Bump buidlroot version to 2018.02.6
This commit is contained in:
jbnadal
@@ -1,78 +0,0 @@
|
||||
From 1252dc1d1f465b8ab6b36ff7252e395e66a040cf Mon Sep 17 00:00:00 2001
|
||||
From: Simon McVittie <smcv@debian.org>
|
||||
Date: Fri, 21 Jul 2017 10:46:39 +0100
|
||||
Subject: [PATCH 1/2] config-loader-expat: Tell Expat not to defend against
|
||||
hash collisions
|
||||
|
||||
By default, Expat uses cryptographic-quality random numbers as a salt for
|
||||
its hash algorithm, and since 2.2.1 it gets them from the getrandom
|
||||
syscall on Linux. That syscall refuses to return any entropy until the
|
||||
kernel's CSPRNG (random pool) has been initialized. Unfortunately, this
|
||||
can take as long as 40 seconds on embedded devices with few entropy
|
||||
sources, which is too long: if the system dbus-daemon blocks for that
|
||||
length of time, important D-Bus clients like systemd and systemd-logind
|
||||
time out and fail to connect to it.
|
||||
|
||||
We're parsing small configuration files here, and we trust them
|
||||
completely, so we don't need to defend against hash collisions: nobody
|
||||
is going to be crafting them to cause pathological performance.
|
||||
|
||||
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=101858
|
||||
Signed-off-by: Simon McVittie <smcv@debian.org>
|
||||
Tested-by: Christopher Hewitt <hewitt@ieee.org>
|
||||
Reviewed-by: Philip Withnall <withnall@endlessm.com>
|
||||
|
||||
Upstream commit 1252dc1d1f465b8ab6b36ff7252e395e66a040cf
|
||||
Signed-off-by: Marcus Hoffmann <m.hoffmann@cartelsol.com>
|
||||
---
|
||||
bus/config-loader-expat.c | 14 ++++++++++++++
|
||||
configure.ac | 8 ++++++++
|
||||
2 files changed, 22 insertions(+)
|
||||
|
||||
diff --git a/bus/config-loader-expat.c b/bus/config-loader-expat.c
|
||||
index b571fda3..27cbe2d0 100644
|
||||
--- a/bus/config-loader-expat.c
|
||||
+++ b/bus/config-loader-expat.c
|
||||
@@ -203,6 +203,20 @@ bus_config_load (const DBusString *file,
|
||||
goto failed;
|
||||
}
|
||||
|
||||
+ /* We do not need protection against hash collisions (CVE-2012-0876)
|
||||
+ * because we are only parsing trusted XML; and if we let Expat block
|
||||
+ * waiting for the CSPRNG to be initialized, as it does by default to
|
||||
+ * defeat CVE-2012-0876, it can cause timeouts during early boot on
|
||||
+ * entropy-starved embedded devices.
|
||||
+ *
|
||||
+ * TODO: When Expat gets a more explicit API for this than
|
||||
+ * XML_SetHashSalt, check for that too, and use it preferentially.
|
||||
+ * https://github.com/libexpat/libexpat/issues/91 */
|
||||
+#if defined(HAVE_XML_SETHASHSALT)
|
||||
+ /* Any nonzero number will do. https://xkcd.com/221/ */
|
||||
+ XML_SetHashSalt (expat, 4);
|
||||
+#endif
|
||||
+
|
||||
if (!_dbus_string_get_dirname (file, &dirname))
|
||||
{
|
||||
dbus_set_error (error, DBUS_ERROR_NO_MEMORY, NULL);
|
||||
diff --git a/configure.ac b/configure.ac
|
||||
index 52da11fb..c4022ed7 100644
|
||||
--- a/configure.ac
|
||||
+++ b/configure.ac
|
||||
@@ -938,6 +938,14 @@ XML_CFLAGS=
