Complete Yocto mirror with license table for TQMa6UL (2038-compliance)
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
Siggi (OpenClaw Agent)
@@ -0,0 +1,37 @@
|
||||
From 0b5e73c4321de0ba1d495fdc0967054b2a77931c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Mon, 10 Jul 2023 13:36:10 +0100
|
||||
Subject: [PATCH] Fix for CVE-2017-16516
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Description: Fix for CVE-2017-16516
|
||||
Potential buffer overread: A JSON file can cause denial of service.
|
||||
Origin: https://github.com/brianmario/yajl-ruby/commit/a8ca8f476655adaa187eedc60bdc770fff3c51ce
|
||||
|
||||
CVE: CVE-2017-16516
|
||||
Upstream-Status: Submitted [https://github.com/lloyd/yajl/issues/248]
|
||||
Signed-off-by: Ross Burton <ross.burton@arm.com>
|
||||
---
|
||||
src/yajl_encode.c | 4 ++--
|
||||
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/yajl_encode.c b/src/yajl_encode.c
|
||||
index fd08258..0d97cc5 100644
|
||||
--- a/src/yajl_encode.c
|
||||
+++ b/src/yajl_encode.c
|
||||
@@ -139,8 +139,8 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
|
||||
end+=3;
|
||||
/* check if this is a surrogate */
|
||||
if ((codepoint & 0xFC00) == 0xD800) {
|
||||
- end++;
|
||||
- if (str[end] == '\\' && str[end + 1] == 'u') {
|
||||
+ if (end + 2 < len && str[end + 1] == '\\' && str[end + 2] == 'u') {
|
||||
+ end++;
|
||||
unsigned int surrogate = 0;
|
||||
hexToDigit(&surrogate, str + end + 2);
|
||||
codepoint =
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
From 17de4d15687aa30c49660dc4b792b1fb4d38b569 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
||||
Date: Thu, 7 Apr 2022 17:29:54 +0200
|
||||
Subject: [PATCH] Fix CVE-2022-24795
|
||||
|
||||
There was an integer overflow in yajl_buf_ensure_available() leading
|
||||
to allocating less memory than requested. Then data were written past
|
||||
the allocated heap buffer in yajl_buf_append(), the only caller of
|
||||
yajl_buf_ensure_available(). Another result of the overflow was an
|
||||
infinite loop without a return from yajl_buf_ensure_available().
|
||||
|
||||
yajl-ruby project, which bundles yajl, fixed it
|
||||
<https://github.com/brianmario/yajl-ruby/pull/211> by checking for the
|
||||
integer overflow, fortifying buffer allocations, and report the
|
||||
failures to a caller. But then the caller yajl_buf_append() skips
|
||||
a memory write if yajl_buf_ensure_available() failed leading to a data
|
||||
corruption.
|
||||
|
||||
A yajl fork mainter recommended calling memory allocation callbacks with
|
||||
the large memory request and let them to handle it. But that has the
|
||||
problem that it's not possible pass the overely large size to the
|
||||
callbacks.
|
||||
|
||||
This patch catches the integer overflow and terminates the process
|
||||
with abort().
|
||||
|
||||
CVE: CVE-2022-24795
|
||||
Upstream-Status: Submitted [https://github.com/lloyd/yajl/issues/239]
|
||||
Signed-off-by: Ross Burton <ross.burton@arm.com>
|
||||
---
|
||||
src/yajl_buf.c | 12 +++++++++++-
|
||||
1 file changed, 11 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/yajl_buf.c b/src/yajl_buf.c
|
||||
index 1aeafde..55c11ad 100644
|
||||
--- a/src/yajl_buf.c
|
||||
+++ b/src/yajl_buf.c
|
||||
@@ -45,7 +45,17 @@ void yajl_buf_ensure_available(yajl_buf buf, size_t want)
|
||||
|
||||
need = buf->len;
|
||||
|
||||
- while (want >= (need - buf->used)) need <<= 1;
|
||||
+ if (((buf->used > want) ? buf->used : want) > (size_t)(buf->used + want)) {
|
||||
+ /* We cannot allocate more memory than SIZE_MAX. */
|
||||
+ abort();
|
||||
+ }
|
||||
+ while (want >= (need - buf->used)) {
|
||||
+ if (need >= (size_t)((size_t)(-1)<<1)>>1) {
|
||||
+ /* need would overflow. */
|
||||
+ abort();
|
||||
+ }
|
||||
+ need <<= 1;
|
||||
+ }
|
||||
|
||||
if (need != buf->len) {
|
||||
buf->data = (unsigned char *) YA_REALLOC(buf->alloc, buf->data, need);
|
||||
--
|
||||
2.34.1
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
Fix memory leaks. Taken from the Fedora packaging (https://src.fedoraproject.org/rpms/yajl)
|
||||
where it was backported from openEuler.
