staging/pepe2k/package/utils, branch v22.03.6

bsdiff: Add patches for CVEs

2023-11-19T13:58:44Z

Add two patches from Debian fixing CVEs in the bsdiff application. CVE-2014-9862: Heap vulnerability in bspatch CVE-2020-14315: Memory Corruption Vulnerability in bspatch Copied the patches from this location: https://salsa.debian.org/debian/bsdiff/-/blob/debian/latest/debian/patches/20-CVE-2014-9862.patch https://salsa.debian.org/debian/bsdiff/-/blob/debian/latest/debian/patches/33-CVE-2020-14315.patch Signed-off-by: Hauke Mehrtens (cherry picked from commit cac723e8b8748938b8d80603578c60189fc32b24)

packages: assign PKG_CPE_ID for all missing packages

2023-09-27T15:29:14Z

The PKG_CPE_ID links to NIST CPE version 2.2. Assign PKG_CPE_ID to all remaining package which have a CPE ID. Not every package has CPE id. Related: https://github.com/openwrt/packages/issues/8534 Signed-off-by: Alexander Couzens

lua: fix integer overflow in LNUM patch

2023-08-12T09:46:51Z

Safely detect integer overflow in try_addint() and try_subint(). Old code relied on undefined behavior, and recent versions of GCC on x86 optimized away the if-statements. This caused integer overflow in Lua code instead of falling back to floating-point numbers. Signed-off-by: Adam Bailey (cherry picked from commit 3a2e7c30d3e6a187ba1df740cdb24c8ad84dfe48)

treewide: Trigger reinstall of all wolfssl dependencies

2023-01-01T20:42:41Z

The ABI of the wolfssl library changed a bit between version 5.5.3 and 5.5.4. This release update will trigger a rebuild of all packages which are using wolfssl to make sure they are adapted to the new ABI. Signed-off-by: Hauke Mehrtens (cherry picked from commit ee47a28cec01c7943238bae45f65a98e4fc9abbe)

e2fsprogs: Fix CVE-2022-1304

2022-12-06T22:29:14Z

This fixes CVE-2022-1304: An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. Signed-off-by: Hauke Mehrtens (cherry picked from commit 60e335b76ea0aeedd9f8e01d247f9aaa617076da)

ucode: update to latest Git HEAD

2022-12-06T10:45:12Z

46d93c9 tests: fixup testcases 4c654df types: adjust double printing format eac2add compiler: fix bytecode for logical assignments of properties 3903b18 fs: add `realpath()` function 8366102 math: add isnan() function eef83d3 tests: relax sleep() test 394e901 lib: uc_json(): accept trailing whitespace when parsing strings 1867c8b uloop: terminate parent uloop in task child processes d2cc003 uci: auto-load package in `ctx.foreach()` and `ctx.get_first()` 6c5ee53 compiler: ensure that arrow functions with block bodies return no value fdc9b6a compiler: fix `??=`, `||=` and `&&=` logical assignment semantics 88dcca7 add cmake to install requires for debian Signed-off-by: Jo-Philipp Wich (cherry picked from commit a4d67066e39bd93c7011c8e07b740a326e4e9803)

busybox: awk: fix use after free (CVE-2022-30065)

2022-11-05T21:43:45Z

This backports a commit which fixes a use after free bug in awk. CVE-2022-30065 description: A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. Signed-off-by: Hauke Mehrtens (cherry picked from commit 8b383ee2a0d21144258346ad39006fc499d04b4f)

util-linux: Update to version 2.37.4

2022-11-05T21:42:08Z

This update contains only a security fix for an issue in chsh and chfn, but OpenWrt is not packaging these applications so OpenWrt is not affected. In OpenWrt master this was already fixed by the update to util-linux 2.38. Signed-off-by: Hauke Mehrtens

ucode: update to latest Git HEAD

2022-10-18T09:26:21Z

00af065 fs: expose `getdelim()` functionality through `fd.read()` 21ace5e lexer: fixes for regex literal parsing Signed-off-by: Jo-Philipp Wich (cherry picked from commit 1b90c7441b81aee7b1212e8918e3ec7144375d96)

ucode: update to latest Git HEAD

2022-10-14T22:43:22Z

4ae7072 fs: use `getline()` for line wise read operations 21ace5e lexer: fixes for regex literal parsing 00965fa lib: implement slice() function 76d396d main: implement print mode 7bbba78 compiler: optimize function return opcode generation a45f2a3 lexer: improve regex literal handling d64d5d6 vm: maintain export symbol tables per program f4b4ded uloop: task: gracefully handle absent output callback a58fe47 ubus: hold reference to underlying connection until deferred is concluded e23b58a lib: uc_system(): retry waitpid() on EINTR cc4eb79 ubus: support obtaining numeric error code 01c412c ubus: add toplevel constants for ubus status codes 8e240fa ubus: allow object method call handlers to return a numeric status code 5cdddd3 lib: add limit support to split() and replace() 0ba9c3e fs: add optional third permission argument to fs.open() c1f7b3b lib: remove fixed capture group limit in match() and regex replace() Signed-off-by: Jo-Philipp Wich (backported from commits 639754e36d849553e288f8e34f51f793761c07db and 5110dcb1fa44fc1aac737c63b31474daa471de89)