The Makefile uses `KERN_MAJ = $(shell uname -r | cut -d . -f1)` to
determine if the kernel version is <7, which enables building vboxvideo.
Therefore, with a host kernel >=7 and a target kernel <7, vboxvideo is
not built and we get this error in vboxsf:
```
| In file included from ../vboxsf/include/iprt/stdarg.h:59,
| from ../vboxsf/include/iprt/types.h:44,
| from ../vboxsf/include/iprt/string.h:43,
| from mount.vboxsf.c:62:
| ../vboxsf/include/linux/stdarg.h:6:9: warning: 'va_start' redefined
| 6 | #define va_start(v, l) __builtin_va_start(v, l)
| | ^~~~~~~~
| In file included from mount.vboxsf.c:44:
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:49:9:
note: this is the location of the previous definition
| 49 | #define va_start(...) __builtin_c23_va_start(__VA_ARGS__)
| | ^~~~~~~~
| ../vboxsf/include/linux/stdarg.h:8:9: warning: 'va_arg' redefined
| 8 | #define va_arg(v, T) __builtin_va_arg(v, T)
| | ^~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:54:9:
note: this is the location of the previous definition
| 54 | #define va_arg(v,l) __builtin_va_arg(v,l)
| | ^~~~~~
| ../vboxsf/include/linux/stdarg.h:9:9: warning: 'va_copy' redefined
| 9 | #define va_copy(d, s) __builtin_va_copy(d, s)
| | ^~~~~~~
|
/work/oe-upstream/bitbake-builds/poky-master/build/tmp/work/qemux86_64-poky-linux/vboxguestdrivers/7.2.14/recipe-sysroot-native/usr/lib/x86_64-poky-linux/gcc/x86_64-poky-linux/16.1.0/include/stdarg.h:57:9:
note: this is the location of the previous definition
| 57 | #define va_copy(d,s) __builtin_va_copy(d,s)
| | ^~~~~~~
```
If the missmatch is reversed, there is probably a different error.
To fix this we provide the actual target kernel version via the KERN_MAJ
Makefile variable
Note: The kernel version might be empty during parsing (e.g. when using
linux-dummy), therefore `or ''` is needed.
CC: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
- Disallow extraction outside extraction path, in case of existing
symlink.
- Disallow creating symlinks to outside of extraction path.
- Apply length limit to passwords, so too long password give same
result as for unrar.
This work was sponsored by GOVCERT.LU.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 250067e217)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upstream changes (NEWS):
* Require GSSDP >= 1.6.5 and reuse its allocated TCP socket for the web
server.
* Do not leak a GError in the ACL handler.
* Fix IPv6 host-header validation.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 575122a4a0)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upstream changes (git log v1.5.4..v1.5.6):
* Group/bonding fixes: check value length in group config storage, fix
deriving string options by a group, fix getting SRTO_RCVBUF/SRTO_SNDBUF
and rejecting options not allowed on a group, and fix a wrong
'connection lost' error when sending to a connection-pending group.
* Fix a stalled connection that should break after rogue NAK/ACK, and a
misleading listening-socket error message.
* Build: Windows-on-Arm64 support, fix Windows installers, fix use of
the OPENSSL_USE_STATIC_LIBS CMake option, deprecation warning for
Windows+PThreads.
Drop 0002-allow-build-with-cmake-4.patch: it backported the
cmake_minimum_required(VERSION 3.5) bump, which is already present in
1.5.6 upstream.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 70dfb6465f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Upstream changes (release notes):
* 1.0.19: security and edge-case correctness fixes - heap-buffer-overflow
read in decode_slice_unit_tiles() from unvalidated PPS tile geometry
(CVE-2026-45382) and heap OOB read in decode_slice_unit_WPP() via an
out-of-bounds CtbAddrRStoTS access (CVE-2026-45383); dec265 SDL fixes
for 4:4:4 streams and mid-stream resolution changes. ABI compatible
with 1.0.18.
