vlc: security bump to version 2.1.6

* Fix heap overflow in decomp stream filter
* Fix buffer overflow in updater
* Fix potential buffer overflow in schroedinger encoder
* Fix null-pointer dereference in DMO decoder
* Fix buffer overflow in parsing of string boxes in mp4 demuxer
* Fix SRTP integer overflow
* Fix potential crash in zip access
* Fix read overflow in Ogg demuxer

And also add hash file.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnpp: fix libupnp detection with static linking

Fixes http://autobuild.buildroot.net/results/566/566e1510f94670d4ff642c7bfa9918c1d9ec583f/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: add support for 4.x versions

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gpm: avoid use of host emacs

configure looks for emacs installation to byte compile .el files. This may
break the build if the host installed emacs is missing needed dependencies.
Since we don't (yet?) package emacs for target, just disable detection of
emacs.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gnupg2: security bump to version 2.0.27

Fixes:

CVE-2015-1606: Use after free, resulting from failure to skip invalid packets

CVE-2015-1607: memcpy with overlapping ranges, resulting from incorrect
bitwise left shifts

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libgc: Remove duplicated package

Remove libgc that is a copy of bdwgc but it's not used
by any package and gives an error when building make-4.1.
bdwgc is a mandatory dependency for guile.

Fixes:
http://autobuild.buildroot.net/results/b80a34a602b1241bc03cd43df1a269389d50e75c/

Reported-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Pedro Aguilar <paguilar@paguilar.org>
[baruch: added Reported-by, Config.in.legacy entry, autobuilder reference]
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ding-libs: fix build with !locale

It needs libiconv if the toolchain doesn't have iconv support.

Fixes:
http://autobuild.buildroot.net/results/60f/60f85a2144b167f33ed674ff5979c1ef20bc0555/
http://autobuild.buildroot.net/results/76d/76d249f5a85da72cc53a3e66202c372dc33c9c38/
http://autobuild.buildroot.net/results/9f7/9f78043f549e09d020d69f45cd26c3e43a91d9dc/
http://autobuild.buildroot.net/results/8a5/8a586b781b6923444857ef58de659e5f0e8652ee/

And many more.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libevent: fix openssl detection when statically linking

Fixes (indirectly):
http://autobuild.buildroot.net/results/dbf/dbf2d348de3831a86728f9d72cb56b9f2ddbf554/
http://autobuild.buildroot.net/results/6a8/6a89183e558e4ff27841c3e544687ad4a04fb036/
http://autobuild.buildroot.net/results/c80/c80eedb4d7335f1aef736a1312900c2b371eabc9/
http://autobuild.buildroot.net/results/91b/91b4ab54ed9d422bfaef765d09cc92192012ce7e/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

directfb-examples: drop usr/bin path from sub options text

Nowhere else do we list the explicit path where binaries are installed to,
so drop it from here.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

directfb-examples: drop explicit stripping when installing into target

Stripping is globally handled by target-finalize (if enabled), so drop it
from here.

Reported-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

directfb-examples: explicitly add -lstdc++ for static build

Fixes [1] and [2]:
undefined reference to `___cxa_pure_virtual'
undefined reference to `___gxx_personality_v0'

[1] http://autobuild.buildroot.net/results/bd0/bd0f4b3e41bf6330f83e3d9b58d985cc63506a3b/
[2] http://autobuild.buildroot.net/results/584/584ace383204d97fcaad37742e2e035ca78a3d10/

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

make: depend on guile explicitly when available

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libsrtp: fix static build with openssl

libsrtp forget to link with zlib for static build when openssl
support is requested.

The issue was reported upstream by Vicente Olivert Riera:
https://github.com/cisco/libsrtp/issues/97

Backport upstream patch for the upcoming libsrtp 1.5.2.
Since the libsrtp package already use AUTORECONF, apply only
the changes for configure.in.

Fixes:
http://autobuild.buildroot.net/results/a71/a71d85a5bb9af2ee82a8e61054025bceb03dbdeb/

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libgtk2: ensure faq/tutorial isn't regenerated

As we don't need them, the tarball already contains generated documentation
and it fails to build with certain versions of db2html:

http://article.gmane.org/gmane.comp.lib.uclibc.buildroot/65165

Reported-by: Justin Swartz <justin.swartz@nym.hush.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libshout: add hash

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

vorbis-tools: add hash

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libtheora: add hash

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libao: add hash

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

opus: add hash

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

glibc: add security patches for CVE-2015-1472

Fixes CVE-2015-1472 - heap buffer overflow in wscanf.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gstreamer[0/1]: rename BR2_PACKAGE_GST_PLUGINS_GOOD_PLUGIN_QTDEMUX config option.

