } + + ++static int ++is_device (pam_handle_t *pamh, const char *tok) ++{ ++ struct stat st; ++ const char *dev = "/dev/"; ++ char *devname; ++ ++ devname = malloc (strlen(dev) + strlen (tok) + 1); ++ if (devname == NULL) { ++ pam_syslog(pamh, LOG_ERR, "Cannot allocate memory for device name: %m"); ++ /* ++ * We should return an error and abort, but pam_access has no good ++ * error handling. ++ */ ++ return NO; ++ } ++ ++ char *cp = stpcpy (devname, dev); ++ strcpy (cp, tok); ++ ++ if (lstat(devname, &st) != 0) ++ { ++ free (devname); ++ return NO; ++ } ++ free (devname); ++ ++ if (S_ISCHR(st.st_mode)) ++ return YES; ++ ++ return NO; ++} ++ + /* network_netmask_match - match a string against one token + * where string is a hostname or ip (v4,v6) address and tok + * represents either a hostname, a single ip (v4,v6) address +@@ -773,10 +809,42 @@ network_netmask_match (pam_handle_t *pamh, + return NO; + } + } ++ else if (isipaddr(tok, NULL, NULL) == YES) ++ { ++ if (getaddrinfo (tok, NULL, NULL, &ai) != 0) ++ { ++ if (item->debug) ++ pam_syslog(pamh, LOG_DEBUG, "cannot resolve IP address \"%s\"", tok); ++ ++ return NO; ++ } ++ netmask_ptr = NULL; ++ } ++ else if (item->nodns) ++ { ++ /* Only hostnames are left, which we would need to resolve via DNS */ ++ return NO; ++ } + else + { ++ /* Bail out on X11 Display entries and ttys. */ ++ if (tok[0] == ':') ++ { ++ if (item->debug) ++ pam_syslog (pamh, LOG_DEBUG, ++ "network_netmask_match: tok=%s is X11 display", tok); ++ return NO; ++ } ++ if (is_device (pamh, tok)) ++ { ++ if (item->debug) ++ pam_syslog (pamh, LOG_DEBUG, ++ "network_netmask_match: tok=%s is a TTY", tok); ++ return NO; ++ } ++ + /* +- * It is either an IP address or a hostname. ++ * It is most likely a hostname. + * Let getaddrinfo sort everything out + */ + if (getaddrinfo (tok, NULL, NULL, &ai) != 0) +-- +2.50.1 + diff --git a/meta/recipes-extended/pam/libpam_1.5.2.bb b/meta/recipes-extended/pam/libpam_1.5.2.bb index 658212dd829..7d6546be530 100644 --- a/meta/recipes-extended/pam/libpam_1.5.2.bb +++ b/meta/recipes-extended/pam/libpam_1.5.2.bb @@ -34,6 +34,7 @@ SRC_URI = "https://github.com/linux-pam/linux-pam/releases/download/v${PV}/Linux file://CVE-2025-6020-01.patch \ file://CVE-2025-6020-02.patch \ file://CVE-2025-6020-03.patch \ + file://CVE-2024-10963.patch \ " SRC_URI[sha256sum] = "e4ec7131a91da44512574268f493c6d8ca105c87091691b8e9b56ca685d4f94d" From patchwork Mon Mar 16 09:28:31 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83516 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 286C8F46436 for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46896.1773653411529118100 for ; Mon, 16 Mar 2026 02:30:11 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=uCUvqG/0; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4852e09e23dso36281745e9.0 for ; Mon, 16 Mar 2026 02:30:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653409; x=1774258209; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=RPhMAG4JJ/yZAS1ZJoWCwtOMNBV5F4LoMnGyMw/FFKU=; b=uCUvqG/0GOfOBRNimXPQY5ylYgCZYT8X+3XSHsSmNQqNC+FxWGTxSaKCN/AG3KdFUn /xlzZ8RBXKIVHfk4iQZYnVh85+d38o6vpNqdVN6Nqck/OH7mx0KVaJPx/Q+asiz6hxbH 1YyCIaNxRhG5K5QBiDFGe1ZSmXu18U5j9A86U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653409; x=1774258209; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=RPhMAG4JJ/yZAS1ZJoWCwtOMNBV5F4LoMnGyMw/FFKU=; b=mTcx5qHc0b2qLaWqWVPkpqj6S7iAgq0eE2MrYiXpvqgIiRcXtTY0S7C8kwK5nOi9py c/7BLwX9gD1xKg8JkubAdYDJlNsswwUOhxALMA/hzSqH8PyxnWB+Bgqy7kzWb6lu95+C oBzOvgVuPdFE14UaOyFsUv1gDn70ATFfBZxzYHMxGvklSA0vHDowzFHWdt5NNWw/6y0J XGAxyJvGaSXU9PswSn1a5pnq/Ux+IFJOn05McmgcwGE7gG5JvFu25xHJZnDBbvUXTW/0 rfkn96uWficMqwwp/QCXqxmydwC4j5reTbWZDTWs/t8D4JgHe6PCk0rxUst1nBV3dYp7 /RRQ== X-Gm-Message-State: AOJu0Yx0RM1+OPuIG6IxfjhJXlyAF1HPRWSHsWpiR9Na9b8mJE+VoVBg notIQFe0DHq2P1jQEUc1lNOzSUaHlLP0apIuYhO9gxw6uyee9Lhi26YfcVqK+t976y25EfOhi92 RIi+f X-Gm-Gg: ATEYQzzb8ryGW+XEYoHDWQ7uJOWYL60BZYlQ30VRxEpsU5yoZbG6FRLijeTaPvAyfni QFLZKH3W+qeJqLAP6p320RsV5LHR/AiJNn9s//WPdfEOYZ/rJ/FXy/RYQPkhvzHtNV5zPW2vRSO CsP+ZOGhhZ7fr0mOKibF3ULVnyO1e+2KU/kxls1tTh6pfJPUDirOmrZf17ETxf+DtDsfcM0LwVz FX5mbkn8nlOsWG4t4sKXIpMpAgj5hG8u4j7Erisel0ykUp5FY59EkkDmF0s5SncVLQ/bikm/jWJ UAazXkCBYXu407R4Pohqm6b0Rd3YHWq+d4jwYxxZua4HA8Mvr3ETjIehyZLts5E6lJyqA8s7RpV 0uEpRf1+KCvJe3gmutPXYDatCiLiIqmPCy+rKphJq8X2c6OxrwiOimGYe5qPTjms5wI1n6XEcpz p4WwjTk/Ff773pN/xIX54hALzv07NQntToewCjNbmofqIMKg9OO68zGr3p77HKGgFeyBJrptks3 u/2GcGY/kebk0j2t7+L9wIGyDdFfTG4Cw== X-Received: by 2002:a05:600c:4f54:b0:485:3b5b:eb8 with SMTP id 5b1f17b1804b1-485567052b8mr202110135e9.26.1773653409535; Mon, 16 Mar 2026 02:30:09 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 12/17] libpam: re-add missing libgen include Date: Mon, 16 Mar 2026 10:28:31 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233233 From: Martin Jansa It was added by original commit for CVE-2025-6020-01.patch https://github.com/linux-pam/linux-pam/commit/475bd60c552b98c7eddb3270b0b4196847c0072e#diff-05f443e6acbe32a148a45648148739bf6f02f13acc5c20c6037bf933223d4d77 but removed here in the rebase, causing: ../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:11: error: call to undeclared function 'dirname'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 326 | parent = dirname(buf); | ^ ../../../Linux-PAM-1.5.3/modules/pam_namespace/pam_namespace.c:326:9: error: incompatible integer to pointer conversion assigning to 'char*' from 'int' [-Wint-conversion] 326 | parent = dirname(buf); | ^ ~~~~~~~~~~~~ Backport 6d88a28ac7b6ff61808eb46e5c85dabd17c77f2e from scarthgap. It's reproducible with clang-18 from kirkstone-clang18 branch of meta-clang. Signed-off-by: Steve Sakoman Signed-off-by: Martin Jansa Signed-off-by: Yoann Congal --- meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch b/meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch index 4f5f780f9cc..53ae2bd2eef 100644 --- a/meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch +++ b/meta/recipes-extended/pam/libpam/CVE-2025-6020-01.patch @@ -1528,7 +1528,7 @@ diff --git a/modules/pam_namespace/pam_namespace.h b/modules/pam_namespace/pam_n index b51f284..abd570d 100644 --- a/modules/pam_namespace/pam_namespace.h +++ b/modules/pam_namespace/pam_namespace.h -@@ -44,21 +44,16 @@ +@@ -44,21 +44,17 @@ #include #include #include @@ -1542,7 +1542,7 @@ index b51f284..abd570d 100644 -#include #include #include --#include + #include #include #include #include From patchwork Mon Mar 16 09:28:32 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83518 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49AC3F4643F for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46605.1773653412173104003 for ; Mon, 16 Mar 2026 02:30:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=FLRWaky6; spf=pass (domain: smile.fr, ip: 209.85.128.52, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-4852c9b4158so38779695e9.0 for ; Mon, 16 Mar 2026 02:30:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653410; x=1774258210; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=7Q7CBUX4jVr7V2Jz3e9tBDtAhhUKDBP0y94UQnqxh8U=; b=FLRWaky6CjcXRI0+o7XBDJEntWgzTonpCqbQ2QrnyrwMaE5eiToipB7YJTUUzT2Gfl d8Ckf8JZw31AHgwik/CNNLY7DT0RUbRI7c6gdBkeecwo744a3K5TP5c8sjv10TmfxHPD ssSvb0DQ4wTJ6Rqgml9KeWsIvo5dPjbOHCW6c= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653410; x=1774258210; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=7Q7CBUX4jVr7V2Jz3e9tBDtAhhUKDBP0y94UQnqxh8U=; b=VKWOTACL3lQgRCcOT+x2cB1/bCy85ufukmyCwWYOfd95sdRdxdMuGdP0XZpJE8Ofms rcmwFPuAcDQER2efN7kiUaUv1+rESFCJzxEZ4VRBfBolJnTq4I0jJewkhw6ritpSv0CX wraVSuoo4qCT/RnSWfNuA6Gw/w1uyILnrF4tbHuBkT3XYYZN6GQm0+7MWOoFYpwU7dzK kHdCCKDWL5I9dZerh7a0HdkPqW0ybT/+RdGT+phyldHkp7pNtKkG4z8m8vCXS0XFCs/M Wr9LYqr5b/kWAbnFoT9RUZZSJnURxU2GJr8kSzVtrnDGlGoKr3Tv6NNc7rHd2RvJVYR8 XB4g== X-Gm-Message-State: AOJu0Yye5QpI9C4va8c08ZT6WU18DWlJxaN+070KRWOyvZpN6sxaALJl R5RL/6QtI+GlMLr0ZyfTy26AZ0jqxvpvswyg3Kw4+WCN6HHYO1Rpqcw8y/8RXFSiM50Kdw2s5zX 3m8NB X-Gm-Gg: ATEYQzx0KKOtk9f1MBVPYx230hTDoO6a0wSXZWqgrXdyNl23IUqCTaIfDkVLyM6G01T tE5KinTofZdMXKldAcXXRkODhtwaWO0jHYryv0w9T8H287z7rZo+9FOVBJhh+XpU+8Sx/gFmXvk JAK7V5H7w1OdH5JohvTXDPvOI/jFGYVShvZKt6fIAoe/b6tg17KEh5sjMh4sjckmJ7yEW779vPp 9aBgQbFtTEppGxLfmu15Wgk8HqQSuIFuhSynOflMU4c3V53xXLNpfzFaBEWyFomizYSgQR15ORF tUharUnv7Z3wGaCvPOLQffvQ6Q2UjET8iaJViH6TGVK7bxSTnPUZt2uLWDAYjOkMgMalH6Z4FrF O1A8fYKYv+j2cQQrwqh4aGuPkw+5+ionMk0n9bew3rQZKZu+LUZm4cbvum+nU3fspU0wZzapOA4 gz3sdidEElCHh/RjfWFRKd1miwrc7aO+kc4oHY/8sGNtKqT9h7VEv4/eQANc4YvS5u/nruIn1sc x96hs9T3kwUpnBeRGe51IlfpSuqNYoyAA== X-Received: by 2002:a05:600c:1f96:b0:485:40db:d40c with SMTP id 5b1f17b1804b1-485566cf8f0mr221818205e9.3.1773653410145; Mon, 16 Mar 2026 02:30:10 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.09 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:09 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 13/17] lsb.py: strip ' from os-release file Date: Mon, 16 Mar 2026 10:28:32 +0100 Message-ID: <8111d2e4b7006f1cd62732e7e12f465568ed37f8.