<feed xmlns='http://www.w3.org/2005/Atom'>
<title>busybox-w32/scripts/kconfig/lxdialog, branch master</title>
<subtitle>A mirror of https://github.com/rmyorston/busybox-w32.git
</subtitle>
<id>https://git.lua4.win/busybox-w32/atom?h=master</id>
<link rel='self' href='https://git.lua4.win/busybox-w32/atom?h=master'/>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/'/>
<updated>2025-05-19T07:34:32+00:00</updated>
<entry>
<title>Merge branch 'busybox' into merge</title>
<updated>2025-05-19T07:34:32+00:00</updated>
<author>
<name>Ron Yorston</name>
<email>rmy@pobox.com</email>
</author>
<published>2025-05-19T07:34:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=64bf69893bd99c305d13a956389f216e7d15c682'/>
<id>urn:sha1:64bf69893bd99c305d13a956389f216e7d15c682</id>
<content type='text'>
</content>
</entry>
<entry>
<title>archival: disallow path traversals (CVE-2023-39810)</title>
<updated>2025-04-16T01:03:17+00:00</updated>
<author>
<name>Denys Vlasenko</name>
<email>vda.linux@googlemail.com</email>
</author>
<published>2024-10-02T08:12:05+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=9a8796436b9b0641e13480811902ea2ac57881d3'/>
<id>urn:sha1:9a8796436b9b0641e13480811902ea2ac57881d3</id>
<content type='text'>
Create new configure option for archival/libarchive based extractions to
disallow path traversals.
As this is a paranoid option and might introduce backward
incompatibility, default it to no.

Fixes: CVE-2023-39810

Based on the patch by Peter Kaestle &lt;peter.kaestle@nokia.com&gt;

function                                             old     new   delta
data_extract_all                                     921     945     +24
strip_unsafe_prefix                                  101     102      +1
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/0 up/down: 25/0)               Total: 25 bytes

Signed-off-by: Denys Vlasenko &lt;vda.linux@googlemail.com&gt;
</content>
</entry>
<entry>
<title>build system: fix ncurses detection</title>
<updated>2024-04-28T14:48:03+00:00</updated>
<author>
<name>Ron Yorston</name>
<email>rmy@pobox.com</email>
</author>
<published>2024-04-28T14:48:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=e21f531c297d1567720c8b0f1c9bab7daf0cfdad'/>
<id>urn:sha1:e21f531c297d1567720c8b0f1c9bab7daf0cfdad</id>
<content type='text'>
Recent versions of gcc fail to build the binary to test for
ncurses because main() is lacking a return type.
</content>
</entry>
<entry>
<title>build system: allow monochrome 'make menuconfig'</title>
<updated>2022-11-16T14:43:33+00:00</updated>
<author>
<name>Ron Yorston</name>
<email>rmy@pobox.com</email>
</author>
<published>2022-11-16T14:43:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=13b71ecafba53ebe8e4f88f9af70170b032ba408'/>
<id>urn:sha1:13b71ecafba53ebe8e4f88f9af70170b032ba408</id>
<content type='text'>
'make menuconfig' uses a hardcoded colour palette which may be
difficult to read.  Add support for the 'COLORS' environment
variable.  Setting this to '0' will cause 'make menuconfig' to
be displayed in black and white.

