perl-file-slurp: bump to version 9999.25

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

perl-date-manip: bump to version 6.75

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 4.{4, 9, 14, 19, 20}.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/clamav: add optional dependency to pcre2

Upstream recommends pcre2 over pcre:
https://github.com/Cisco-Talos/clamav-devel/commit/1f71c2b21ccaef412280471444f4d01ec9b8099d

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/clamav: bump version to 0.101.1

Removed patch applied upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/samba4: security bump to version 4.9.4

Fixes the following security issues:

- CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression
- CVE-2018-16853: Fix S4U2Self crash with MIT KDC build
- CVE-2018-16853: Do not segfault if client is not set

For more info, see the release notes:
https://www.samba.org/samba/history/samba-4.9.4.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: mention security impact, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xdriver_xf86-video-neomagic: bump version to 1.3.0

Added all hashes provided by upstream and license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xdriver_xf86-video-mga: bump version to 2.0.0

Added all hashes provided by upstream and license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xdriver_xf86-video-i128: bump version to 1.4.0

Removed patch applied upstream, added all hashes provided by upstream
and license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xapp_xcursorgen: bump version to 1.0.7

Added all hashes provided by upstream and license hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/vlc: bump version to 3.0.6

Rebased patch 0006, removed patch 0008 which is included in upstream
release version, renumbered remaining patches.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libva: bump version to 2.4.0

Removed patch applied upstream:
https://github.com/intel/libva/commit/62bad1239d8ea1bb269ca69d3469aa267f57cdec

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-psycopg2: bump to version 2.7.7

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-psutil: bump to version 5.5.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-pip: bump to version 19.0.1

License change - a year bump.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-msgpack: bump to version 0.6.1

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-engineio: bump to version 3.3.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libwebsock: Fix openssl reporting in header

The websock_config.h file currently ends up being installed into the
sysroot with a #include "config.h" line but the config.h file does not
get copied into the sysroot. Refactoring the original patch to have the
configure script properly report whether or not SSL support is enabled
without using the config.h file.

Patch has been submitted upstream but may never be merged since upstream
appears to be dead.
https://github.com/payden/libwebsock/pull/38

Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/x11r7/xdriver_xf86-video-intel: bump version

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/{mesa3d, mesa3d-headers}: bump version to 18.3.2

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libdrm: bump version to 2.4.97

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libqmi: bump to version 1.22.0

Signed-off-by: Nicolas Serafini <nicolas.serafini@sensefly.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libmbim: bum to version 1.18.0

Signed-off-by: Nicolas Serafini <nicolas.serafini@sensefly.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mobile-broadband-provider-info: bump to version 20190116

Signed-off-by: Nicolas Serafini <nicolas.serafini@sensefly.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/ofono: bump to version 1.28

Add patch to fix musl TEMP_FAILURE_RETRY error

Signed-off-by: Nicolas Serafini <nicolas.serafini@sensefly.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/tor: bump version to 0.3.5.7

Patch rebased and re-formatted with git.

Release notes:
https://blog.torproject.org/new-releases-tor-0357-03410-and-03311

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rpi-firmware: bump version to 81cca1a93

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

go: security bump to 1.11.5

Go 1.11.5 addresses a reported security issue, CVE-2019-6486.

Signed-off-by: Christian Stewart <christian@paral.in>
Acked-by: Anisse Astier <anisse@astier.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tslib: update to 1.19

For the curious, there's the short changelog summary:
https://github.com/kergoth/tslib/releases

Signed-off-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libkcapi: fix build with gcc 8.2.x

Fixes:
 - http://autobuild.buildroot.org/results/8355bc42238e885f7f11ed3d9d37fc55ebdead2b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iperf: fixed hash to match v2.0.13 archive

The iperf project changed the archive after the release without changing
the filename of the archive.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

musl: fix hash of license file

COPYRIGHT file has been updated between version 1.1.20 and 1.1.21:
https://git.musl-libc.org/cgit/musl/commit/COPYRIGHT?id=c50985d5c8e316c5c464f352e79eeebfed1121a9