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233234 From: Martin Jansa In gentoo the file looks like this: NAME='Gentoo' ID='gentoo' PRETTY_NAME='Gentoo Linux' VERSION='2.18' VERSION_ID='2.18' HOME_URL='https://www.gentoo.org/' SUPPORT_URL='https://www.gentoo.org/support/' BUG_REPORT_URL='https://bugs.gentoo.org/' ANSI_COLOR='1;32' ' were added with: https://github.com/gentoo/gentoo/commit/2f590e35c9d3d13d5673163527120b2de97fdc80 before that the os-release file looked like this: NAME=Gentoo ID=gentoo PRETTY_NAME="Gentoo Linux" ANSI_COLOR="1;32" HOME_URL="https://www.gentoo.org/" SUPPORT_URL="https://www.gentoo.org/support/" BUG_REPORT_URL="https://bugs.gentoo.org/" VERSION_ID="2.18" The ' is stripped from the ID later in distro_identifier with: # Filter out any non-alphanumerics and convert to lowercase distro_id = re.sub(r'\W', '', distro_id).lower() but not from version which results in a weird NATIVELSBSTRING like: NATIVELSBSTRING = "gentoo-'2.18'" And similarly the directory name in sstate-cache: oe-core $ ls -d sstate-cache/gentoo-* "sstate-cache/gentoo-'2.18'" sstate-cache/gentoo-2.18 Signed-off-by: Martin Jansa Signed-off-by: Yoann Congal --- meta/lib/oe/lsb.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/lib/oe/lsb.py b/meta/lib/oe/lsb.py index 43e46380d7b..f2c3c0ff568 100644 --- a/meta/lib/oe/lsb.py +++ b/meta/lib/oe/lsb.py @@ -14,7 +14,7 @@ def get_os_release(): key, val = line.rstrip().split('=', 1) except ValueError: continue - data[key.strip()] = val.strip('"') + data[key.strip()] = val.strip('"\'') return data def release_dict_osr(): From patchwork Mon Mar 16 09:28:33 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83515 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC98EF46435 for ; Mon, 16 Mar 2026 09:30:19 +0000 (UTC) Received: from mail-wm1-f42.google.com (mail-wm1-f42.google.com [209.85.128.42]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46607.1773653412911331244 for ; Mon, 16 Mar 2026 02:30:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=PwRbmdBo; spf=pass (domain: smile.fr, ip: 209.85.128.42, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f42.google.com with SMTP id 5b1f17b1804b1-4852e9ca034so39423015e9.2 for ; Mon, 16 Mar 2026 02:30:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653411; x=1774258211; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=+iUboOrmgL8lrU0Q1zx7gyjF9rrIv36WPtuap9bylnI=; b=PwRbmdBoKeU/wXVh6mmgnN/+clMz8HclIGjDli1xiHKVQ9wgCzuLPHMMoj9MXTnN9s g629oM1idJwpp3K36acjpNNEewDJtoLxD5TUi8EVrmQZzYANRVp0EiVVfqiiQdoukrWQ 3Zqard4X4JONCHRtYgcZN0XTFft1k2QIcvQao= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653411; x=1774258211; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=+iUboOrmgL8lrU0Q1zx7gyjF9rrIv36WPtuap9bylnI=; b=h3fU0xVo2GmSevhEfuH8Iz1ALUMCBXnnKHQXZdDmyltXjH7d846xfY79gsUXnb8OPZ aSepYGegZr9ZkiLCROrra3jex73I9jJNbTWGmJMUARs5R/2pRQaNprpCIWbAAv+k+nPS i7EpVpbT+oF0ekT8cj5MVRWCouPE39GkK4Hyl+eJweReTDHfsEs7Rs+/yus2jVSU/8P4 9eATgkz2fwngj2Ttk6U7T12fStoYLzxJS1zNW7KIK1I7KgjKiMBHfIj/5znQYdlqroNy v6wzydNrWa1tmRyxuOs05Z+XLTVc8D43kPAzgW682eV63RUzoWhZ+J2ckWkudKcDjMWm gmaA== X-Gm-Message-State: AOJu0YzqCMXXRs/c8bGWzXEGK827kI33HKmgceot93e6CviAy8bweHjs PVOztn5eWHrT40eCzMLuGr7UJUbafw51FojyMNvmTWY/Qbks6l/SykMgTSqGiOWzUm1tBnUmXOG DxOI0 X-Gm-Gg: ATEYQzyNQQ1wob/4gHU+itgrGdDTSzbvJHo5JMPR8wBPcB17nGgJjJtWoH8wgTo9UTA d64elb6ID/3P/HR9s2P3TWBujfrommwWYqAXUaVOZlzIXLwMhtBMygFtLkcs4Fn68Vi106g3vsT 5XFmTJoWRqJO3aqYfmr2D7N6BnbKOTErOrhWCSzeL8xLRuk0x71/Y3rQJ7Y6HwrSJu20YT0WPSM PVnL1EUIi3oZ8LBw3ZBrggSRkb6HkuFlbU6tQU8UV8mpr3EClbuR1S1dtreUz8GfNbJiFZkhxOQ h98xzYf+wGevdRvgXqO2Bs1lXW9AdJEAbTNqiLjd8iCkf0f9UwkpRCpD+jgobFHFaitsDQODUnI JxKGTSijuNz+SG0FxNWaVQwo4kSwsq+eVF595X5qqftkIoxQVncitkn0D6XhnfCe4j/HQDsmPw8 UZ3gdoxLbdT5YhoYjGchj80dEOQ6Qh0P7LLxTo6tFOeh97NkJIIQyA43yBWB/MQMrghKK6xVpxE Uih2Ijn/wG00D30HppDR23F04T8/FXOZA== X-Received: by 2002:a05:600c:3588:b0:485:5d25:81a9 with SMTP id 5b1f17b1804b1-4855d258656mr168077095e9.14.1773653410778; Mon, 16 Mar 2026 02:30:10 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 14/17] python3-pip: Fix CVE-2026-1703 Date: Mon, 16 Mar 2026 10:28:33 +0100 Message-ID: <63573d3d95a2ae38e4e562bb4c2eca379125462d.