nodejs: security bump 0.10.x series to 0.10.48
authorPeter Korsgaard <peter@korsgaard.com>
Fri, 2 Dec 2016 20:16:52 +0000 (21:16 +0100)
committerThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Fri, 2 Dec 2016 23:01:13 +0000 (00:01 +0100)
c-ares: fix for single-byte buffer overwrite, CVE-2016-5180, more
information at https://c-ares.haxx.se/adv_20160929.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
package/nodejs/0.10.47/0001-remove-python-bz2-dependency.patch [deleted file]
package/nodejs/0.10.47/0002-gyp-force-link-command-to-use-CXX.patch [deleted file]
package/nodejs/0.10.47/0003-fix-musl-USE-MISC-build-issue.patch [deleted file]
package/nodejs/0.10.47/0004-Fix-support-for-uClibc-ng.patch [deleted file]
package/nodejs/0.10.48/0001-remove-python-bz2-dependency.patch [new file with mode: 0644]
package/nodejs/0.10.48/0002-gyp-force-link-command-to-use-CXX.patch [new file with mode: 0644]
package/nodejs/0.10.48/0003-fix-musl-USE-MISC-build-issue.patch [new file with mode: 0644]
package/nodejs/0.10.48/0004-Fix-support-for-uClibc-ng.patch [new file with mode: 0644]
package/nodejs/Config.in
package/nodejs/nodejs.hash

diff --git a/package/nodejs/0.10.47/0001-remove-python-bz2-dependency.patch b/package/nodejs/0.10.47/0001-remove-python-bz2-dependency.patch
deleted file mode 100644 (file)
index 75fe437..0000000
+++ /dev/null
@@ -1,27 +0,0 @@
-Remove dependency on Python bz2 module
-
-The Python bz2 module is only needed in certain cases, so only import
-it when needed. In the normal nodejs build, this allows to remove the
-dependency on this module.
-
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
-Index: b/deps/v8/tools/js2c.py
-===================================================================
---- a/deps/v8/tools/js2c.py
-+++ b/deps/v8/tools/js2c.py
-@@ -33,7 +33,6 @@
- import os, re, sys, string
- import jsmin
--import bz2
- def ToCAsciiArray(lines):
-@@ -344,6 +343,7 @@
-   else:
-     raw_sources_declaration = RAW_SOURCES_COMPRESSION_DECLARATION
-     if env['COMPRESSION'] == 'bz2':
-+      import bz2
-       all_sources = bz2.compress("".join(all_sources))
-     total_length = len(all_sources)
-     sources_data = ToCArray(all_sources)
diff --git a/package/nodejs/0.10.47/0002-gyp-force-link-command-to-use-CXX.patch b/package/nodejs/0.10.47/0002-gyp-force-link-command-to-use-CXX.patch
deleted file mode 100644 (file)
index a2f02ab..0000000
+++ /dev/null
@@ -1,26 +0,0 @@
-From 00d809e9305241f8636a2d75e22c493293e6971a Mon Sep 17 00:00:00 2001
-From: Samuel Martin <s.martin49@gmail.com>
-Date: Sun, 20 Apr 2014 15:03:01 +0200
-Subject: [PATCH] gyp: force link command to use CXX
-
-Signed-off-by: Samuel Martin <s.martin49@gmail.com>
----
- tools/gyp/pylib/gyp/generator/make.py | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/tools/gyp/pylib/gyp/generator/make.py b/tools/gyp/pylib/gyp/generator/make.py
-index 0de510e..54e4c96 100644
---- a/tools/gyp/pylib/gyp/generator/make.py
-+++ b/tools/gyp/pylib/gyp/generator/make.py
-@@ -134,7 +134,7 @@ cmd_alink_thin = rm -f $@ && $(AR.$(TOOLSET)) crsT $@ $(filter %.o,$^)
- # special "figure out circular dependencies" flags around the entire
- # input list during linking.