Fixes:
 - http://autobuild.buildroot.org/results/8cfa70b906221442c9e6dfd46b64011c987d24bf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/inadyn: bump version to 2.5

Signed-off-by: Ryan Coe <bluemrp9@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libite: bump version to 2.0.2

Signed-off-by: Ryan Coe <bluemrp9@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/subversion: security bump to version 1.9.10

Additional fixes for CVE-2017-9800: Malicious server can execute arbitrary
command on client and a number of crash fixes.

https://svn.apache.org/repos/asf/subversion/tags/1.9.10/CHANGES

Drop upstream SHA1 hash as that is no longer listed.  Also add a hash for
the license file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 4.{9, 14, 19, 20}.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dmalloc: fix build with strndup

Fixes:
 - http://autobuild.buildroot.org/results/5cfa01a41951ee3be2e8c1cb10edac3722d72c77

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dmalloc: fix build with strdup

Fixes:
 - http://autobuild.buildroot.org/results/3f2518f7a9e87034cd501ac3d121ea3a33827e7d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sqlcipher: add license

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libssh: fix some -Werror=strict-overflow build failures

Add fixes for some of the build failures caused by strict-overflow
warnings. Patches #1, #2, and #4 are upstream. Patch #3 is pending
upstream.

Fixes:
http://autobuild.buildroot.net/results/923/9239f230629ca4e381af5e8f43989997d9bfde99/
http://autobuild.buildroot.net/results/618/6187b92bcdfd9281683c37906ae74f2e0c5e6d0e/
http://autobuild.buildroot.net/results/9eb/9eb5ed92a923f0c038e3d913289eddc1cda1b62f/

Cc: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/upmpdcli: add upstream patch to fix musl build issue

upmpdcli 1.4.0 uses both the `uint64_t` and `u_int64_t` type. `uintN_t` is
standard C99 type available in `<stdint.h>`, whereas `u_intN_t` is defined in
`<sys/types.h>`.

Because of the missing include of `<sys/types.h>` building upmpdcli breaks now
when building with the musl C library, which is very strict:

```
src/mediaserver/cdplugins/netfetch.h:71:5: error: ‘u_int64_t’ does not name a type
     u_int64_t datacount() {
```

Add a patch from upstream which fixes the issue by replacing `u_int64_t`
with `uint64_t`.

Fixes:
http://autobuild.buildroot.net/results/f3082d2fdda8d73dbd9d3b65a08d844934066ef7

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/apache: security bump to version 2.4.38

Fixes the following security vulnerabilities:

  *) SECURITY: CVE-2018-17199 (cve.mitre.org)
     mod_session: mod_session_cookie does not respect expiry time allowing
     sessions to be reused.  [Hank Ibell]

  *) SECURITY: CVE-2018-17189 (cve.mitre.org)
     mod_http2: fixes a DoS attack vector. By sending slow request bodies
     to resources not consuming them, httpd cleanup code occupies a server
     thread unnecessarily. This was changed to an immediate stream reset
     which discards all stream state and incoming data.  [Stefan Eissing]

  *) SECURITY: CVE-2019-0190 (cve.mitre.org)
     mod_ssl: Fix infinite loop triggered by a client-initiated
     renegotiation in TLSv1.2 (or earlier) with OpenSSL 1.1.1 and
     later.  PR 63052.  [Joe Orton]

For more details, see the CHANGES file:
https://www.apache.org/dist/httpd/CHANGES_2.4.38

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/xerces: use new website (was redirecting)

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rp-pppoe: update website url

The website for rp-pppoe moved from Roaring Penguin's main site to
a personal project page.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openresolv: update webpage URL

Update URL to point at the project page vs just the GIT repository
containing the source code.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/lsof: bump to version 4.91

Add upstream provided md5 hash.