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233236 From: Vijay Anusuri Pick patch according to [1] [1] https://security-tracker.debian.org/tracker/CVE-2026-1703 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-1703 [3] https://github.com/pypa/pip/pull/13777 Signed-off-by: Vijay Anusuri Signed-off-by: Yoann Congal --- .../python/python3-pip/CVE-2026-1703.patch | 37 +++++++++++++++++++ .../python/python3-pip_22.0.3.bb | 1 + 2 files changed, 38 insertions(+) create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch diff --git a/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch b/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch new file mode 100644 index 00000000000..7a9bc1c9afa --- /dev/null +++ b/meta/recipes-devtools/python/python3-pip/CVE-2026-1703.patch @@ -0,0 +1,37 @@ +From 4c651b70d60ed91b13663bcda9b3ed41748d0124 Mon Sep 17 00:00:00 2001 +From: Seth Michael Larson +Date: Fri, 30 Jan 2026 09:49:11 -0600 +Subject: [PATCH] Use os.path.commonpath() instead of commonprefix() + +Upstream-Status: Backport [https://github.com/pypa/pip/commit/4c651b70d60ed91b13663bcda9b3ed41748d0124] +CVE: CVE-2026-1703 +Signed-off-by: Vijay Anusuri +--- + news/+1ee322a1.bugfix.rst | 1 + + src/pip/_internal/utils/unpacking.py | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + create mode 100644 news/+1ee322a1.bugfix.rst + +diff --git a/news/+1ee322a1.bugfix.rst b/news/+1ee322a1.bugfix.rst +new file mode 100644 +index 0000000..edb1b32 +--- /dev/null ++++ b/news/+1ee322a1.bugfix.rst +@@ -0,0 +1 @@ ++Use a path-segment prefix comparison, not char-by-char. +diff --git a/src/pip/_internal/utils/unpacking.py b/src/pip/_internal/utils/unpacking.py +index 5f63f97..3cebbf7 100644 +--- a/src/pip/_internal/utils/unpacking.py ++++ b/src/pip/_internal/utils/unpacking.py +@@ -81,7 +81,7 @@ def is_within_directory(directory: str, target: str) -> bool: + abs_directory = os.path.abspath(directory) + abs_target = os.path.abspath(target) + +- prefix = os.path.commonprefix([abs_directory, abs_target]) ++ prefix = os.path.commonpath([abs_directory, abs_target]) + return prefix == abs_directory + + +-- +2.25.1 + diff --git a/meta/recipes-devtools/python/python3-pip_22.0.3.bb b/meta/recipes-devtools/python/python3-pip_22.0.3.bb index 28eab9c3dea..e49be588390 100644 --- a/meta/recipes-devtools/python/python3-pip_22.0.3.bb +++ b/meta/recipes-devtools/python/python3-pip_22.0.3.bb @@ -38,6 +38,7 @@ SRC_URI += "file://0001-change-shebang-to-python3.patch \ file://no_shebang_mangling.patch \ file://reproducible.patch \ file://CVE-2023-5752.patch \ + file://CVE-2026-1703.patch \ " SRC_URI[sha256sum] = "f29d589df8c8ab99c060e68ad294c4a9ed896624f6368c5349d70aa581b333d0" From patchwork Mon Mar 16 09:28:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83513 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C8823F46433 for ; Mon, 16 Mar 2026 09:30:19 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.46897.1773653413409211435 for ; Mon, 16 Mar 2026 02:30:13 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=tqAJCsVT; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4853c1ca73aso35669265e9.2 for ; Mon, 16 Mar 2026 02:30:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653411; x=1774258211; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=xh8JkQqfySRyFpH0k1JChOkeKuXow9O98XT8IBXeVqI=; b=tqAJCsVT75iE7wcLrd5HbSZON15w51BiLOCgqI7ts3e6vvSPQUPsmIoGS8nMpb6xSk 24PvP678ZD0bbMyk6ssPlNkSQD+xU9qZxYaJt6wqofx2ghHX233E1WRTqhYy6TKh9BxB aWZ1Qio8ue7LvKmzCqCTDrSRFaja/622Pxt4g= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653411; x=1774258211; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=xh8JkQqfySRyFpH0k1JChOkeKuXow9O98XT8IBXeVqI=; b=tLVd/2d+IXEVqXw1ZTWhHSulP/yhK804C8HpVRba7Uu0zy29OkwNWCJXgkHACPu6k1 