- quiet_cmd_link = LINK($(TOOLSET)) $@
--cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ -Wl,--start-group $(LD_INPUTS) -Wl,--end-group $(LIBS)
-+cmd_link = $(CXX.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ -Wl,--start-group $(LD_INPUTS) -Wl,--end-group $(LIBS)
- # We support two kinds of shared objects (.so):
- # 1) shared_library, which is just bundling together many dependent libraries
--- 
-1.9.2
-
diff --git a/package/nodejs/0.10.47/0003-fix-musl-USE-MISC-build-issue.patch b/package/nodejs/0.10.47/0003-fix-musl-USE-MISC-build-issue.patch
deleted file mode 100644 (file)
index 128058d..0000000
+++ /dev/null
@@ -1,47 +0,0 @@
-From 0bc482abeb814573251ecafb5a1e045c885b13a2 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Krause?= <joerg.krause@embedded.rocks>
-Date: Mon, 25 May 2015 16:22:57 +0200
-Subject: [PATCH 1/1] Fix musl __USE_MISC issue
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The musl C library does not define __USE_MISC and so libuv (built-in dependency)
-does not use the correct struct stat definition for musl.
-
-The feature test macro __USE_MISC is defined by glibc if _BSD_SOURCE or
-_SVID_SOURCE is defined.
-
-The libuv build system enables the feature test macro _GNU_SOURCE for linux
-builds.
-
-Since glibc 2.19, defining _GNU_SOURCE also has the effect of implicitly
-defining _DEFAULT_SOURCE - the replacement for _BSD_SOURCE and _SVID_SOURCE.
-
-In glibc versions before 2.20, defining _GNU_SOURCE also had the effect of
-implicitly defining _BSD_SOURCE and _SVID_SOURCE. This is also true for uClibc.
-
-Alltogether, we can safely replace __USE_MISC by _GNU_SOURCE to support building
-nodejs 0.10.x with the musl C library.
-
-Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
----
- deps/uv/src/fs-poll.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/deps/uv/src/fs-poll.c b/deps/uv/src/fs-poll.c
-index ad27f18..094447e 100644
---- a/deps/uv/src/fs-poll.c
-+++ b/deps/uv/src/fs-poll.c
-@@ -198,7 +198,7 @@ static int statbuf_eq(const uv_statbuf_t* a, const uv_statbuf_t* b) {
-   /* Jump through a few hoops to get sub-second granularity on Linux. */
- # if defined(__linux__)
--#  if defined(__USE_MISC) /* _BSD_SOURCE || _SVID_SOURCE */
-+#  if defined(_GNU_SOURCE) /* _BSD_SOURCE || _SVID_SOURCE */
-   if (a->st_ctim.tv_nsec != b->st_ctim.tv_nsec) return 0;
-   if (a->st_mtim.tv_nsec != b->st_mtim.tv_nsec) return 0;
- #  else
--- 
-2.4.1
-
diff --git a/package/nodejs/0.10.47/0004-Fix-support-for-uClibc-ng.patch b/package/nodejs/0.10.47/0004-Fix-support-for-uClibc-ng.patch
deleted file mode 100644 (file)
index 59b9d50..0000000
+++ /dev/null
@@ -1,33 +0,0 @@
-From 1cc08f6ceacbb0e5ba1f4638ca3a97ac002d7792 Mon Sep 17 00:00:00 2001
-From: "Bark, Martin" <martin.bark@te.com>
-Date: Mon, 14 Dec 2015 13:26:10 +0000
-Subject: [PATCH 2/2] Fix support for uClibc-ng
-
-uClibc-ng is currently at v1.0.9.  The patch corrects the uClibc
-version test so that HAVE_IFADDRS_H is defined for uClibc versions
-after v0.9.32.
-
-Submitted upstream to libuv and accepted, see
-https://github.com/libuv/libuv/pull/653 and
-https://github.com/libuv/libuv/commit/c861972
-
-Signed-off-by: Bark, Martin <martin.bark@te.com>
----
- deps/uv/src/unix/linux-core.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/deps/uv/src/unix/linux-core.c b/deps/uv/src/unix/linux-core.c
-index e6e6828..6cbbb71 100644
---- a/deps/uv/src/unix/linux-core.c
-+++ b/deps/uv/src/unix/linux-core.c
-@@ -39,7 +39,7 @@
- #define HAVE_IFADDRS_H 1
-
- #ifdef __UCLIBC__
--# if __UCLIBC_MAJOR__ < 0 || __UCLIBC_MINOR__ < 9 || __UCLIBC_SUBLEVEL__ < 32
-+# if __UCLIBC_MAJOR__ < 0 && __UCLIBC_MINOR__ < 9 && __UCLIBC_SUBLEVEL__ < 32
- #  undef HAVE_IFADDRS_H
- # endif
- #endif
---
-2.6.2
diff --git a/package/nodejs/0.10.48/0001-remove-python-bz2-dependency.patch b/package/nodejs/0.10.48/0001-remove-python-bz2-dependency.patch
new file mode 100644 (file)
index 0000000..75fe437
--- /dev/null
@@ -0,0 +1,27 @@
+Remove dependency on Python bz2 module
+
+The Python bz2 module is only needed in certain cases, so only import
+it when needed. In the normal nodejs build, this allows to remove the
+dependency on this module.