 1] BR2_PACKAGE_GST_PLUGINS_GOOD_PLUGIN_QTDEMUX is not defined anywhere
 2] qtdemux is not a plugin by itself but belongs to isomp4

Signed-off-by: Julien Boibessot <julien.boibessot@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2015.02-rc3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

e2fsprogs: add security bug fix

Add upstream patch fixing CVE-2015-1572: incomplete fix for CVE-2015-0247.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5base: fix postgresql plugin compile

Add qt5base '-psql_config' configure option and use it to set
pg_config path in configure step instead of legacy PSQL_LIBS
enviornment variable.

Fixes [1]:

PostgreSQL auto-detection... ()
make[1]: Entering directory `/home/peko/autobuild/instance-0/output/build/qt5base-5.4.0/config.tests/unix/psql'
/home/peko/autobuild/instance-0/output/host/usr/bin/sh-linux-gnu-g++ -c -pipe -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os --sysroot=/home/peko/autobuild/instance-0/output/host/usr/sh4a-buildroot-linux-gnu/sysroot -O2 -O3 -Wall -W -fPIE  -I../../../mkspecs/devices/linux-buildroot-g++ -I. -I/usr/include/postgresql -o psql.o psql.cpp
sh-linux-gnu-g++: ERROR: unsafe header/library path used in cross-compilation: '/usr/include/postgresql'
make[1]: *** [psql.o] Error 1
make[1]: Leaving directory `/home/peko/autobuild/instance-0/output/build/qt5base-5.4.0/config.tests/unix/psql'
PostgreSQL disabled.
PostgreSQL support cannot be enabled due to functionality tests!
 Turn on verbose messaging (-v) to ./configure to see the final report.
 If you believe this message is in error you may use the continue
 switch (-continue) to ./configure to continue.
make: *** [/home/peko/autobuild/instance-0/output/build/qt5base-5.4.0/.stamp_configured] Error 101
make: Leaving directory `/home/peko/autobuild/instance-0/buildroot'

[1] http://autobuild.buildroot.net/results/354/354bae2337703ad8bfb9d33c79538df3017b7fe9/

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

samba4: security bump to version 4.1.17

Fixes:
CVE-2015-0240 - Unexpected code execution in smbd.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

samba: security bump to version 3.6.25

Fixes:
CVE-2014-0178 - Malformed FSCTL_SRV_ENUMERATE_SNAPSHOTS response.
CVE-2015-0240 - Unexpected code execution in smbd.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

busybox: add 1.23.1 patch to fix modinfo

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl/libevas: explicitly disable X11 support

Fixes:
http://autobuild.buildroot.net/results/bfc/bfc52a6f12789055ad376b40a00bc94847760469/

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

evtest: disable documentation

evtest uses asciidoc to generate documentation, but /usr/bin/asciidoc
will try to use buildroot's host-python which doesn't have the required
unicodedata. To avoid that, define ASCIIDOC as an empty string so the
Makefile can't find the executable and skips the documentation
generation.  This is the same solution used in the evemu package.
Otherwise it will fail with this message:

make[1]: Entering directory `/br/output/build/evtest-1.32'
/usr/bin/make  all-am
make[2]: Entering directory `/br/output/build/evtest-1.32'
  File "/usr/bin/asciidoc", line 95
    except KeyError, k: return None

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

i2c-tools: link to i2c-tools specific wiki page

Although there is a link to that page from the main lm-sensors page, it is
quite hard to find.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl/libevas: explicitly disable xlib support

Fixes:
http://autobuild.buildroot.net/results/d69/d69a324434f370b490a53e6191d38a204ac28371

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl/libevas: explicitly disable GL/GLES2 support

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl/libevas: add missing dependency on fontconfig

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

util-linux: ul also requires ncurses

Found via auditing.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

util-linux: setterm requires ncurses

Fixes:
http://autobuild.buildroot.net/results/7c0/7c02c0de18059bd1a633267b43a8a5e9ee2fdfdc/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

fltk: fix build issue caused by rpath

The fltk build system has some logic that causes it to pass
-Wl,-rpath,/usr/lib when --libdir is not /usr/lib. However, in our
case, libdir is ${exec_prefix}/lib, and is not expanded to /usr/lib
before the rpath related test is done. Rather than fixing the fltk
build system, this commit works around the problem by explicitly
passing --libdir=/usr/lib.