Add license file hash.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iperf: bump to 2.0.13

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/ipset: bump to version 7.1

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/qemu_riscv64_virt_defconfig: bump Linux version

Since riscv64 works with linux default defconfig, this patch drop custom config.

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Tested-by: Mark Corbin <mark.corbin@embecosm.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wavemon: add upstream patch to fix musl/uclibc build issue

In version 0.9.0 wavemon uses the GLIBC-specific extension `on_exit()`
which is not available in musl and uClibc.

According to the Linux kernel man page [1]: "Portable application should
avoid this function, and use the standard atexit(3) instead."

Add patch from upstream which is fixing this issue by dropping
`on_exit()` and using the standard `atexit()` instead. Note, that the commit
message of the upstream patch was changed to add some useful information.

[1] http://man7.org/linux/man-pages/man3/on_exit.3.html

Backported from: f6e20c9c6e9b50963caaf5483248d329473a6815

Fixes:
http://autobuild.buildroot.net/results/ae54441c65fe9a1bdcf743aa7f6a208e5545ca29
http://autobuild.buildroot.net/results/40fd66e6a351a1acd537ade715ab3e993eddb1c1

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

musl: bump to version 1.1.21

>From the upstream release announcement:

"""
This release makes improvements with respect to default thread stack size,
including increasing the default from 80k to 128k, increasing the default
guard size from 4k to 8k, and allowing the default to be increased via ELF
headers so that programs that need larger stacks can be build without
source-level changes, using just LDFLAGS. Insufficient stack size for AIO
threads on kernels that don't honor the constant MINSIGSTKSZ is also fixed.

The glob core has been rewritten to fix inability to see past
searchable-but-unreadable path components, and to avoid excessive stack usage
and unnecessary syscalls. The tsearch AVL tree implementation has also been
rewritten for better size and performance. The math library adds more native
single-instruction implementations for arm, s390x, powerpc, and x86_64.

Various bugs are fixed, including several possible deadlocks, one of which was
a new regression in 1.1.20.
"""

Drop upstream patch 0002 which is included in the release.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-uvloop: bump to version 0.11.3

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-pyopenssl: bump to version 19.0.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/imx6-sabresd: Bump kernel version

Bump the kernel version to 4.19.16.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libcpprestsdk: bump to version 2.10.9

- Remove second patch (already in version)
- Fix build with gcc 4.7:
  https://github.com/Microsoft/cpprestsdk/commit/e6498b2f99cf20163d8224716d8127f9089b01ef

Fixes:
 - http://autobuild.buildroot.org/results/a080dbe2977cd35e4f8351d864bd71aaa8f9b743

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

shadowsocks-libev: fix static build with netfilter_conntrack

Fixes:
 - http://autobuild.buildroot.org/results/22a28e8fd8182e1c908541dbc5b0ee087c3803e6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/sunxi-mali-mainline-driver: bump version

For 4.20 support.

git shortlog --invert-grep --grep travis --no-merges 143ff2b17de63ce931c4f758771969e75c09a4c7..
Roman Stratiienko (1):
      mali: support building against 4.20

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openresolv: update to fix install location

Update to install in /sbin as expected by other applications
such as strongswan instead of /usr/sbin

Signed-off-by: Jared Bents <jared.bents@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

exempi: fix libiconv dependency

Fixes:
 - http://autobuild.buildroot.org/results/a77a891683ae9a135dc31be1b419061922d0e1ba

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tekui: disable parallel build

It seems tekui has parallel build issues since November 2017:
 - Fatal error: can't create build/posix/directfb_lua.lo: No such file or directory
 - /home/peko/autobuild/instance-3/output/host/bin/microblazeel-buildroot-linux-uclibc-ar: ../../lib/posix/libtekdebug.a: No such file or directory
 - Fatal error: can't create build/posix/visual_mod.lo: No such file or directory

So disable parallel build

Fixes:
 - http://autobuild.buildroot.org/results/0732568fcbaa6829154fa91c352b52f074384df0
 - http://autobuild.buildroot.org/results/580593e79bc4ecdea1dc71d16607e5c88f87403c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libftdi1: fix python build with cmake < 3.7