+
+Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+Index: b/deps/v8/tools/js2c.py
+===================================================================
+--- a/deps/v8/tools/js2c.py
++++ b/deps/v8/tools/js2c.py
+@@ -33,7 +33,6 @@
+ import os, re, sys, string
+ import jsmin
+-import bz2
+ def ToCAsciiArray(lines):
+@@ -344,6 +343,7 @@
+   else:
+     raw_sources_declaration = RAW_SOURCES_COMPRESSION_DECLARATION
+     if env['COMPRESSION'] == 'bz2':
++      import bz2
+       all_sources = bz2.compress("".join(all_sources))
+     total_length = len(all_sources)
+     sources_data = ToCArray(all_sources)
diff --git a/package/nodejs/0.10.48/0002-gyp-force-link-command-to-use-CXX.patch b/package/nodejs/0.10.48/0002-gyp-force-link-command-to-use-CXX.patch
new file mode 100644 (file)
index 0000000..a2f02ab
--- /dev/null
@@ -0,0 +1,26 @@
+From 00d809e9305241f8636a2d75e22c493293e6971a Mon Sep 17 00:00:00 2001
+From: Samuel Martin <s.martin49@gmail.com>
+Date: Sun, 20 Apr 2014 15:03:01 +0200
+Subject: [PATCH] gyp: force link command to use CXX
+
+Signed-off-by: Samuel Martin <s.martin49@gmail.com>
+---
+ tools/gyp/pylib/gyp/generator/make.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/tools/gyp/pylib/gyp/generator/make.py b/tools/gyp/pylib/gyp/generator/make.py
+index 0de510e..54e4c96 100644
+--- a/tools/gyp/pylib/gyp/generator/make.py
++++ b/tools/gyp/pylib/gyp/generator/make.py
+@@ -134,7 +134,7 @@ cmd_alink_thin = rm -f $@ && $(AR.$(TOOLSET)) crsT $@ $(filter %.o,$^)
+ # special "figure out circular dependencies" flags around the entire
+ # input list during linking.
+ quiet_cmd_link = LINK($(TOOLSET)) $@
+-cmd_link = $(LINK.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ -Wl,--start-group $(LD_INPUTS) -Wl,--end-group $(LIBS)
++cmd_link = $(CXX.$(TOOLSET)) $(GYP_LDFLAGS) $(LDFLAGS.$(TOOLSET)) -o $@ -Wl,--start-group $(LD_INPUTS) -Wl,--end-group $(LIBS)
+ # We support two kinds of shared objects (.so):
+ # 1) shared_library, which is just bundling together many dependent libraries
+-- 
+1.9.2
+
diff --git a/package/nodejs/0.10.48/0003-fix-musl-USE-MISC-build-issue.patch b/package/nodejs/0.10.48/0003-fix-musl-USE-MISC-build-issue.patch
new file mode 100644 (file)
index 0000000..128058d
--- /dev/null
@@ -0,0 +1,47 @@
+From 0bc482abeb814573251ecafb5a1e045c885b13a2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Krause?= <joerg.krause@embedded.rocks>
+Date: Mon, 25 May 2015 16:22:57 +0200
+Subject: [PATCH 1/1] Fix musl __USE_MISC issue
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The musl C library does not define __USE_MISC and so libuv (built-in dependency)
+does not use the correct struct stat definition for musl.
+
+The feature test macro __USE_MISC is defined by glibc if _BSD_SOURCE or
+_SVID_SOURCE is defined.
+
+The libuv build system enables the feature test macro _GNU_SOURCE for linux
+builds.
+
+Since glibc 2.19, defining _GNU_SOURCE also has the effect of implicitly
+defining _DEFAULT_SOURCE - the replacement for _BSD_SOURCE and _SVID_SOURCE.
+
+In glibc versions before 2.20, defining _GNU_SOURCE also had the effect of
+implicitly defining _BSD_SOURCE and _SVID_SOURCE. This is also true for uClibc.
+
+Alltogether, we can safely replace __USE_MISC by _GNU_SOURCE to support building
+nodejs 0.10.x with the musl C library.