Fixes:

  http://autobuild.buildroot.org/results/8d1/8d1b202a182e3fb5dee21f20afc9f749c2defa1a/

and many other similar build failures that have been occuring since 1+
year.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/libxcb: really disable docs

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/ffmpeg: fix nios2 fenv build failure

Fixes
http://autobuild.buildroot.net/results/216/216fbc33c4838b1414cb25f823fd1db5c92e33c6/
http://autobuild.buildroot.net/results/800/800fe1d79ef2e52b86a97feeba85b5c47aff8dcd/
http://autobuild.buildroot.net/results/8a6/8a6d24ecc6487fd20ba663f71996160124083a68/

Only the affected toolchains are disabled. When using branch next/ compilation
works with a buildroot-compiled toolchain using this defconfig:

BR2_nios2=y
BR2_PACKAGE_FFMPEG=y
BR2_PACKAGE_FFMPEG_GPL=y
BR2_PACKAGE_FFMPEG_NONFREE=y
BR2_PACKAGE_FFMPEG_FFPLAY=y
BR2_PACKAGE_FFMPEG_FFSERVER=y
BR2_PACKAGE_FFMPEG_FFPROBE=y
BR2_PACKAGE_FFMPEG_AVRESAMPLE=y
BR2_PACKAGE_FFMPEG_POSTPROC=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

toolchain-external: clarify external toolchain description

External toolchain can also have been generated by Buildroot previously, as
the list that follows demonstrates. Rephrase the paragraph describing what an
external toolchain is as suggested by Thomas Petazzoni, to make it clearer.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/opentyrian: fix build on bfin

There is a conflict with the _strchrnul symbole from mingw_fixes.c
and the one from uClibc.

Add a guard around strchrnul function for unix systems.

Fixes:
http://autobuild.buildroot.net/results/a08/a085fb55269971e3c7b8ae8c167e7330c3c042a5/

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Config.in: remove text denoting central package infra

The central package infrastructure handles all packages for quite some time
now, so this note is no longer needed.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

btrfs-progs: fix static build with gettext

gettext needs -pthread. Incidentally this change was also made in the package
Makefile itself for a different reason.

Also, drop -lm to match upstream change.

Fixes:
http://autobuild.buildroot.net/results/a53/a53f31355e955c734010922b47084605e13708ef/
http://autobuild.buildroot.net/results/43d/43deeeda31d9750b37e1f1058c3313a387843bee/

and more.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

xserver_xorg-server: enable libunwind for MIPS with 32-bit pointers

libunwind support was broken for MIPS variants with 32-bit pointers so
we disabled it:

  http://lists.busybox.net/pipermail/buildroot/2014-December/114404.html

But now we have a patch to fix that problem so we can enable it again.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

xserver_xorg-server: fix libunwind on MIPS with 32-bit pointers

Adding a patch to fix a compilation problem of Xorg + libunwind support
when building it on MIPS variants with 32-bit pointers.

Related:

  http://lists.busybox.net/pipermail/buildroot/2014-December/114404.html

Patch submitted upstream:

  http://lists.x.org/archives/xorg-devel/2015-January/045226.html

Patch reviewed by an Xorg developer:

  http://lists.x.org/archives/xorg-devel/2015-January/045383.html

Fixes:

  http://autobuild.buildroot.net/results/87b/87be2c95957f9925c1258812e536df72689fc5da/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pkg-cmake.mk: Fix ARM variant typo

Signed-off-by: Assaf Inbal <shmuelzon@gmail.com>
Acked-by: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pkg-rebar: fix very minor typos in the comments

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

netsnmp: Set ac_cv_NETSNMP_CAN_USE_SYSCTL to no

NETSNMP_CAN_USE_SYSCTL is for BSD systems, setting it to yes on
Linux systems breaks compilation when the mibII mib is enabled.