(GitHub issue #273)
</content>
</entry>
<entry>
<title>build system: silence compiler warning</title>
<updated>2022-11-08T08:47:44+00:00</updated>
<author>
<name>Ron Yorston</name>
<email>rmy@pobox.com</email>
</author>
<published>2022-11-08T08:36:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=5507c8744566a7100d2da3cfa0decc005783a58e'/>
<id>urn:sha1:5507c8744566a7100d2da3cfa0decc005783a58e</id>
<content type='text'>
The compiler in MSYS2 warns that strcasecmp(3) isn't declared in
scripts/kconfig/lxdialog/checklist.c.  Add the appropriate include
to silence this warning.
</content>
</entry>
<entry>
<title>Provide PDCurses source for w64devkit build</title>
<updated>2022-11-07T13:49:52+00:00</updated>
<author>
<name>Ron Yorston</name>
<email>rmy@pobox.com</email>
</author>
<published>2022-11-07T11:29:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=863342aef089f064afb65d7c344a0d254c30d155'/>
<id>urn:sha1:863342aef089f064afb65d7c344a0d254c30d155</id>
<content type='text'>
w64devkit doesn't ship a curses library.  Provide a cut-down copy
of PDCurses which is sufficient to allow 'make menuconfig' to work
in w64devkit.
</content>
</entry>
<entry>
<title>build system: fix compiler warnings</title>
<updated>2019-01-06T19:12:16+00:00</updated>
<author>
<name>Denys Vlasenko</name>
<email>vda.linux@googlemail.com</email>
</author>
<published>2019-01-06T19:12:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=4bdc914ff97df0cea8d2c7b42bf7f57d5ebb8dcb'/>
<id>urn:sha1:4bdc914ff97df0cea8d2c7b42bf7f57d5ebb8dcb</id>
<content type='text'>
Signed-off-by: Denys Vlasenko &lt;vda.linux@googlemail.com&gt;
</content>
</entry>
<entry>
<title>kconfig/lxdialog: get ncurses CFLAGS with pkg-config</title>
<updated>2016-04-04T03:59:15+00:00</updated>
<author>
<name>Bjørn Forsman</name>
<email>bjorn.forsman@gmail.com</email>
</author>
<published>2014-09-14T10:57:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=d63d77a7f03eaa49729619a14aa9a12a0e9f95ad'/>
<id>urn:sha1:d63d77a7f03eaa49729619a14aa9a12a0e9f95ad</id>
<content type='text'>
This makes "make menuconfig" also work on systems where ncurses is not
installed in a standard location (such as on NixOS).

This patch changes ccflags() so that it tries pkg-config first, and only
if pkg-config fails does it go back to the fallback/manual checks. This
is the same algorithm that ldflags() already uses.

Signed-off-by: Bjørn Forsman &lt;bjorn.forsman@gmail.com&gt;
Signed-off-by: Michal Marek &lt;mmarek@suse.cz&gt;
Signed-off-by: Mike Frysinger &lt;vapier@gentoo.org&gt;
</content>
</entry>
<entry>
<title>kbuild: Make scripts executable</title>
<updated>2016-04-04T03:59:15+00:00</updated>
<author>
<name>Michal Marek</name>
<email>mmarek@suse.cz</email>
</author>
<published>2014-08-20T14:02:59+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=935fe68236f21bf641b316fea1867754e754911b'/>
<id>urn:sha1:935fe68236f21bf641b316fea1867754e754911b</id>
<content type='text'>
The Makefiles call the respective interpreter explicitly, but this makes
it easier to use the scripts manually.

Signed-off-by: Michal Marek &lt;mmarek@suse.cz&gt;
Signed-off-by: Mike Frysinger &lt;vapier@gentoo.org&gt;
</content>
</entry>
<entry>
<title>kconfig/lxdialog: rationalise the include paths where to find {.n}curses{,w}.h</title>
<updated>2016-04-04T03:59:15+00:00</updated>
<author>
<name>Yann E. MORIN</name>
<email>yann.morin.1998@free.fr</email>
</author>
<published>2013-03-22T22:12:16+00:00</published>
<link rel='alternate' type='text/html' href='https://git.lua4.win/busybox-w32/commit/?id=d35ba8b5eddedd50349adf9358574cdbbc3c47ef'/>
<id>urn:sha1:d35ba8b5eddedd50349adf9358574cdbbc3c47ef</id>
<content type='text'>
The current code does this:

    if [ -f /usr/include/ncursesw/curses.h ]; then
        echo '-I/usr/include/ncursesw -DCURSES_LOC="&lt;ncursesw/curses.h&gt;"'
    elif [ -f /usr/include/ncurses/ncurses.h ]; then
        echo '-I/usr/include/ncurses -DCURSES_LOC="&lt;ncurses.h&gt;"'
    elif [ -f /usr/include/ncurses/curses.h ]; then
        echo '-I/usr/include/ncurses -DCURSES_LOC="&lt;ncurses/curses.h&gt;"'
    [...]

This is merely inconsistent:
  - adding the full path to the directory in the -I directive,
  - especially since that path is already a sub-path of the system
    include path,
  - and then repeating the sub-path in the #include directive.

Rationalise each include directive:
  - only use the filename in the #include directive,
  - keep the -I directives: they are always searched for before the
    system include path; this ensures the correct header is used.

Using the -I directives and the filename-only in #include is more in
line with how pkg-config behaves, eg.:
    $ pkg-config --cflags ncursesw
    -I/usr/include/ncursesw

This paves the way for using pkg-config for CFLAGS, too, now we use it
to find the libraries.

Signed-off-by: "Yann E. MORIN" &lt;yann.morin.1998@free.fr&gt;
Signed-off-by: Mike Frysinger &lt;vapier@gentoo.org&gt;
</content>
</entry>
</feed>