+
+Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
+---
+ deps/uv/src/fs-poll.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/deps/uv/src/fs-poll.c b/deps/uv/src/fs-poll.c
+index ad27f18..094447e 100644
+--- a/deps/uv/src/fs-poll.c
++++ b/deps/uv/src/fs-poll.c
+@@ -198,7 +198,7 @@ static int statbuf_eq(const uv_statbuf_t* a, const uv_statbuf_t* b) {
+   /* Jump through a few hoops to get sub-second granularity on Linux. */
+ # if defined(__linux__)
+-#  if defined(__USE_MISC) /* _BSD_SOURCE || _SVID_SOURCE */
++#  if defined(_GNU_SOURCE) /* _BSD_SOURCE || _SVID_SOURCE */
+   if (a->st_ctim.tv_nsec != b->st_ctim.tv_nsec) return 0;
+   if (a->st_mtim.tv_nsec != b->st_mtim.tv_nsec) return 0;
+ #  else
+-- 
+2.4.1
+
diff --git a/package/nodejs/0.10.48/0004-Fix-support-for-uClibc-ng.patch b/package/nodejs/0.10.48/0004-Fix-support-for-uClibc-ng.patch
new file mode 100644 (file)
index 0000000..59b9d50
--- /dev/null
@@ -0,0 +1,33 @@
+From 1cc08f6ceacbb0e5ba1f4638ca3a97ac002d7792 Mon Sep 17 00:00:00 2001
+From: "Bark, Martin" <martin.bark@te.com>
+Date: Mon, 14 Dec 2015 13:26:10 +0000
+Subject: [PATCH 2/2] Fix support for uClibc-ng
+
+uClibc-ng is currently at v1.0.9.  The patch corrects the uClibc
+version test so that HAVE_IFADDRS_H is defined for uClibc versions
+after v0.9.32.
+
+Submitted upstream to libuv and accepted, see
+https://github.com/libuv/libuv/pull/653 and
+https://github.com/libuv/libuv/commit/c861972
+
+Signed-off-by: Bark, Martin <martin.bark@te.com>
+---
+ deps/uv/src/unix/linux-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/deps/uv/src/unix/linux-core.c b/deps/uv/src/unix/linux-core.c
+index e6e6828..6cbbb71 100644
+--- a/deps/uv/src/unix/linux-core.c
++++ b/deps/uv/src/unix/linux-core.c
+@@ -39,7 +39,7 @@
+ #define HAVE_IFADDRS_H 1
+
+ #ifdef __UCLIBC__
+-# if __UCLIBC_MAJOR__ < 0 || __UCLIBC_MINOR__ < 9 || __UCLIBC_SUBLEVEL__ < 32
++# if __UCLIBC_MAJOR__ < 0 && __UCLIBC_MINOR__ < 9 && __UCLIBC_SUBLEVEL__ < 32
+ #  undef HAVE_IFADDRS_H
+ # endif
+ #endif
+--
+2.6.2
index a47ba37a4a1ba32ace18fefd19dcf7ac7f874dbb..832152b9f000a3bffb2c17933556a281015b7305 100644 (file)
@@ -44,7 +44,7 @@ config BR2_PACKAGE_NODEJS_V8_ARCH_SUPPORTS
 config BR2_PACKAGE_NODEJS_VERSION_STRING
        string
        default "6.9.1"         if BR2_PACKAGE_NODEJS_V8_ARCH_SUPPORTS
-       default "0.10.47"
+       default "0.10.48"
 
 config BR2_PACKAGE_NODEJS_NPM
        bool "NPM for the target"
index 5df79afee4e9f0cae18917c3f7b33a76537ea703..e55bb1696d1b0d7a9cb9268761166bafb99e1046 100644 (file)
@@ -1,5 +1,5 @@
-# From upstream URL: http://nodejs.org/dist/v0.10.47/SHASUMS256.txt
-sha256  335bdf4db702885a8acaf2c9f241c70cabd62497361da81aca65c8e8a8e7ff09  node-v0.10.47.tar.xz
+# From upstream URL: http://nodejs.org/dist/v0.10.48/SHASUMS256.txt
+sha256  365a93d9acc076a0d93f087d269f376abeebccad599a9dab72f2f6ed96c8ae6e  node-v0.10.48.tar.xz
 
 # From upstream URL: http://nodejs.org/dist/v6.9.1/SHASUMS256.txt
 sha256  0bdd8d1305777cc8cd206129ea494d6c6ce56001868dd80147aff531d6df0729  node-v6.9.1.tar.xz