Changelog:
============
- Fixed a 'TypeError' on PHP 8 when 'Security::$static_classes' was set to a
non-array value (e.g. the string ''none'') to disable static class access;
any non-array value now cleanly denies access. Use 'Security::$static_classes =
null' to disable access to all static classes.
- Security: the built-in 'stream:' resource type now validates the nested
stream wrapper against the security policy, so a template such as
'stream:php://filter/...' can no longer bypass 'Security::$streams' (including
'Security::$streams = null') to read local files
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 43fc425c32)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Backport patch to fix CVE-2026-55971.
References:
https://nvd.nist.gov/vuln/detail/CVE-2026-55971
Upstream fix:
https://github.com/apache/thrift/commit/db4a473f3a984eee27273256fe737be5dd175595
Testing:
The backported fix ships with a C++ Boost regression test,
test_theadertransport_zlib_roundtrip, in
lib/cpp/test/ThrifttReadCheckTests.cpp. The recipe builds with
-DBUILD_TESTING=OFF, so the C++ test suite is not compiled during a
normal build. To verify the fix, the suite was built with
BUILD_TESTING=ON (using the native thrift compiler for codegen via
THRIFT_COMPILER) and the resulting UnitTests binary was executed
against the target sysroot for MACHINE=qemux86-64.
Result: test_theadertransport_zlib_roundtrip passed. Full C++ UnitTests
suite: 79 of 80 test cases passed, 107659 of 107660 assertions passed.
The single failure (ToStringTest/locale_de_DE_floating_point_to_string)
is unrelated to this fix and is caused by the de_DE locale not being
present in the minimal test sysroot.
Signed-off-by: Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The backport dropped the "j++" body of the delpaths_sorted() grouping
loop while adding the "== 1" guard, turning "while (...) j++;" into an
empty-bodied "while (...);". The index never advances, so any update
that produces "empty" (which reaches _modify() -> delpaths()) hangs,
e.g. "map_values(. // empty)" and ".a |= empty". This also hangs the jq
ptest suite.
Restore the "j++" body while keeping the "== 1" guard.
Assisted-by: kiro:claude-opus-4.8
Signed-off-by: Tugrul Kukul <tugrul.kukul@est.tech>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
csysdig fails to link when stock Lua is also present in the sysroot:
ld.lld: error: undefined symbol: luaL_openselectedlibs
>>> referenced by chisel.cpp:1190
ld.lld: error: undefined symbol: lua_pcallk
ld.lld: error: undefined symbol: lua_setglobal
sysdig's chisel code does #include "lua.h" and links against LuaJIT
(lua${JIT}), but the recipe-sysroot also carries stock Lua headers
(openembedded-core lua installs lua.h into ${includedir}). Those headers
win the include search over ${includedir}/luajit-2.1, so the chisel
objects are compiled against stock Lua while the binary links
libluajit-5.1.so. In Lua >= 5.4.4 luaL_openlibs is a macro for
luaL_openselectedlibs and lua_setglobal/lua_pcallk are real symbols,
none of which LuaJIT (a Lua 5.1 ABI) provides, hence the undefined
references. -DLUA_INCLUDE_DIR does not help: sysdig's luajit.cmake only
consults it in its stock-Lua fallback, not when it finds LuaJIT.
Prepend ${STAGING_INCDIR}/luajit-2.1 to CFLAGS/CXXFLAGS. These land in
CMAKE_CXX_FLAGS, which precede CMake's generated -I includes, so LuaJIT's
lua.h is found first and matches the linked library.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 00e7a91180)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
The pypi class default python:h11 doesn't match how h11 is tracked
in the CVE databases. NVD has no CPE for it yet; the only existing
record (CVE-2025-43859) carries python-hyper:h11 in its CNA affected
entry [1], so set that pair.
CVE-2025-43859 (request smuggling) is fixed in 0.16.0, the version
we ship, so it resolves as not affected.
[1] https://www.cve.org/CVERecord?id=CVE-2025-43859
Signed-off-by: mark.yang <mark.yang@lge.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a9bfe001bd)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
lens_default.c defines PRIb64 through a fallback that hardcodes
__PRI64_PREFIX as "ll". That is only correct where uint64_t is unsigned
long long (ILP32). On LP64 musl targets uint64_t is unsigned long, so the
resulting "%llb" conversion does not match the argument and do_compile
aborts under -Werror=format:
lens_default.c:90:48: error: format '%llb' expects argument of type
'long long unsigned int', but argument 3 has type 'uint64_t'
{aka 'long unsigned int'}
glibc never reaches the fallback: it defines __PRI64_PREFIX itself,
wordsize aware, in <inttypes.h>. musl provides the same modifier there
under the name __PRI64 but not __PRI64_PREFIX, so the hardcoded "ll" is
used and is wrong on 64-bit. Reuse musl's __PRI64 when __PRI64_PREFIX is
absent, keeping "ll" as a last resort. glibc builds are unaffected: the
block is skipped entirely.
Signed-off-by: Alejandro Mery <amery@apptly.co>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 09a7b15072)
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
* Fix to set VERSION_INFO to create .so.3 instead of .so.11 which will
be reserved for a future 1.10.0 release
* Bugfix: Insufficient verification that responses belong to a
query (CVE-2026-10846). Thanks Pablo Ruiz from 'codecome.ai'
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit a5a18fe23f)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Changelog:
===========
- Fixed timing leak vulnerability in EdDSA/Ed25519 signatures.
- Various minor documentation fixes.
- Various minor build system fixes.
- Various minor compiler warning fixes.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>
(cherry picked from commit 25cfd0324c)
Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
Wang Mingyu
Ankur Tyagi
Khem Raj
Adarsh Jagadish Kamini
Jason Schonberg
Hetvi Thakar
Tugrul Kukul
mark.yang
He Zhe
Alejandro Mery