Not upgraded to 1.1.x: 1.1.0 reworked the x86 SIMD path to dispatch at
runtime via __builtin_cpu_supports(), which reads the compiler-rt global
__cpu_model. Under this distro's clang/lld toolchain, linking the shared
library then fails with
R_X86_64_PC32 cannot be used against symbol '__cpu_model'; recompile with -fPIC
because clang emits a direct PC-relative access to that exported,
preemptible symbol. Building the objects -fPIC, -Bsymbolic,
--exclude-libs, -fno-direct-access-external-data and a version script
localizing __cpu_model were all tried without success (lld validates the
relocation before applying the localization). 1.0.19 stays on the
compile-time SSE path and builds cleanly, so it is the latest buildable
release here.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 99ca84156d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
python3-mpv RDEPENDS on mpv, which requires ffmpeg (LICENSE_FLAGS =
"commercial"). With "commercial" not in LICENSE_FLAGS_ACCEPTED, parsing
the universe target - which ignores EXCLUDE_FROM_WORLD - reports:
WARNING: Nothing RPROVIDES 'mpv' (but .../python3-mpv_1.0.8.bb
RDEPENDS on or otherwise requires it)
NOTE: Runtime target 'python3-mpv' is unbuildable, removing...
Now that mpv carries LICENSE_FLAGS = "commercial" and is skipped, carry
the same flag here so python3-mpv is likewise skipped cleanly in both
world and universe instead of surfacing as an unbuildable dependency.
The redundant EXCLUDE_FROM_WORLD is dropped.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 2ba9dd8823)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
mpv has an unconditional DEPENDS on ffmpeg, which carries
LICENSE_FLAGS = "commercial". When "commercial" is not in
LICENSE_FLAGS_ACCEPTED (the default), ffmpeg is skipped, and parsing the
universe target - which, unlike world, ignores EXCLUDE_FROM_WORLD -
reports mpv as an unbuildable dependency chain:
WARNING: Nothing PROVIDES 'ffmpeg' (but .../mpv_0.41.0.bb DEPENDS on
or otherwise requires it)
ffmpeg was skipped: Has a restricted license 'commercial' ...
NOTE: Runtime target 'mpv' is unbuildable, removing...
Since mpv cannot be built or shipped without accepting ffmpeg's terms,
propagate the flag onto mpv itself. bitbake then skips mpv cleanly (in
both world and universe) with the same "restricted license" note as
ffmpeg, and no longer emits the confusing unbuildable-dependency
warnings. This mirrors how oe-core's gstreamer1.0-libav (which also
DEPENDS on ffmpeg) carries LICENSE_FLAGS = "commercial".
The explicit EXCLUDE_FROM_WORLD is now redundant - a recipe skipped for
its license flags is already excluded from world - so drop it.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 5f4e021e2d)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This fixes:
WARNING: hyprland-image-1.0-r0 do_rootfs: User colord has been defined as (colord, 998, 998, -, /home/colord, /bin/false) but sysusers.d expects it as (colord, -, -, colord colour management daemon, /var/lib/colord, -)
Signed-off-by: Markus Volk <f_l_k@t-online.de>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit f4f7c09deb)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
============
- Fixed a 'TypeError' on PHP 8 when 'Security::$static_classes' was set to a
non-array value (e.g. the string ''none'') to disable static class access;
any non-array value now cleanly denies access. Use 'Security::$static_classes =
null' to disable access to all static classes.
- Security: the built-in 'stream:' resource type now validates the nested
stream wrapper against the security policy, so a template such as
'stream:php://filter/...' can no longer bypass 'Security::$streams' (including
'Security::$streams = null') to read local files
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fc425c32)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Backport patch to fix CVE-2026-55971.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
Upstream fix:
https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595
Testing:
The backported fix ships with a C++ Boost regression test,
test_theadertransport_zlib_roundtrip, in
lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with
-DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a
normal build. To verify the fix, the suite was built with
BUILD_TESTING=ON (using the native thrift compiler for codegen via
THRIFT_COMPILER) and the resulting UnitTests binary was executed
against the target sysroot for MACHINE=qemux86-64.
Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests
suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed.
The single failure (ToStringTest/locale_de_DE_floating_point_to_string)
is unrelated to this fix and is caused by the de_DE locale not being
present in the minimal test sysroot.
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.
Restore the "j++" body while keeping the "== 1" guard.
Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Rouven Rastetter
Peter Marko
Omkar Patil
Devansh Patel
Wang Mingyu
Leon Anavi
Ankur Tyagi
Khem Raj
Markus Volk
Jason Schonberg
Adarsh Jagadish Kamini
Hetvi Thakar
Tugrul Kukul