Fixes:
 - http://autobuild.buildroot.org/results/1091872e2b77d789e361d1ddefd235c738933c55

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rtc-tools: rtc-sync needs threads support

Fixes:
http://autobuild.buildroot.net/results/573/57350271eff9284a8b07ceef02a9960f3568a0a3/
http://autobuild.buildroot.net/results/b6c/b6cf05deab77c7a84c721c95d9d618b1ddc2957e/
http://autobuild.buildroot.net/results/187/1877cfbbe37ef15c16cec5d6ad6e3d4d60bc3cbc/

Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ocrad: bump to version 0.27

Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnpp: remove AUTORECONF

Commit 9b551dacf74445d58aaefef349e2817e009c9d5d removed patch on
configure.ac so remove uneeded LIBUPNPP_AUTORECONF

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnpp: fix libupnp dependency

Commit 9b551dacf74445d58aaefef349e2817e009c9d5d added support for
libupnp18 but without updating LIBUPNPP_DEPENDENCIES

Fixes:
 - http://autobuild.buildroot.org/results/aa734318b9ad318d25e772585c8794429cc0f489

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

odhcp6c: fix build with gcc 8

Retrieve and backport upstream patch to fix build with gcc 8

Fixes:
 - http://autobuild.buildroot.org/results/1c6f0d1f2fcd3474af81b3851d875f834a3a0a4f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/upmpdcli: bump to version 1.4.0

upmpdcli switched license from GPL-2.0+ to LGPL-2.1+, therefore update
the hash file for the license file "COPYING".

Note, that upmpdcli depends on libupnpp 0.17.0.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libupnpp: bump to version 0.17.0

libupnpp 0.17.0 adds compatibility for libupnp 1.8. Therefore, we prefer
selecting libupnp 1.8 and falling back to libupnp 1.6.

Drop patch 0001, which has been merged upstream.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-txtorcon: bump to version 19.0.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-logbook: bump to version 1.4.3

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-bcrypt: bump to version 3.1.6

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libuv: bump to version 1.25.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

unixodbc: needs dynamic library

Fixes:
 - http://autobuild.buildroot.org/results/1036ee061ce7f7747d5514c61866da60bcfae769

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: propagate to PHP_EXT_PDO_UNIXODBC as well]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

php: security bump to 7.3.1

Fixes the following security issue:

- CVE-2018-19935: Allows remote attackers to cause a denial of service
  (NULL pointer dereference and application crash) via an empty string in the
  message argument to the imap_mail function.
https://www.cvedetails.com/cve/CVE-2018-19935/

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

php: switch to pcre2

php moved from pcre to pcre2 since bump to version 7.3 and
http://github.com/php/php-src/commit/a5bc5aed71f7a15f14f33bb31b8e17bf5f327e2d

This fixes a build failure: without this change, if BR2_PACKAGE_PCRE is
set, external pcre support in php is (wrongly) enabled with
--with-pcre-regex but because pcre2 was not found, php fallbacks on
built-in pcre2 without the "SLJIT_SINGLE_THREADED hack"

Fixes:
 - http://autobuild.buildroot.org/results/40ef339019203d2cc49d388e222cf17c3ca37944

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Revert "package/php: fix building pcre extension"

This reverts commit 745f884e41b5f350296e8448f5fc31d20f67a077.

This was the wrong fix: issue is that php moves from pcre to pcre2 since
version 7.3.0 and
http://github.com/php/php-src/commit/a5bc5aed71f7a15f14f33bb31b8e17bf5f327e2d

This patch will always disable external pcre2 support and raise a build
failure when toolchaine does not have pthread

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-cython: bump to version 0.29.3

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-crossbar: bump to version 19.1.2

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gnu-efi: fix build with gcc 4.8

Fixes:
 - http://autobuild.buildroot.org/results/a0ca37b5ed27af445344e3ac49dc87bb17512c50

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libgeotiff: bump to version 1.4.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tesseract-ocr: disable documentation

Fixes:
 - http://autobuild.buildroot.org/results/a608e9bfb2b0161c45ae490e2866d96763593723

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Gilles Talis <gilles.talis@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/syslog-ng: fix startup with systemd

By default syslog-ng installs a .service that requires a config file at
/etc/default, so provide one with the default values.