4OzXIuIFut9mUaBKLsycrTzJruJmXEo5ti1TxUHOsXdD8JrV3VQjW/tfJ9QJXzUPsUm6 Kpxfc/tsydEj+2tqpw5Jt6MlFTdtP6kOMyH7UgkgIuyzpSDcuExyXeC2zcrlRvacx+iJ tK5lgwsdFZUyewqHEcRW9KvaEFue+sAWTvZYGbUBuolhJQfBY5SxA7CJVynbRbZhRs9V CfUJ2u3meWbBcxm2ZMKn91XSQH72Zy1ZrGzFLatGxy+EQd0tYML82KPGu7yLe7TKXR9k aAww== X-Gm-Message-State: AOJu0Ywf3w37lMoXUROvssAsPOZJanV3e/jdg49xLCvmMjdAUFdLBkXn vX+uOliyxQpGwoyY3op8Pk5cS37RxJ5kSlkUuLyAu6L3hAsrF864N0bQThHw3lTYvzUP7NYfguY 9aSje X-Gm-Gg: ATEYQzxj7JgLRNcdp/WMq67K0E8JvAICWXuk7MffYcSGaqBnbtap/SIMxz3AqduEWEr 05rHWNRxhyWjSejGl6VZPmKSBOrOdAUh1YYsnVKkp4gZ6kCGBlnb8RBGN56PTsRy+PcoZkoRqMO sGBMpKbqNRdwvII5cHwpjiSo7hGiEd3MDQXvHgWoXmzbtXT1gjKdSRZbZspaPoc3jGggSCqbjVO muiBYGCZBOCrClC0Xx6wlDI2IVovERUcdB5XN0kw9X0tI/NRLal2sIsdLL3LmnizRGbSghkUD5X RMG91gT7Y4WNrEBHXReTetmu1MSFlqKkpiPWoZhBl9l2RSyHtFdq8jsx4lBtgjBrwwF268AUuST s1XBlSyy2z9ebFm/5vLcW6nGFReG/ayO8LP44oDBlPdTXDGFuvKVDe6v6AJ6voXdYSHp1+n89VF KF/VVBzgldkc/D8Kxfm87TPKb93iwfKAR3CwNbfYeL8hxpZH+aAkL2w43fbyrgwjsr6df06HzqK gaM386jhM3vUBzhShQpida5mNCzzcOGGNr7vEov64WI X-Received: by 2002:a05:600c:1e8b:b0:483:b505:9db7 with SMTP id 5b1f17b1804b1-4855672ada8mr198156435e9.32.1773653411380; Mon, 16 Mar 2026 02:30:11 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.10 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:10 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 15/17] scripts/install-buildtools: Update to 4.0.33 Date: Mon, 16 Mar 2026 10:28:34 +0100 Message-ID: <003b4f26061a7ae634b64165482a23e28ae347b6.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233237 From: Aleksandar Nikolic Update to the 4.0.33 release of the 4.0 series for buildtools Signed-off-by: Aleksandar Nikolic Signed-off-by: Yoann Congal --- scripts/install-buildtools | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/install-buildtools b/scripts/install-buildtools index c105dfe4623..6a1762c14b3 100755 --- a/scripts/install-buildtools +++ b/scripts/install-buildtools @@ -57,8 +57,8 @@ logger = scriptutils.logger_create(PROGNAME, stream=sys.stdout) DEFAULT_INSTALL_DIR = os.path.join(os.path.split(scripts_path)[0],'buildtools') DEFAULT_BASE_URL = 'https://downloads.yoctoproject.org/releases/yocto' -DEFAULT_RELEASE = 'yocto-4.0.32' -DEFAULT_INSTALLER_VERSION = '4.0.32' +DEFAULT_RELEASE = 'yocto-4.0.33' +DEFAULT_INSTALLER_VERSION = '4.0.33' DEFAULT_BUILDDATE = '202110XX' # Python version sanity check From patchwork Mon Mar 16 09:28:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83512 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2029F4642E for ; Mon, 16 Mar 2026 09:30:19 +0000 (UTC) Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46608.1773653414821206785 for ; Mon, 16 Mar 2026 02:30:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=u5wpFU2i; spf=pass (domain: smile.fr, ip: 209.85.128.43, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4853aec185aso35591945e9.1 for ; Mon, 16 Mar 2026 02:30:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653413; x=1774258213; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=69bGY8sRAnqQnuUUadM0Bx18tFRBTopYNLXt+QOZ0hE=; b=u5wpFU2iY2tKOW57yXyx+pRRezP5YfJ7/lH/8XPmXR1Ot3Q/Sbh99OFU/IP+gAxkyU BgBo4CRyf5sHivckeC6+kopg2ei+BmWeD++jD/DK5NZToJ+i6xNo9f0MIe+KQjjOqYWq wspAh8U7EtPnSfQBG/PVcp66YtgbGB+4uHzsE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653413; x=1774258213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=69bGY8sRAnqQnuUUadM0Bx18tFRBTopYNLXt+QOZ0hE=; b=PG8CGLMaW5E0iq9kA7yosWwooOVxdPSTJVgv426lnCn1uOeVPpnElqSOtjEz8JDSEt YcxGHh1w5ms+5AAY1e5FEuxbpPGaF1KkosHTy8wX9riKeTiAIKIhBjg4O8kbbNXWcxi2 Ach/ot+36wekVcvKGBq1yQv4dv7JW1ZE11EKmaUJL4Ggavt08lFhTj1EQX3NOKiprMQ5 WI+c3re36TJH1EjYc6v/OW4+vQElMIt4TZfxMRLRSY/INJCDJIrgCONP7Ahj5lE+GEWc jS6Cm4sOOwqqdK2feCKHwYQ8UHyUis+fvZe2nIHjVrDAF+/mZsq4lT7pQ5y1DG6axgkI MqgQ== X-Gm-Message-State: AOJu0YwUM1w9eqJ6m4wBhYypco7ZRXZb5RAV/uB1dRPY5lOI6SxPGzIr UzmmLm0N7a6LTFcoYdoqyDU2mxQ+c6Us9xQ0MXdsb4aYWyacST+5/kJwPE9jlGg1k5C0Fznu5nY j0dML X-Gm-Gg: ATEYQzwF5Lfi4U9yaI9JJcP3XggdtBbDZraaaa3HuR1/dIQ3qVx/XftVfP+kdoUmgm3 rfHoiy3ci/lo9BFulpQyN1qPn0iPlpqcsmMTCxMkppGOkXnO5Xt+ttyNzjRnrBR4Nrgx3RpAPfe 