From f4e5941700de1f71f5bf04a03407e24fc25ec5d6 Mon Sep 17 00:00:00 2001 From: Andras Timar Date: Wed, 8 Aug 2018 13:00:11 +0200 Subject: nss: upgrade to release 3.38 Fixes CVE-2018-0495 and "the ASN.1 code". Change-Id: I96ec90aaee7e4a803ebde1508951c55db4577e9e (cherry picked from commit b01ee1682286a52cda1ee14597257e1f862d4e16) --- download.lst | 4 +- external/nss/ExternalProject_nss.mk | 71 +++++++--------------- external/nss/Module_nss.mk | 2 - external/nss/UnpackedTarball_nss.mk | 12 +--- external/nss/asan.patch.1 | 8 +-- external/nss/clang-cl.patch.0 | 37 ++++++++++++ external/nss/nss.patch | 116 ++++++++++++++++-------------------- external/nss/nss.vs2015.patch | 10 ++++ 8 files changed, 131 insertions(+), 129 deletions(-) diff --git a/download.lst b/download.lst index 088b4f0f8280..d857917a5e2b 100644 --- a/download.lst +++ b/download.lst @@ -131,8 +131,8 @@ export MWAW_TARBALL := libmwaw-0.3.$(MWAW_VERSION_MICRO).tar.bz2 export MYSQLCPPCONN_TARBALL := 7239a4430efd4d0189c4f24df67f08e5-mysql-connector-c++-1.1.4.tar.gz export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz export NEON_TARBALL := 231adebe5c2f78fded3e3df6e958878e-neon-0.30.1.tar.gz -export NSS_MD5SUM := e55ee06b22687df68fafc6a30c0554b2 -export NSS_TARBALL := nss-3.29.5-with-nspr-4.13.1.tar.gz +export NSS_MD5SUM := cd649be8ee61fe15d64d7bef361b37ba +export NSS_TARBALL := nss-3.38-with-nspr-4.19.tar.gz export ODFGEN_MD5SUM := 32572ea48d9021bbd6fa317ddb697abc export ODFGEN_VERSION_MICRO := 6 export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2 diff --git a/external/nss/ExternalProject_nss.mk b/external/nss/ExternalProject_nss.mk index b7bdf4b26ac9..8ce10b0a4ee9 100644 --- a/external/nss/ExternalProject_nss.mk +++ b/external/nss/ExternalProject_nss.mk @@ -9,25 +9,14 @@ $(eval $(call gb_ExternalProject_ExternalProject,nss)) +# nss build calls configure for nspr itself - if for some reason the configure step should be split out, +# make sure to create config.status (aka run configure) in dir specified with OBJDIR_NAME (nspr/out) $(eval $(call gb_ExternalProject_register_targets,nss,\ - configure \ build \ )) -$(call gb_ExternalProject_get_state_target,nss,configure): - $(call gb_ExternalProject_run,configure,\ - $(if $(filter MSC,$(COM)),INCLUDE="$(COMPATH)/include" LIB="$(ILIB)") \ - $(if $(CROSS_COMPILING),\ - NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py") \ - nspr/configure --includedir=$(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/include \ - $(if $(CROSS_COMPILING),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \ - $(if $(filter MSC-X86_64,$(COM)-$(CPUNAME)),--enable-64bit) \ - $(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)),--host=i686-pc-cygwin) \ - ,,nss_configure.log) - ifeq ($(OS),WNT) -ifeq ($(COM),MSC) -$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python) +$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python) $(call gb_ExternalProject_run,build,\ $(if $(MSVC_USE_DEBUG_RUNTIME),USE_DEBUG_RTL=1,BUILD_OPT=1) \ MOZ_MSVCVERSION=9 OS_TARGET=WIN95 \ @@ -38,28 +27,10 @@ $(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject NSINSTALL='$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py' \ ,nss) - -else -$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python) - $(call gb_ExternalProject_run,build,\ - $(MAKE) -j1 nss_build_all \ - NS_USE_GCC=1 \ - CC="$(CC) $(if $(MINGW_SHARED_GCCLIB),-shared-libgcc)" \ - CXX="$(CXX) $(if $(MINGW_SHARED_GCCLIB),-shared-libgcc)" \ - OS_LIBS="-ladvapi32 -lws2_32 -lmswsock -lwinmm $(if $(MINGW_SHARED_GXXLIB),$(MINGW_SHARED_LIBSTDCPP))" \ - LDFLAGS="" \ - PATH="$(PATH)" \ - RANLIB="$(RANLIB)" \ - OS_TARGET=WINNT RC="$(WINDRES)" OS_RELEASE="5.0" \ - IMPORT_LIB_SUFFIX=dll.a \ - NSPR_CONFIGURE_OPTS="--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM) --enable-shared --disable-static" \ - NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py" \ - && rm -f $(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/lib/*.a \ - ,nss) - -endif else # OS!