It's also necessary to enable the service by means of a symlink created
at /etc/systemd/system/multi-user.target.wants.

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Reviewed-by: Chris Packham <judge.packham@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/pango: add upstream security fix for CVE-2018-15120

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other
products, allows remote attackers to cause a denial of service (application
crash) or possibly have unspecified other impact via crafted text with
invalid Unicode sequences.

https://nvd.nist.gov/vuln/detail/CVE-2018-15120

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libsndfile: add upstream post-1.0.28 security fixes

Fixes the following security vulnerabilities:

CVE-2017-14634: In libsndfile 1.0.28, a divide-by-zero error exists in the
function double64_init() in double64.c, which may lead to DoS when playing a
crafted audio file

CVE-2017-17456: The function d2alaw_array() in alaw.c of libsndfile
1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address
0x000000000000), a different vulnerability than CVE-2017-14245

CVE-2017-17457: The function d2ulaw_array() in ulaw.c of libsndfile
1.0.29pre1 may lead to a remote DoS attack (SEGV on unknown address
0x000000000000), a different vulnerability than CVE-2017-14246

CVE-2018-13139: A stack-based buffer overflow in psf_memset in common.c in
libsndfile 1.0.28 allows remote attackers to cause a denial of service
(application crash) or possibly have unspecified other impact via a crafted
audio file.  The vulnerability can be triggered by the executable
sndfile-deinterleave

CVE-2018-19661: An issue was discovered in libsndfile 1.0.28.  There is a
buffer over-read in the function i2ulaw_array in ulaw.c that will lead to a
denial of service

CVE-2018-19662: An issue was discovered in libsndfile 1.0.28.  There is a
buffer over-read in the function i2alaw_array in alaw.c that will lead to a
denial of service

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/asterisk: bump version to 16.1.1

Fixes a regression introduced in 16.1.0:
https://issues.asterisk.org/jira/browse/ASTERISK-28222

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wireshark: security bump to version 2.6.6

Fixes the following security vulnerabilities:

- wnpa-sec-2019-01 The 6LoWPAN dissector could crash. Bug 15217. CVE-2019-5716
  https://www.wireshark.org/security/wnpa-sec-2019-01

- wnpa-sec-2019-02 The P_MUL dissector could crash. Bug 15337. CVE-2019-5717
  https://www.wireshark.org/security/wnpa-sec-2019-02

- wnpa-sec-2019-03 The RTSE dissector and other dissectors could crash.  Bug
  15373.  CVE-2019-5718
  https://www.wireshark.org/security/wnpa-sec-2019-03

- wnpa-sec-2019-04 The ISAKMP dissector could crash. Bug 15374. CVE-2019-5719
  https://www.wireshark.org/security/wnpa-sec-2019-04

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 4.{4, 9, 14, 19, 20}.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libmad: needs autoreconf

libmad uses a very old configure script.

When the toolchain lacks C++ and the build machine lacks /lib/cpp, this
old configure script fails because it can't find a C++ preprocessor that
is valid:

    checking for arm-buildroot-linux-uclibcgnueabi-g++... no
    checking whether we are using the GNU C++ compiler... no
    checking whether no accepts -g... no
    checking dependency style of no... none
    checking how to run the C++ preprocessor... /lib/cpp
    configure: error: C++ preprocessor "/lib/cpp" fails sanity check
    See `config.log' for more details.

This is yet another case that was tentatively fixed by bd39d11d2e
(core/infra: fix build on toolchain without C++), further amended by
4cd1ab15886 (core: alternate solution to disable C++).

However, this only works on libtool scripts that are recent enough, and
thus we need to autoreconf to get it.