0SiwH1Lm7iu7lOLYjVjzCyeRq1DC0kN1RHpqs1AjPKdOjC6WX73F7nA/bRCUxRQjBCkj3d/qw+/ 5w0LHaGoDdiGu98K1PBQolwrQG8WZ56J3uKVLe1QEAkfA7eJWvsARqAb8IYH1RyCgwyAfovX58g 7oVjBpUjKSqx7Wc1NZD30pJw8IYqg4rAcftjvx/0abYo/Pd3uf2QrsbpdstDK0xNLq6Q9KsnYHm N6ovHWWnl6Usx0U6WkG7BDSB6VcghfhFTtyC5D3iF4/kphb0H7vpkg8VLwvNP0G8JJ8VnXKUh5F Sm6JH4iexBZukXm02/SKpNTGoZi0VUXByqsPkaW9or+P8dCAlw/cfbPGIJnU4xy+FyjPS6cmTr7 aHlKxImPUqAVk82oPPpHGATTfn32I3iwQ== X-Received: by 2002:a05:600c:8b41:b0:483:c35d:3659 with SMTP id 5b1f17b1804b1-485566fd0d4mr202562395e9.18.1773653412676; Mon, 16 Mar 2026 02:30:12 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:11 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 16/17] libcomps: Fix libcomps-native build on GCC14 hosts (e.g. Fedora 41) Date: Mon, 16 Mar 2026 10:28:35 +0100 Message-ID: <95a25cf11b69c84cc90dd9104ba0c6f96e4459a3.1773652940.git.yoann.congal@smile.fr> X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233238 From: Yoann Congal This version of libcomps does wrong pointer assignment, and on GCC14 hosts (e.g. Fedora 41), this fails to build with: | build/tmp-glibc/work/x86_64-linux/libcomps-native/0.1.18-r0/git/libcomps/tests/check_parse.c:588:11: error: assignment to ‘COMPS_DocGroup *’ from incompatible pointer type ‘COMPS_DocCategory *’ [-Wincompatible-pointer-types] | 588 | g = (COMPS_DocCategory*)it->comps_obj; Backport a patch making the assignment correct. Signed-off-by: Yoann Congal --- ...orrect-variable-for-category-and-env.patch | 48 +++++++++++++++++++ .../libcomps/libcomps_0.1.18.bb | 1 + 2 files changed, 49 insertions(+) create mode 100644 meta/recipes-devtools/libcomps/libcomps/0001-Fix-build-use-correct-variable-for-category-and-env.patch diff --git a/meta/recipes-devtools/libcomps/libcomps/0001-Fix-build-use-correct-variable-for-category-and-env.patch b/meta/recipes-devtools/libcomps/libcomps/0001-Fix-build-use-correct-variable-for-category-and-env.patch new file mode 100644 index 00000000000..6d243064452 --- /dev/null +++ b/meta/recipes-devtools/libcomps/libcomps/0001-Fix-build-use-correct-variable-for-category-and-env.patch @@ -0,0 +1,48 @@ +From adcf4aaca08ea712af4b4e886931fd8ed59c7bf7 Mon Sep 17 00:00:00 2001 +From: Aleš Matěj +Date: Tue, 2 Jan 2024 08:32:55 +0100 +Subject: [PATCH] Fix build: use correct variable for category and env +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Fixes: +- error: assignment to ‘COMPS_DocGroup *’ from incompatible pointer type ‘COMPS_DocCategory *’ +- error: assignment to ‘COMPS_DocGroup *’ from incompatible pointer type ‘COMPS_DocEnv *’ + +For: https://fedoraproject.org/wiki/Changes/PortingToModernC +(https://fedoraproject.org/wiki/Toolchain/PortingToModernC) +(https://gitlab.com/fweimer-rh/fedora-modernc-logs/-/blob/main/logs/l/libcomps.log) + +Upstream-Status: Backport [https://github.com/rpm-software-management/libcomps/commit/a71bce7e62990550a57688e51b14eb82d6de196b] +Signed-off-by: Yoann Congal +--- + libcomps/tests/check_parse.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/libcomps/tests/check_parse.c b/libcomps/tests/check_parse.c +index e5935e1..689cb98 100644 +--- a/libcomps/tests/check_parse.c ++++ b/libcomps/tests/check_parse.c +@@ -585,8 +585,8 @@ START_TEST(test_arch) + list = comps_doc_categories(doc2); + ck_assert(list->len == 2); + for (it = list->first, x=0; it != NULL; it = it->next, x++) { +- g = (COMPS_DocCategory*)it->comps_obj; +- str = (COMPS_Str*)comps_doccategory_get_id(g); ++ c = (COMPS_DocCategory*)it->comps_obj; ++ str = (COMPS_Str*)comps_doccategory_get_id(c); + ck_assert_msg(strcmp(str->val, cats[0][x]) == 0, "%s != %s", + str->val, cats[0][x]); + COMPS_OBJECT_DESTROY(str); +@@ -605,8 +605,8 @@ START_TEST(test_arch) + list = comps_doc_environments(doc2); + ck_assert(list->len == 2); + for (it = list->first, x=0; it != NULL; it = it->next, x++) { +- g = (COMPS_DocEnv*)it->comps_obj; +- str = (COMPS_Str*)comps_docenv_get_id(g); ++ e = (COMPS_DocEnv*)it->comps_obj; ++ str = (COMPS_Str*)comps_docenv_get_id(e); + ck_assert_msg(strcmp(str->val, envs[0][x]) == 0, "%s != %s", + str->val, envs[0][x]); + COMPS_OBJECT_DESTROY(str); diff --git a/meta/recipes-devtools/libcomps/libcomps_0.1.18.bb b/meta/recipes-devtools/libcomps/libcomps_0.1.18.bb index dd0a1f8f952..db6f3179626 100644 --- a/meta/recipes-devtools/libcomps/libcomps_0.1.18.bb +++ b/meta/recipes-devtools/libcomps/libcomps_0.1.18.