Prior to commit 30bb1bdca49a1dcb71d477e546a40840af865ce2 ("netsnmp:
bump version") from November 2008, this variable was already set to
no, and was changed to yes by the commit, with no explanation. And the
previous code indeed had a comment saying:

   # We set CAN_USE_SYSCTL to no and use /proc since the sysctl code
   # in this thing is apparently intended for freebsd or some such
   # thing...

[Thomas: improved commit log.]

Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

busybox: add 1.23.1 fixes for dc and wget

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

polarssl: security bump to version 1.2.13

Includes the previous CVE-2015-1182 fix (patch dropped) and other fixes
(security and non) from the 1.3 branch (no CVEs yet), see release notes:
https://polarssl.org/tech-updates/releases/polarssl-1.2.13-released

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

php: security bump to version 5.5.22

Fixes:
CVE-2015-0273 - Use after free vulnerability in unserialize() with
DateTimeZone.
CVE-2015-0235 - Mitigation for GHOST: glibc gethostbyname buffer
overflow.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

bind: security bump to version 9.9.6-P2

Fixes CVE-2015-1349 - Revoking a managed trust anchor and supplying an
untrusted replacement could cause namedto crash with an assertion
failure.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mjpg-streamer: limit lines length to 72 characters

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mjpg-streamer: disable for static builds

This package needs to load plugins to do its job. Those plugins are
shared objects (.so) which are loaded using 'dlopen()', so it makes no
sense to enable this package when doing static builds where 'dlopen()'
is not available.

Fixes:

  http://autobuild.buildroot.net/results/cd5/cd52b739370d57b5ecbc6472b8c7f1126700e85f/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-rebar: add bin to list of install directories

Some Erlang packages provide a bin directory for programs that are to be
invoked from the command line. An example of such a package is the Lisp
Flavored Erlang compiler. The Erlang OTP library includes several more
examples (it doesn't use rebar, though.) This change makes sure that the
bin directory gets installed too.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-rebar: HOST_CC -> HOSTCC

Fix HOSTCC typo that would cause host-rebar builds to fail.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

make: disable the 'load' operation for static builds

Disable the 'load' operation for static builds since it needs dlopen and
friends. Otherwise it will fail with an error message like this one:

load.o: In function `load_file':
load.c:(.text+0x2a8): undefined reference to `dlopen'
load.c:(.text+0x2c4): undefined reference to `dlerror'
load.c:(.text+0x308): undefined reference to `dlsym'
load.c:(.text+0x33c): undefined reference to `dlopen'
load.c:(.text+0x35c): undefined reference to `dlsym'
load.c:(.text+0x380): undefined reference to `dlopen'
load.c:(.text+0x39c): undefined reference to `dlopen'
load.c:(.text+0x3a0): undefined reference to `dlerror'
load.c:(.text+0x42c): undefined reference to `dlsym'
load.c:(.text+0x470): undefined reference to `dlsym'
load.c:(.text+0x48c): undefined reference to `dlerror'
load.o: In function `unload_file':
load.c:(.text+0x63c): undefined reference to `dlclose'
collect2: error: ld returned 1 exit status

Fixes:

  http://autobuild.buildroot.net/results/9e3/9e39039b6db79a46990cd9bdcb179289e38d9f31/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

imagemagick: use official download site

Don't use anymore the alternate download site beacause it does not
conatins anymore older versions, instead use the official download site
because now it contains even the older versions.

Signed-off-by: Fabio Porcedda <Fabio.Porcedda@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

busybox: add 1.23.1 patch to fix MODPROBE_SMALL

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

sudo: security bump to version 1.8.12

Fixes CVE-2014-9680 - A user with sudo access may be able to exploit
parsing bugs in the time zone parsing functions of the system's C
library functions. The user may also be able to read arbitrary files,
potentially causing changes in system behavior when reading certain
device special files or simply causing the program run via sudo to
block.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gnutls: make sure librt detection doesn't poison the linker flags

Just like we're passing --with-libpthread-prefix, we also need to pass
--with-librt-prefix in order to avoid having the gnutls build system
detect the librt in /usr/lib, and pass -L/usr/lib to the linker flags.