|
||||
|
||||
CVE: CVE-2023-33460
|
||||
Upstream-Status: Submitted [https://github.com/lloyd/yajl/issues/250]
|
||||
Signed-off-by: Ross Burton <ross.burton@arm.com>
|
||||
|
||||
diff --git a/src/yajl_tree.c b/src/yajl_tree.c
|
||||
index 3d357a3..56c7012 100644
|
||||
--- a/src/yajl_tree.c
|
||||
+++ b/src/yajl_tree.c
|
||||
@@ -143,7 +143,7 @@ static yajl_val context_pop(context_t *ctx)
|
||||
ctx->stack = stack->next;
|
||||
|
||||
v = stack->value;
|
||||
-
|
||||
+ free (stack->key);
|
||||
free (stack);
|
||||
|
||||
return (v);
|
||||
@@ -444,7 +444,14 @@ yajl_val yajl_tree_parse (const char *input,
|
||||
snprintf(error_buffer, error_buffer_size, "%s", internal_err_str);
|
||||
YA_FREE(&(handle->alloc), internal_err_str);
|
||||
}
|
||||
+ while(ctx.stack != NULL) {
|
||||
+ yajl_val v = context_pop(&ctx);
|
||||
+ yajl_tree_free(v);
|
||||
+ }
|
||||
yajl_free (handle);
|
||||
+ //If the requested memory is not released in time, it will cause memory leakage
|
||||
+ if(ctx.root)
|
||||
+ yajl_tree_free(ctx.root);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
SUMMARY = "Yet Another JSON Library."
|
||||
|
||||
DESCRIPTION = "YAJL is a small event-driven (SAX-style) JSON parser \
|
||||
written in ANSI C, and a small validating JSON generator."
|
||||
|
||||
HOMEPAGE = "http://lloyd.github.com/yajl/"
|
||||
|
||||
LICENSE = "BSD-3-Clause"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=da2e9aa80962d54e7c726f232a2bd1e8"
|
||||
|
||||
# Use 1.0.12 tag
|
||||
SRCREV = "17b1790fb9c8abbb3c0f7e083864a6a014191d56"
|
||||
SRC_URI = "git://github.com/lloyd/yajl;nobranch=1;protocol=https"
|
||||
|
||||
inherit cmake lib_package
|
||||
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
EXTRA_OECMAKE = "-DLIB_SUFFIX=${@d.getVar('baselib').replace('lib', '')}"
|
||||
|
||||
UPSTREAM_CHECK_GITTAGREGEX = "(?P<pver>1(\.\d+)+)"
|
||||
@@ -0,0 +1,22 @@
|
||||
SUMMARY = "Yet Another JSON Library."
|
||||
|
||||
DESCRIPTION = "YAJL is a small event-driven (SAX-style) JSON parser \
|
||||
written in ANSI C, and a small validating JSON generator."
|
||||
|
||||
HOMEPAGE = "https://lloyd.github.io/yajl/"
|
||||
|
||||
LICENSE = "ISC"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=39af6eb42999852bdd3ea00ad120a36d"
|
||||
|
||||
SRC_URI = "git://github.com/lloyd/yajl;branch=master;protocol=https \
|
||||
file://CVE-2017-16516.patch \
|
||||
file://CVE-2022-24795.patch \
|
||||
file://CVE-2023-33460.patch \
|
||||
"
|
||||
SRCREV = "a0ecdde0c042b9256170f2f8890dd9451a4240aa"
|
||||
|
||||
S = "${WORKDIR}/git"
|
||||
|
||||
inherit cmake lib_package
|
||||
|
||||
EXTRA_OECMAKE = "-DLIB_SUFFIX=${@d.getVar('baselib').replace('lib', '')}"
|
||||
Reference in New Issue
Block a user