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "git://github.com/rpm-software-management/libcomps.git;branch=master;protocol=https \ file://0002-Do-not-set-PYTHON_INSTALL_DIR-by-running-python.patch \ + file://0001-Fix-build-use-correct-variable-for-category-and-env.patch \ " SRCREV = "dee4ae37f7818709802de28c4d16fa823bd83ae2" From patchwork Mon Mar 16 09:28:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Yoann Congal X-Patchwork-Id: 83517 X-Patchwork-Delegate: yoann.congal@smile.fr Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B609F4643B for ; Mon, 16 Mar 2026 09:30:20 +0000 (UTC) Received: from mail-wm1-f54.google.com (mail-wm1-f54.google.com [209.85.128.54]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.46609.1773653415340466279 for ; Mon, 16 Mar 2026 02:30:15 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@smile.fr header.s=google header.b=Njsb2s8I; spf=pass (domain: smile.fr, ip: 209.85.128.54, mailfrom: yoann.congal@smile.fr) Received: by mail-wm1-f54.google.com with SMTP id 5b1f17b1804b1-4853c3c2fe7so26031835e9.0 for ; Mon, 16 Mar 2026 02:30:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smile.fr; s=google; t=1773653413; x=1774258213; darn=lists.openembedded.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:from:to:cc:subject:date:message-id :reply-to; bh=AD+PdVkD+iM+2kwBDqgfvInF9P1CbMP4CpbvfmdJf70=; b=Njsb2s8IttpzOXNaFengvZ6/NLJQUaNikOCxJFzOba3hHlP/8eghlmsh6UCZbFK2CY usgCa8ulAdKqHCmmMwO2J/Qb2FpRFFZPzu/pjjg/jTneW8BoYo+pA+5nj68v37/Uvm+q S/YiP3i74V7sQYETUklCxQB595jJtWoSfH/A4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1773653413; x=1774258213; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=AD+PdVkD+iM+2kwBDqgfvInF9P1CbMP4CpbvfmdJf70=; b=s1sfwOM5555Yriw+H9RK4Mwdgx4ytK6C+iSKa7Sv1SV34Vmf5XpzJ9QVKw9WiDXY57 vKNR7otigjxGOPRRhnFyQOBL0M5BIxgS+lF0ImOOA6oTSqLAoP+dKpXD1hoe+4UsuC5l Nw9ya+yMjXLdo6JEm1QeRdO669cggCtjlcUUULKJfpzZU2YajTlBZt3pKTklOwcu7DCG JHpN7G/1enionVNw3nNNTS1HXxrNXcRnq3OS3ROtj2nqXb1s4JzaA5mwtgzkAZhqyG9g lQqke2ZMhMVkekimCbovVYZpDEwwKaHfdKVwguQEdPjkqRHBFmhRrZS320HU2vdQuWYh YScg== X-Gm-Message-State: AOJu0Yz9vrI8yQB3DR+P4ZKDs9LwnDo+XEwSvzjcaR7m8mUNtxl5OdfB 5qNdoCt+l5TKuCk/F4opDxvU59eb2PxMQ1HaUg2AEgRElbYt372lcBsmb08otGyNm7HbfALB5cA 0WA3i X-Gm-Gg: ATEYQzyPaAht7qcyEop4kkeddQeajqGIJNdVtfOinriKuYnrUx+WSCJuOkM0oDvat2T IOnjnMQFJPiRf/zwRGaoy558LeQnCDwxVVQyoe5UfYHVWZHxxUJVaScRG1dHAUT3+egThV4zOtR quvPTOe5VcqF9ptN/cJknwSlcoqwRdlUq1gv0fUTE9XC8FeWHrRMEB5zbS3asAZ4M92C0frM5iC W2zyTnFHaqswtXvX81h8MWxem14OvJXV0+xsfXsC/HEnNzWJoykQpY+P79mBSzQIoDD8bV3GXOP SVnZbhVCvS2ytF0LAeh5/2U4bPTXChXwM0Q0jXipjwjtsxProteOhLCS9DllXtQfx6hUqNQVGrB 9hTdNg4qEc/udBT0ul20CWFmvBF1xvApsFH5mCPrcIMJHwJaSWhCB2uULdTlqxgNtRuJOsO3eWq gApPhAwsRJihIDY+vasUXen15MXtnWuiaP8Htz//rMaOedX45MfwEpzDWIP9uvn52esaLtFm7pz 2RkPmDcWOm30A+pIFIIHRiy/zSNRNqsoA== X-Received: by 2002:a05:600c:3552:b0:485:3a59:99ca with SMTP id 5b1f17b1804b1-485566fab0bmr198447035e9.16.1773653413386; Mon, 16 Mar 2026 02:30:13 -0700 (PDT) Received: from FRSMI25-LASER.idf.intranet (static-css-ccs-204145.business.bouyguestelecom.com. [176.157.204.145]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48557a732cesm91138265e9.12.2026.03.16.02.30.12 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 16 Mar 2026 02:30:12 -0700 (PDT) From: Yoann Congal To: openembedded-core@lists.openembedded.org Subject: [OE-core][kirkstone 17/17] createrepo-c: Fix createrepo-c-native build on GCC14 hosts (e.g. Fedora 41) Date: Mon, 16 Mar 2026 10:28:36 +0100 Message-ID: X-Mailer: git-send-email 2.47.3 In-Reply-To: References: MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 16 Mar 2026 09:30:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/233239 From: Yoann Congal This version of createrepo-c does a wrong pointer assignment, and on GCC14[0] hosts (e.g. Fedora 41), this fails to build with: FAILED: src/python/CMakeFiles/_createrepo_c.dir/createrepo_cmodule.c.o build/tmp-glibc/hosttools/gcc [...] python/createrepo_cmodule.c python/createrepo_cmodule.c:82:41: error: initialization of ‘PyObject * (*)(PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *)’} from incompatible pointer type ‘PyObject * (*)(PyObject *, PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *, struct _object *)’} [-Wincompatible-pointer-types] 82 | {"xml_parse_main_metadata_together",(PyCFunctionWithKeywords)py_xml_parse_main_metadata_together, | ^ src/python/createrepo_cmodule.c:82:41: note: (near initialization for ‘createrepo_c_methods[15].ml_meth’) Add a patch to fix the pointer assignment. The patched code has since been removed by upstream. [0]: https://gcc.gnu.org/gcc-14/porting_to.html#incompatible-pointer-types Signed-off-by: Yoann Congal --- ...-proper-cast-for-PyMethodDef.ml_meth.patch | 41 +++++++++++++++++++ .../createrepo-c/createrepo-c_0.19.0.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta/recipes-devtools/createrepo-c/createrepo-c/0001-Use-proper-cast-for-PyMethodDef.ml_meth.patch diff --git a/meta/recipes-devtools/createrepo-c/createrepo-c/0001-Use-proper-cast-for-PyMethodDef.ml_meth.patch b/meta/recipes-devtools/createrepo-c/createrepo-c/0001-Use-proper-cast-for-PyMethodDef.ml_meth.patch new file mode 100644 index 00000000000..fc09fdfcdd8 --- /dev/null +++ b/meta/recipes-devtools/createrepo-c/createrepo-c/0001-Use-proper-cast-for-PyMethodDef.ml_meth.patch @@ -0,0 +1,41 @@ +From d2dd32bcdcc717a0da48d5e983c4396ccc79fc9c Mon Sep 17 00:00:00 2001 +From: Yoann Congal +Date: Sun, 15 Mar 2026 23:25:16 +0100 +Subject: [PATCH] Use proper cast for PyMethodDef.ml_meth +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +PyMethodDef.ml_meth is of PyCFunction type. Using a +PyCFunctionWithKeywords cast for its initializer trigger build failure +with GCC >=14 [0]: +| FAILED: src/python/CMakeFiles/_createrepo_c.dir/createrepo_cmodule.c.o +| build/tmp-glibc/hosttools/gcc [...] python/createrepo_cmodule.c +| python/createrepo_cmodule.c:82:41: error: initialization of ‘PyObject * (*)(PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *)’} from incompatible pointer type ‘PyObject * (*)(PyObject *, PyObject *, PyObject *)’ {aka ‘struct _object * (*)(struct _object *, struct _object *, struct _object *)’} [-Wincompatible-pointer-types] +| 82 | {"xml_parse_main_metadata_together",(PyCFunctionWithKeywords)py_xml_parse_main_metadata_together, +| | ^ +| src/python/createrepo_cmodule.c:82:41: note: (near initialization for ‘createrepo_c_methods[15].ml_meth’) + +Fix this by using the proper (PyCFunction) cast. + +[0]: https://gcc.gnu.org/gcc-14/porting_to.html#incompatible-pointer-types + +Upstream-Status: Inappropriate [Upstream removed the patched code in 7092ab2 (Remove python bindings for xml_parse_main_metadata_together, 2022-03-17)] +Signed-off-by: Yoann Congal +--- + src/python/createrepo_cmodule.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/python/createrepo_cmodule.c b/src/python/createrepo_cmodule.c +index c0b9200..94a206d 100644 +--- a/src/python/createrepo_cmodule.c ++++ b/src/python/createrepo_cmodule.c +@@ -79,7 +79,7 @@ static struct PyMethodDef createrepo_c_methods[] = { + METH_VARARGS, xml_parse_repomd__doc__}, + {"xml_parse_updateinfo", (PyCFunction)py_xml_parse_updateinfo, + METH_VARARGS, xml_parse_updateinfo__doc__}, +- {"xml_parse_main_metadata_together",(PyCFunctionWithKeywords)py_xml_parse_main_metadata_together, ++ {"xml_parse_main_metadata_together",(PyCFunction)py_xml_parse_main_metadata_together, + METH_VARARGS | METH_KEYWORDS, xml_parse_main_metadata_together__doc__}, + {"checksum_name_str", (PyCFunction)py_checksum_name_str, + METH_VARARGS, checksum_name_str__doc__}, diff --git a/meta/recipes-devtools/createrepo-c/createrepo-c_0.19.0.bb b/meta/recipes-devtools/createrepo-c/createrepo-c_0.19.0.bb index 82351252e5a..dec882fddc6 100644 --- a/meta/recipes-devtools/createrepo-c/createrepo-c_0.19.0.bb +++ b/meta/recipes-devtools/createrepo-c/createrepo-c_0.19.0.bb @@ -6,6 +6,7 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263" SRC_URI = "git://github.com/rpm-software-management/createrepo_c;branch=master;protocol=https \ file://0001-Do-not-set-PYTHON_INSTALL_DIR-by-running-python.patch \ + file://0001-Use-proper-cast-for-PyMethodDef.ml_meth.patch \ " SRCREV = "a531ee881a8f1d9273b4383fb9fa604c56fff138"