The relevant CVEs are associated with usc:cereal CPE.
See CVE db query:
sqlite> select * from PRODUCTS where PRODUCT like '%cereal%';
CVE-2020-11104|usc|cereal|||1.3.0|<=
CVE-2020-11105|usc|cereal|||1.3.0|<=
Signed-off-by: Gyorgy Sarvari <skandigraun@gmail.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Please see
https://git.yoctoproject.org/poky/commit/?id=4dd321f8b83afecd962393101b2a6861275b5265
for what changes are needed, and sed commands that can be used to make them en masse.
I've verified that bitbake -c patch world works with these, but did not run a world
build; the majority of recipes shouldn't need further fixups, but if there are
some that still fall out, they can be fixed in followups.
Signed-off-by: Alexander Kanavin <alex@linutronix.de>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Clang 18 is fussy about it
Fixes
unittests/map.hpp:65:25: error: non-constant-expression cannot be narrowed from type 'typename std::enable_if<std::is_integral<char>::value && sizeof(char) == sizeof(char), char>::type' (aka 'char') to 'const signed char' in initializer list [-Wc++11-narrowing-const-reference]
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Since gcc-12, gcc is also emitting calls to 64bit atomics
Fixes
unittests/CMakeFiles/test_atomic.dir/atomic.cpp.o:/usr/include/c++/12.0.1/atomic:285: more undefined references to `__atomic_load_8' follow
collect2: error: ld returned 1 exit status
Signed-off-by: Khem Raj <raj.khem@gmail.com>
clang/mips emits calls to atomic builtins which it expects from C
runtime perhaps but compiler-rt does not provide them so link in
libatomics
Fixes
atomic.cpp:(.text._ZN6cereal12Inpu
tArchiveINS_16JSONInputArchiveELj0EE7processIRNSt3__16atomicIdEEEEvOT_[_ZN6cereal12InputArchiveINS_16JSONInputArchiveELj0EE7processIRNSt3__16atomicIdEEEEvOT_]+0x10c): undefined reference to `__atomic_store_8'
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is a minor bug fix and build enhancement release for cereal.
The primary reason for this release is to correctly increment the version for
cereal in include/cereal/version.hpp.
Bug fixes and enhancements
--------------------------
Make doxygen docs reproducible
Add CMake options for building doc and sandbox
Correct patch version for 1.3.2
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
License-Update: year updated to 2022
0001-Use-GNUInstallDirs-instead-of-hard-wiring-install-di.patch
removed since it is included in 1.3.1
Changelog:
=========
Highlighted fixes and enhancements include:
------------------------------------------
Github actions in place of Travis CI
Doctest updates (and upstream patches!) to support all targeted compilers
Cmake modernization
Bug fixes and minor enhancements:
---------------------------------
Fix typo in docs in #597
Add MSVC 2019 to build, default ctor for static object
Fix json.hpp compilation issue when int32_t is a long
[cpp20] explicitly capture 'this' as copy
Fix rapidjson for Clang 10
Fixes to prevent clang-diagnostic errors
cleanup cmake files to be a little more moderen
CVE-2020-11105: Store a copy of each serialized shared_ptr within the archive to prevent the shared_ptr to be freed to early
add license files for components of cereal
Catch short documents in JSON input
C++17: use inline globals for StaticObjects
Use std::variant::emplace when loading
Use std::optional::emplace() when loading non-empty optional
Fix itsNextName not clearing when not found + style change
Update doctest to 2.4.6 + local fixes slated for upstream
Fixed loading of std::vector
Update license to match BSD template
Update doctest to 2.4.7
Use GNUInstallDirs instead of hard wiring install directories
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This patch updates SRC_URIs using git to include branch=master if no branch is set
and also to use protocol=https for github urls as generated by the conversion script
in OE-Core.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
This is the result of automated script (0.9.1) conversion:
oe-core/scripts/contrib/convert-overrides.py .
converting the metadata to use ":" as the override character instead of "_".
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
* Add "+git${SRCPV}" to PV to indicate that a non-released version is
used.
* Do not redefine FILES_${PN}-dev; the default will work just fine.
* Move PROVIDES to better match the style guide.
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
fixes CVE-2020-11105
adds license information for components of cerial
Signed-off-by: Adam Miartus <adam.miartus@softhows.eu>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
libcereal is header-only so create the empty base package so that
libcereal can be sanely included in an SDK via IMAGE_INSTALL, RDEPENDS,
and the like.
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Gyorgy Sarvari
Alexander Kanavin
Khem Raj
Martin Jansa
Mingli Yu
Wang Mingyu
Richard Purdie
Anton Blanchard
Peter Kjellerstedt
Adam Miartus
Pierre-Jean Texier
Brad Bishop
Fritjof Jonsson