We also need to patch configure.ac so that it does not fail on the
missing, GNU-specific files: NEWS, AUTHORS, and Changelog.

Fixes:
 - http://autobuild.buildroot.org/results/6a6aa29295bd70679c3a22a149e79010fa20c1bf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openvmtools: bump version to 10.3.5

Fixes build against glibc 2.28: closes #11546
http://autobuild.buildroot.net/results/f2c/f2c73480b5a1060bb17ac260ef82c3e641fad085/
http://autobuild.buildroot.net/results/e21/e219b8bacb52bb661eb6663b82f549ed941f26fe/

Use released tarball rather than github helper.  The tarball does not
contain the open-vm-tools sub directory, so adjust the paths in the patches
to match and drop OPENVMTOOLS_SUBDIR.

Drop 0001-has_bsd_printf.patch: msgList.c has been removed upstream since:
https://github.com/vmware/open-vm-tools/commit/dc81979e78e1b8f42639aeb7aaec69f7ea49eb79

Drop 0004-uclibc_secure_getenv.sh: uClibc-ng provides secure_getenv() since
1.0.22.

Renumber remaining patches.

Add hash for license file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cargo: pass appropriate library path to the linker

When linking the host cargo binary, the linker should be told to find
libraries in $(HOST_DIR)/lib, otherwise it will not work libraries
such as libhttp_parser. This was found with per-package directory
support, where the build failed with:

  = note: /usr/bin/ld: cannot find -lhttp_parser
          collect2: error: ld returned 1 exit status

In order to fix this, instead of passing -L$(HOST_DIR)/lib during the
build of Cargo, we make sure all flags in $(HOST_LDFLAGS) are passed.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/pkg-meson: support per-package directories

Currently, package/meson/meson.mk generates a single global
cross-compilation.conf file, with the path to the compiler, cflags,
ldflags, and various other details. This file is then used when
building all meson-based packages.

This causes two problems:

 - It is not compatible with per-package directories, because with
   per-package folders, we need to use a different compiler, and
   possibly CFLAGS/LDFLAGS for each package.

 - It is not possible to define per package CFLAGS. Indeed, when
   cross-compiling, meson doesn't support passing CFLAGS through the
   environment, only the CFLAGS from cross-compilation.conf are taken
   into account.

For this reason, this commit:

 - Introduces a per-package cross-compilation.conf, which is generated
   by the pkg-meson infrastructure in the "configure" step right
   before calling meson. The file is generated in $(@D)/build/, and
   because it is generated within a given package "configure" step,
   the compiler path is the one of this package.

 - Keeps the global cross-compilation.conf in $(HOST_DIR)/etc/meson/,
   for the SDK use-case of Buildroot. Since we want the final and
   global values of the compiler path, CFLAGS and LDFLAGS, generating
   this global cross-compilation.conf is moved to a
   TARGET_FINALIZE_HOOKS. If we were keeping this as a
   HOST_MESON_POST_INSTALL_HOOKS, it would contain values specific to
   the host-meson package.

For now, we don't yet support per-package CFLAGS/LDFLAGS, but having
such per-package cross-compilation.conf is a necessary preparation to
achieve this goal.

This commit has been tested by building all Buildroot packages that
use meson: json-glib, systemd, enlightenment, at-spi2-core, ncmpc,
libmpdclient and ncmpc.

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Thomas:
 - add extended commit log
 - in pkg-meson.mk, re-use variables defined in meson.mk to do the
   replacement of CFLAGS/LDFLAGS/CXXFLAGS
 - move the generation of the global cross-compilation.conf to a
   TARGET_FINALIZE_HOOKS
 - testing with per-package folders]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Makefile: move definition of TARGET_DIR inside .config condition

In a follow-up commit introducing per-package directory support, we
will need to define TARGET_DIR in a different way depending on the
value of a Config.in option. To make this possible, the definition of
TARGET_DIR should be moved inside the BR2_HAVE_DOT_CONFIG condition.