|
||||
AC_SUBST([XML_CFLAGS])
|
||||
AC_SUBST([XML_LIBS])
|
||||
|
||||
+save_cflags="$CFLAGS"
|
||||
+save_libs="$LIBS"
|
||||
+CFLAGS="$CFLAGS $XML_CFLAGS"
|
||||
+LIBS="$LIBS $XML_LIBS"
|
||||
+AC_CHECK_FUNCS([XML_SetHashSalt])
|
||||
+CFLAGS="$save_cflags"
|
||||
+LIBS="$save_libs"
|
||||
+
|
||||
# Thread lib detection
|
||||
AC_ARG_VAR([THREAD_LIBS])
|
||||
save_libs="$LIBS"
|
||||
--
|
||||
2.11.0
|
||||
|
||||
@@ -1,2 +1,5 @@
|
||||
# Locally calculated after checking pgp signature
|
||||
sha256 a7b0ba6ea3e8d0e08afec5e3030d0245614268276620c536726f8fa6e5c43388 dbus-1.10.16.tar.gz
|
||||
# https://dbus.freedesktop.org/releases/dbus/dbus-1.12.2.tar.gz.asc
|
||||
sha256 272bb5091770b047c8188b926d5e6038fa4fe6745488b2add96b23e2d9a83d88 dbus-1.12.2.tar.gz
|
||||
# Locally calculated
|
||||
sha256 0e46f54efb12d04ab5c33713bacd0e140c9a35b57ae29e03c853203266e8f3a1 COPYING
|
||||
|
||||
@@ -4,11 +4,9 @@
|
||||
#
|
||||
################################################################################
|
||||
|
||||
DBUS_VERSION = 1.10.16
|
||||
DBUS_SITE = http://dbus.freedesktop.org/releases/dbus
|
||||
DBUS_LICENSE = AFLv2.1 or GPLv2+ (library, tools), GPLv2+ (tools)
|
||||
# 0001-config-loader-expat-Tell-Expat-not-to-defend-against.patch
|
||||
DBUS_AUTORECONF = YES
|
||||
DBUS_VERSION = 1.12.2
|
||||
DBUS_SITE = https://dbus.freedesktop.org/releases/dbus
|
||||
DBUS_LICENSE = AFL-2.1 or GPL-2.0+ (library, tools), GPL-2.0+ (tools)
|
||||
DBUS_LICENSE_FILES = COPYING
|
||||
DBUS_INSTALL_STAGING = YES
|
||||
|
||||
@@ -22,20 +20,15 @@ endef
|
||||
|
||||
DBUS_DEPENDENCIES = host-pkgconf expat
|
||||
|
||||
DBUS_CONF_ENV = ac_cv_have_abstract_sockets=yes
|
||||
DBUS_CONF_OPTS = \
|
||||
--with-dbus-user=dbus \
|
||||
--disable-tests \
|
||||
--disable-asserts \
|
||||
--enable-abstract-sockets \
|
||||
--disable-selinux \
|
||||
--disable-xml-docs \
|
||||
--disable-doxygen-docs \
|
||||
--disable-dnotify \
|
||||
--with-xml=expat \
|
||||
--with-system-socket=/var/run/dbus/system_bus_socket \
|
||||
--with-system-pid-file=/var/run/messagebus.pid \
|
||||
--with-init-scripts=none
|
||||
--with-system-pid-file=/var/run/messagebus.pid
|
||||
|
||||
ifeq ($(BR2_STATIC_LIBS),y)
|
||||
DBUS_CONF_OPTS += LIBS='-pthread'
|
||||
@@ -111,11 +104,9 @@ HOST_DBUS_CONF_OPTS = \
|
||||
--with-dbus-user=dbus \
|
||||
--disable-tests \
|
||||
--disable-asserts \
|
||||
--enable-abstract-sockets \
|
||||
--disable-selinux \
|
||||
--disable-xml-docs \
|
||||
--disable-doxygen-docs \
|
||||
--enable-dnotify \
|
||||
--without-x \
|
||||
--with-xml=expat
|
||||
|
||||
@@ -123,7 +114,7 @@ HOST_DBUS_CONF_OPTS = \
|
||||
DBUS_HOST_INTROSPECT = $(HOST_DBUS_DIR)/introspect.xml
|
||||
|
||||
HOST_DBUS_GEN_INTROSPECT = \
|
||||
$(HOST_DIR)/usr/bin/dbus-daemon --introspect > $(DBUS_HOST_INTROSPECT)
|
||||
$(HOST_DIR)/bin/dbus-daemon --introspect > $(DBUS_HOST_INTROSPECT)
|
||||
|
||||
HOST_DBUS_POST_INSTALL_HOOKS += HOST_DBUS_GEN_INTROSPECT
|
||||
|
||||
|
||||
Reference in New Issue
Block a user