Fixes:

  http://autobuild.buildroot.org/results/fa5/fa58602cb78ffe3ae4ee389ef5cf5a37b7657c4c/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Update for 2015.02-rc2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-stats: ignore linux-ext-fbtft.mk and doc-asciidoc.mk

Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-stats: add kconfig and rebar infrastructures

Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5bse: configure: fix gold linker detection

Fixes http://autobuild.buildroot.net/results/92c/92c3fb4ddb934115b228652bb8c972bb7459bb40/

While the -fuse-ld=gold flag is related to linking, it is an argument to the
compiler driver to tell it what linker to execute, NOT an option to tell the
linker to behave differently.

So it shouldn't get prefixed with -Wl when passed though the compiler driver.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dvdauthor: fix static build

Dvdauthor forget to link witk -lbz2 when linking with freetype2.

Fixes:
http://autobuild.buildroot.net/results/1d8/1d83390a3dd9f6bb595e9fc7b321500b4dc533a8/

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

x11r7/xserver_xorg-server: security bump to version 1.16.4

Fixes:

CVE-2015-0255 - Information leak in the XkbSetGeometry request of X servers
http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libsemanage: add patch to fix Blackfin build issue

libsemanage use the same build system than libselinux,
so it's affected by the same issue.

Fixes:
http://autobuild.buildroot.net/results/39d/39d3460e88a1316ec7dbcd0d67b7fdb992c3fc77

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libsepol: add patch to fix Blackfin build issue

libsepol use the same build system than libselinux,
so it's affected by the same issue.

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/openvmtools: don't use host library path

Set CUSTOM_PROCPS_LIBS to " " otherwise -L/lib is used by default.

Fixes:
http://autobuild.buildroot.net/results/bff/bff7d8f3ec19ce790f0c88a336d1007e1ff29836/

[Thomas: fix typo in commit log.]

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mplayer: fix compilation with new versions of libgif

mplayer fails to compile with the following error message:

libmpdemux/demux_gif.c: In function 'demux_open_gif':
libmpdemux/demux_gif.c:260:3: error: too few arguments to function
'DGifOpen'
   gif = DGifOpen(demuxer->stream, my_read_gif);

Backport an upstream patch to support newer versions of libgif in
mplayer. Unfortunately this patch is incomplete and mplayer stills
failing to compile with a new error message:

libvo/vo_gif89a.c: In function 'uninit':
libvo/vo_gif89a.c:374:3: error: too few arguments to function
'EGifCloseFile'
   EGifCloseFile(new_gif); // also frees gif storage space.

So I have written a new patch and submitted it upstream to finally fix
the problem.

Upstream commit:

  https://github.com/pigoz/mplayer-svn/commit/a0ddaef5457e222dade386901bf448c5e3ac7b89

New submitted patch:

  https://lists.mplayerhq.hu/pipermail/mplayer-dev-eng/2015-February/072848.html

Fixes:

  http://autobuild.buildroot.net/results/a51/a510a0ab2cb827bb91b4fdec43055f2bfda239b1/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libssh2: fix zlib library search path issues

Like for lingcrypt and openssl, help the configure script to find
zlib installed in STAGING_DIR.

Otherwise, It might find the one installed on the host:
checking how to link with libz... /usr/lib/libz.so -Wl,-rpath -Wl,/usr/lib

Fixes:
http://autobuild.buildroot.net/results/93b/93b43e114f21a22f0f8b7d7dd6774c089c426cd1

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

boards/raspberrypi: update dt kernel sha1

The sha1 used for the DT enabled kernel is no longer available
(presumably, the rpi-3.18.y branch was rebased recently.) This updates
it to the lastest sha1 in the rpi-3.18.y branch.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/openvmtools: fix syncDriverPosix

Backport a patch from Fedora

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/openvmtools: configure fix USE_SLASH_PROC

Backport a patch from Fedora

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Makefile: update help text for savedefconfig

Updated text to say that the defconfig is written to the BR2_DEFCONFIG
location.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5connectivity: fix for big endian platforms

Add a patch to fix qt5connectivity for big endian platforms.

Building qtconnectivity fails for big endian platforms because the
bswap_16 function is not declared. This is the error message:

In file included from bluez/hcimanager_p.h:52:0,
 from bluez/hcimanager.cpp:35:
./bluez/bluez_data_p.h: In function 'quint16 bt_get_le16(const void*)':
./bluez/bluez_data_p.h:172:60: error: 'bswap_16' was not declared in
this scope
     return bswap_16(bt_get_unaligned((const quint16 *) ptr));

bswap_16 is defined in byteswap.h so we can include this file in order
to fix this problem.