We have verified that $(TARGET_DIR) is only used within the
BR2_HAVE_DOT_CONFIG condition. Outside of this condition, such as in
the "clean" target, $(BASE_TARGET_DIR) is used.

Suggested-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/scripts/check-host-rpath: document existing functions

As suggested by Arnout Vandecappelle, let's document the
elf_needs_rpath() and check_elf_has_rpath() functions, before we make
them a bit more complicated with per-package directory support.

Suggested-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

zbar: bump to version b3b4e32b55f570372fc3af473e51f0a13ee57869

- Add hash for license file
- Fix build with kernel headers >= 4.4 with:
  https://git.linuxtv.org/zbar.git/commit/?id=b3b4e32b55f570372fc3af473e51f0a13ee57869

Fixes:
 - http://autobuild.buildroot.org/results/630204315eac6e2800bc13c1486a5a525bf9ab37

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

apr: fix runtime tests for cross compile

- epoll supported since linux-2.5.44/glibc-2.3.2 (see [1])
 - dup3 supported since linux-2.6.27/glibc-2.9 (see [2])
 - SOCK_CLOEXEC supported on linux (see [3])
 - accept4 suppported since linux-2.6.28/glibc-2.10 (see [4])

Fixes [5] apache runtime failure (#11576)

  [mpm_event:crit] [pid 173:tid 1996214272] (70023)This function has not been
      implemented on this platform: AH00495: Couldn't create a Thread Safe Pollset.
      Is it supported on your platform?Also check system or user limits!
  [:emerg] [pid 173:tid 1996214272] AH00017: Pre-configuration failed, exiting

[1] http://man7.org/linux/man-pages/man7/epoll.7.html
[2] https://linux.die.net/man/2/dup3
[4] https://linux.die.net/man/2/accept4
[5] https://bugs.busybox.net/show_bug.cgi?id=11576

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nettle: fix build with gcc 4.7

Fixes:
 - http://autobuild.buildroot.org/results/69226d42e9a483aaff44fb3f468b4724415e71f6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wavemon: bump to version 0.9.0

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gst1-plugins-bad: fix build with fdk-aac 2.0

Fixes:
http://autobuild.buildroot.net/results/343/343249ab34ab77be3b8077f544b9d1e2d4852796/
http://autobuild.buildroot.net/results/edc/edca961f2c4d1946385ac86a756308caaf22d79d/

Fdk-aac 2.0 dropped some legacy APIs, breaking the build of the fdk-aac
plugin.  Add two upstream upstream patches to fix building against fdk-aac
2.0.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/llvm: set the path to llvm-config

While building llvm for the target (x86_64), the build failed due to
path poisoning (-I/usr/include/libxml2) while building NATIVE tools
(i.e for the host). The llvm package tries to build a tool for the host
with the cross-compiler which doesn't work when the paranoid toolchain
wrapper (BR2_COMPILER_PARANOID_UNSAFE_PATH) is enabled.

We know that llvm (target) needs llvm-tablegen and llvm-config built by
host-llvm, but only LLVM_TABLEGEN is provided by llvm.mk. Adding
LLVM_CONFIG_PATH=$(HOST_DIR)/bin/llvm-config for llvm (target)
fixes the path poisoining issue since llvm doesn't build the NATIVE
variant.

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Cc: Valentin Korenblit <valentinkorenblit@gmail.com>
Cc: Matthew Weber <matthew.weber@rockwellcollins.com>
Tested-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libva-utils: drop _SOURCE variable which has the default value

Since commit b0907949261ef5e8179c027c086903f30417dd66
("package/libva-utils: bump to version 2.3.0"), the LIBVA_UTILS_SOURCE
variable has the default value of the <pkg>_SOURCE variable, so
check-package complains:

package/libva-utils/libva-utils.mk:8: remove default value of _SOURCE variable (http://nightly.buildroot.org/#generic-package-reference)

Let's fix this by dropping the now unneeded variable assignment.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>