This addresses the following security advisories:
+ CVE-2016-3075: Stack overflow in _nss_dns_getnetbyname_r
+ CVE-2016-1234: glob: buffer overflow with GLOB_ALTDIRFUNC due to incorrect
NAME_MAX limit assumption
+ CVE-2016-3706: getaddrinfo: stack overflow in hostent conversion
Patches cherry-picked from glibc's release/2.23/master branch.
The "glob-simplify-interface.patch" was a dependency for
"cve-2016-1234.patch".
Looks like `nix-env -qaP --drv-path` is not enough and one need to
either add `--json` too to catch problems like this... or just use
`nox-review wip`.
Release announcement, 2016-01-30:
https://www.sigrok.org/blog/major-sigrok-releases-libsigrok-libsigrokdecode-sigrok-cli-pulseview
I first tried updating the projects in separate commits. But later I
found cyclic dependencies, that would break git bisect, so I ended up
squashing the commits:
* libsigrok: 0.3.0 -> 0.4.0
Enable building libsigrokcxx.so, the C++ bindings for libsigrok, by
adding doxygen, glibmm and python as build deps. This is needed for
Pulseview >= 0.3.0. Also update the firmware (sigrok-firmware-fx2lafw)
while at it.
* libsigrokdecode: 0.3.0 -> 0.4.0
* sigrok-cli: 0.5.0 -> 0.6.0
* pulseview: 0.2.0 -> 0.3.0
New dependency: glibmm (due to libsigrokcxx.pc from libsigrok).
Note that collectd is incompatible with the new libsigrok release, so
I let it use the old one (0.3.0).
This reverts commit 6ff886e539 because it
doesn't work when chroot builds are enabled (nix.useChroot = true):
$ nix-build -A arduino
these derivations will be built:
/nix/store/xjv1j3mww4jx1vccfc0p1inlcrlgx2if-arduino-1.6.6.drv
building path(s) ‘/nix/store/58sdiphd4pm3811gir0b8j718pgq8zvk-arduino-1.6.6’
...
untar-unzip-download:
[get] Getting: http://downloads.arduino.cc/reference-1.6.6-3.zip
[get] To: /tmp/nix-build-arduino-1.6.6.drv-0/Arduino-1.6.6-src/build/shared/reference-1.6.6-3.zip
[get] Error getting http://downloads.arduino.cc/reference-1.6.6-3.zip to /tmp/nix-build-arduino-1.6.6.drv-0/Arduino-1.6.6-src/build/shared/reference-1.6.6-3.zip
untar-unzip-checksum:
[echo] Testing checksum of "shared/reference-1.6.6-3.zip"
[checksum] Could not find file /tmp/nix-build-arduino-1.6.6.drv-0/Arduino-1.6.6-src/build/shared/reference-1.6.6-3.zip to generate checksum for.
BUILD FAILED
Reasoning: without a revert, the build farm cannot produce binaries and
users that build from source, without chroot, cannot trust that they get
a working result (non-deterministic build, depending on how pure the
arduino builder is).