This patch has been submitted upstream:

  https://bugreports.qt.io/browse/QTBUG-44421

Fixes:

  http://autobuild.buildroot.net/results/5b8/5b85c6819f94988abd8abfcdaad6226ceb2d790a/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python3: fix invalid ncursesw header path

This commit adds a patch to python3 that makes sure it does not use an
invalid header path (pointing to host headers) when including ncursesw
support.

Fixes:

  http://autobuild.buildroot.org/results/9bd/9bdaa392e8dd00c6ebee156b758e3c0cac480237/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@openwide.fr>
Tested-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dbus: security bump

Fixes CVE-2015-0245. See announcement for details:

http://lists.freedesktop.org/archives/dbus/2015-February/016554.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ntp: rebase nano patch to apply cleanly

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

git: fix static link with openssl

openssl needs -lz when building statically.

Fixes:
http://autobuild.buildroot.net/results/4b3/4b33f3f415776cf43be0910b583d222711a03cad/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Tested-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ntp: security bump to version 4.2.8p1

Fixes:

CVE-2014-9297 - vallen is not validated in several places in ntp_crypto.c,
leading to a potential information leak or possibly a crash

CVE-2014-9298 - ::1 can be spoofed on some OSes (including "some versions" of
Linux), so ACLs based on IPv6 ::1 addresses can be bypassed

Drop a patch applied upstream, along with its accompanied AUTORECONF.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website/news.html: add 2015.02-rc1 announcement link

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2015.02-rc1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

CHANGES: Update with recent changes

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libselinux: add patch to fix Blackfin build issue

Fixes:

  http://autobuild.buildroot.org/results/165/165a227a0a8ecd4cb3f96761aacdf90ae974fea7/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

perl: remove poisoned path from dynaloader hints

Fixes
http://autobuild.buildroot.net/results/323a82776cccf17afaa00ebe3483cfc06a06f264/
http://autobuild.buildroot.net/results/7d4cf7b63fda1a062263b7a4e758c699049105af/

Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/erlang: fix build issue with pcre package

If the pcre package is build before erlang, the erlang's build
system use pcre.h from pcre package instead of using pcre.h bundled
by Erlang.

Erlang use an old version of this file which is incompatible
with the upstream one.

http://autobuild.buildroot.net/results/cbd/cbd8b54eef535f19d7d400fd269af1b3571d6143/build-end.log

And many more.

Signed-off-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5multimedia: Make it compile with no-opengl

Backport an upstream patch to make it compile with no-opengl. Otherwise
it will fail showing an error message like this one:

qpaintervideosurface.cpp:99:47: error: 'QOpenGLContext' has not been
declared

Upstream commit:

  https://qt.gitorious.org/qt/qtmultimedia/commit/2b181d546970d18a48a0f36f5d1a22418b61cd4d

Fixes:

  http://autobuild.buildroot.net/results/b77/b77cdf9b1cf6cafd5afef7337553bb32489207e5/

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

postgresql: bump version to 9.4.1

See [1] for a detailed list of changes.

[1] http://www.postgresql.org/docs/9.4/static/release-9-4-1.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

legacy: add missing option for util-linux' wdctl

In 349c9c7 (package/util-linux: add more tool select options), the
util-linux' wdctl option was renamed, but a entry in the legacy menu was
no added.

Add this now.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Maxim Mikityanskiy <maxtram95@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5webkit: add missing indirect dependency on atomics and !flat

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5cinex: add missing indirect dependency on libegl

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

enlightenment: add missing indirect dependency on atomics

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

xscreensaver: add missing indirect dependency on atomics

Also reformat the comment lines and fix the comment.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pinenty: add missing indirect dependency on atomics for gtk2 support

Also remove redundant comment lines.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

opencv: add missing indirect dependency on atomics for gtk support

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cwiid: add missing indirect dependency on atomics for wmgui

Also add a comment for cwiid itself.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

php: add missing indirect dependency on !avr32 for mysql extensions

Also fix the comment.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dovecot: add missing indirect dependency on !avr32 for mysql

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

util-linux: add missing indirect dependency on !avr32 for setpriv

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>