=WNT -$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python) +# make sure to specify NSPR_CONFIGURE_OPTS as env (before make command), so nss can append it's own defaults +# OTOH specify e.g. CC and NSINSTALL as arguments (after make command), so they will overrule nss makefile values +$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python) $(call gb_ExternalProject_run,build,\ $(if $(filter FREEBSD LINUX MACOSX,$(OS)),$(if $(filter X86_64,$(CPUNAME)),USE_64=1)) \ $(if $(filter IOS,$(OS)),\ @@ -72,30 +43,32 @@ $(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject $(if $(CROSS_COMPILING),\ $(if $(filter MACOSXPOWERPC,$(OS)$(CPUNAME)),CPU_ARCH=ppc) \ $(if $(filter IOS-ARM,$(OS)-$(CPUNAME)),CPU_ARCH=arm) \ - NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py") \ + NSPR_CONFIGURE_OPTS="--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)") \ NSDISTMODE=copy \ $(MAKE) -j1 AR="$(AR)" \ RANLIB="$(RANLIB)" \ NMEDIT="$(NM)edit" \ - CCC="$(CXX)" \ - $(if $(CROSS_COMPILING),NSPR_CONFIGURE_OPTS="--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)") \ + COMMA=$(COMMA) \ + CC="$(CC)" CCC="$(CXX)" \ + $(if $(CROSS_COMPILING),NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py") \ + $(if $(filter ANDROID,$(OS)),OS_TARGET=Android OS_TARGET_RELEASE=14 ARCHFLAG="" DEFAULT_COMPILER=clang ANDROID_NDK=$(ANDROID_NDK_HOME) ANDROID_TOOLCHAIN_VERSION=$(ANDROID_GCC_TOOLCHAIN_VERSION)) \ nss_build_all \ && rm -f $(call gb_UnpackedTarball_get_dir,nss)/dist/out/lib/*.a \ $(if $(filter MACOSX,$(OS)),\ && chmod u+w $(call gb_UnpackedTarball_get_dir,nss)/dist/out/lib/*.dylib \ && $(PERL) \ $(SRCDIR)/solenv/bin/macosx-change-install-names.pl shl OOO \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libfreebl3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libnspr4.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libnss3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libnssckbi.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libnssdbm3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libnssutil3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libplc4.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libplds4.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libsmime3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libsoftokn3.dylib \ - $(gb_Package_SOURCEDIR_nss)/dist/out/lib/libssl3.dylib) \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libfreebl3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libnspr4.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libnss3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libnssckbi.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libnssdbm3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libnssutil3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libplc4.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libplds4.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libsmime3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libsoftokn3.dylib \ + $(EXTERNAL_WORKDIR)/dist/out/lib/libssl3.dylib) \ ,nss) endif diff --git a/external/nss/Module_nss.mk b/external/nss/Module_nss.mk index 69b39f59ee5d..eae9e9524480 100644 --- a/external/nss/Module_nss.mk +++ b/external/nss/Module_nss.mk @@ -9,12 +9,10 @@ $(eval $(call gb_Module_Module,nss)) -ifeq ($(filter ANDROID,$(OS)),) $(eval $(call gb_Module_add_targets,nss,\ UnpackedTarball_nss \ ExternalPackage_nss \ ExternalProject_nss \ )) -endif # vim: set noet sw=4 ts=4: diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk index 4a90853f543a..314ff875ecbd 100644 --- a/external/nss/UnpackedTarball_nss.mk +++ b/external/nss/UnpackedTarball_nss.mk @@ -17,26 +17,20 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\ external/nss/nss-3.13.5-zlib-werror.patch \ external/nss/nss_macosx.patch \ external/nss/nss-win32-make.patch.1 \ - $(if $(filter WNTMSC,$(OS)$(COM)),external/nss/nss.windows.patch \ + $(if $(filter WNT,$(OS)),external/nss/nss.windows.patch \ external/nss/nss.nowerror.patch \ external/nss/nss.vs2015.patch) \ - $(if $(filter WNTGCC,$(OS)$(COM)),external/nss/nspr-4.9-build.patch.3 \ - external/nss/nss-3.13.3-build.patch.3 \ - external/nss/nss.mingw.patch.3) \ external/nss/ubsan.patch.0 \ external/nss/clang-cl.patch.0 \ - external/nss/nss.windowbuild.patch.0 \ $(if $(filter IOS,$(OS)), \ external/nss/nss-chromium-nss-static.patch \ external/nss/nss-more-static.patch \ external/nss/nss-ios.patch) \ $(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)), \ external/nss/nss.cygwin64.in32bit.patch) \ - $(if $(filter WNTMSC,$(OS)$(COM)), \ + $(if $(filter WNT,$(OS)), \ external/nss/nss.vs2015.pdb.patch) \ - $(if $(findstring 120_70,$(VCVER)_$(WINDOWS_SDK_VERSION)), \ - external/nss/nss-winXP-sdk.patch.1) \ - $(if $(filter WNTMSC,$(OS)$(COM)), \ + $(if $(filter WNT,$(OS)), \ external/nss/nss.utf8bom.patch.1) \ )) diff --git a/external/nss/asan.patch.1 b/external/nss/asan.patch.1 index 0685adb1dc4b..7dfd6ed4e782 100644 --- a/external/nss/asan.patch.1 +++ b/external/nss/asan.patch.1 @@ -1,12 +1,12 @@ diff -ur nss.org/nss/coreconf/Linux.mk nss/nss/coreconf/Linux.mk --- nss.org/nss/coreconf/Linux.mk 2014-05-06 04:36:01.817838877 +0200 +++ nss/nss/coreconf/Linux.mk 2014-05-06 04:37:25.387835456 +0200 -@@ -158,7 +158,7 @@ +@@ -146,7 +146,7 @@ # we don't use -z defs there. # Also, -z defs conflicts with Address Sanitizer, which emits relocations # against the libsanitizer runtime built into the main executable. -ZDEFS_FLAG = -Wl,-z,defs +ZDEFS_FLAG = - ifneq ($(USE_ASAN),1) - DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -Wl,-z,origin '-Wl,-rpath,$$ORIGIN' - endif + DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) $(if $(filter-out $(OS),ANDROID),-Wl$(COMMA)-z$(COMMA)origin '-Wl$(COMMA)-rpath$(COMMA)$$ORIGIN') + LDFLAGS += $(ARCHFLAG) -z noexecstack + diff --git a/external/nss/clang-cl.patch.0 b/external/nss/clang-cl.patch.0 index 98786d49971c..684cf74d3ca6 100644 --- a/external/nss/clang-cl.patch.0 +++ b/external/nss/clang-cl.patch.0 @@ -72,3 +72,40 @@ /* This magic gets the windows compiler to give us a deprecation * warning */ #pragma deprecated(CKT_NSS_UNTRUSTED, CKT_NSS_MUST_VERIFY, CKT_NSS_VALID) + +# While MSVC uses +# #pragma warning(disable : 4103) +# in the inner pkcs11p.h, clang-cl wants +# #pragma clang diagnostic ignored "-Wpragma-pack" +# in the outer pkcs11t.h: +--- nss/lib/util/pkcs11t.h ++++ nss/lib/util/pkcs11t.h +@@ -72,7 +72,14 @@ + #define CK_INVALID_HANDLE 0 + + /* pack */ ++#if defined __clang__ && defined _MSC_VER ++#pragma clang diagnostic push ++#pragma clang diagnostic ignored "-Wpragma-pack" ++#endif + #include "pkcs11p.h" ++#if defined __clang__ && defined _MSC_VER ++#pragma clang diagnostic pop ++#endif + + typedef struct CK_VERSION { + CK_BYTE major; /* integer portion of version number */ +@@ -1795,6 +1802,13 @@ + #include "pkcs11n.h" + + /* undo packing */ ++#if defined __clang__ && defined _MSC_VER ++#pragma clang diagnostic push ++#pragma clang diagnostic ignored "-Wpragma-pack" ++#endif + #include "pkcs11u.h" ++#if defined __clang__ && defined _MSC_VER ++#pragma clang diagnostic pop ++#endif + + #endif diff --git a/external/nss/nss.patch b/external/nss/nss.patch index b3b932343d83..6219775c2d3c 100644 --- a/external/nss/nss.patch +++ b/external/nss/nss.patch @@ -1,5 +1,16 @@ ---- a/nss.orig/nspr/pr/src/misc/prnetdb.c 2016-02-12 14:51:25.000000000 +0100 -+++ b/nss/nspr/pr/src/misc/prnetdb.c 2016-03-04 19:23:00.462892600 +0100 +--- a/a/nspr/configure 2017-08-29 23:44:13.686045013 +0530 ++++ b/b/nspr/configure 2017-08-29 23:46:53.774768655 +0530 +@@ -7034,7 +7034,7 @@ + PR_MD_CSRCS=linux.c + MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@' + DSO_CFLAGS=-fPIC +- DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)' ++ DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@) $(if $(filter-out $(OS),ANDROID),-Wl$(COMMA)-z$(COMMA)origin -Wl$(COMMA)-rpath$(COMMA)\$$ORIGIN)' + _OPTIMIZE_FLAGS=-O2 + _DEBUG_FLAGS="-g -fno-inline" # most people on linux use gcc/gdb, and that + # combo is not yet good at debugging inlined +--- a/nss.orig/nspr/pr/src/misc/prnetdb.c 2017-08-29 23:44:13.690045031 +0530 ++++ b/nss/nspr/pr/src/misc/prnetdb.c 2017-08-29 23:47:03.810814019 +0530 @@ -438,7 +438,7 @@ char *buf = *bufp; PRIntn buflen = *buflenp; @@ -9,21 +20,8 @@ PRIntn skip = align - ((ptrdiff_t)buf & (align - 1)); if (buflen < skip) { return 0; -diff -ru a/nspr/configure b/nspr/configure ---- a/a/nspr/configure 2014-09-29 16:46:38.427423757 +0100 -+++ b/b/nspr/configure 2014-09-29 16:47:42.984012225 +0100 -@@ -7018,7 +7018,7 @@ - PR_MD_CSRCS=linux.c - MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@' - DSO_CFLAGS=-fPIC -- DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)' -+ DSO_LDOPTS='-shared -Wl,-z,origin -Wl,-rpath,\$$ORIGIN -Wl,-soname -Wl,$(notdir $@)' - _OPTIMIZE_FLAGS=-O2 - _DEBUG_FLAGS="-g -fno-inline" # most people on linux use gcc/gdb, and that - # combo is not yet good at debugging inlined -diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk ---- a/a/nss/cmd/platlibs.mk 2014-09-29 16:46:38.306422654 +0100 -+++ b/b/nss/cmd/platlibs.mk 2014-09-29 16:47:42.987012253 +0100 +--- a/a/nss/cmd/platlibs.mk 2017-08-29 23:44:13.554044416 +0530 ++++ b/b/nss/cmd/platlibs.mk 2017-08-29 23:46:09.638569150 +0530 @@ -10,17 +10,22 @@ ifeq ($(OS_ARCH), SunOS) @@ -51,10 +49,9 @@ diff -ru a/nss/cmd/platlibs.mk b/nss/cmd/platlibs.mk endif endif -diff -ru nss.orig/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk ---- a/nss.orig/nss/coreconf/arch.mk 2016-02-12 15:36:18.000000000 +0100 -+++ b/nss/nss/coreconf/arch.mk 2016-02-23 20:48:31.595941079 +0100 -@@ -280,11 +280,17 @@ +--- a/nss.org/nss/coreconf/arch.mk 2017-08-29 23:44:13.646044832 +0530 ++++ b/nss/nss/coreconf/arch.mk 2017-08-29 23:45:51.494487134 +0530 +@@ -305,11 +305,17 @@ OBJDIR_NAME_COMPILER = $(COMPILER_TAG) endif OBJDIR_NAME_BASE = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(OBJDIR_NAME_COMPILER)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG) @@ -74,9 +71,8 @@ diff -ru nss.orig/nss/coreconf/arch.mk nss/nss/coreconf/arch.mk # # Define USE_DEBUG_RTL if you want to use the debug runtime library # (RTL) in the debug build -diff -ru a/nss/coreconf/FreeBSD.mk b/nss/coreconf/FreeBSD.mk ---- a/a/nss/coreconf/FreeBSD.mk 2014-09-29 16:46:38.189421588 +0100 -+++ b/b/nss/coreconf/FreeBSD.mk 2014-09-29 16:47:42.984012225 +0100 +--- a/nss.org/nss/coreconf/FreeBSD.mk 2017-08-29 23:44:13.642044814 +0530 ++++ b/nss/nss/coreconf/FreeBSD.mk 2017-08-29 23:45:20.850348615 +0530 @@ -25,6 +25,7 @@ DSO_CFLAGS = -fPIC @@ -85,19 +81,18 @@ diff -ru a/nss/coreconf/FreeBSD.mk b/nss/coreconf/FreeBSD.mk # # The default implementation strategy for FreeBSD is pthreads. -diff -ru a/nss/coreconf/Linux.mk b/nss/coreconf/Linux.mk ---- a/a/nss/coreconf/Linux.mk 2014-09-29 16:46:38.189421588 +0100 -+++ b/b/nss/coreconf/Linux.mk 2014-09-29 16:47:42.985012235 +0100 -@@ -157,7 +160,7 @@ +--- a/nss.org/nss/coreconf/Linux.mk 2017-08-29 23:44:13.642044814 +0530 ++++ b/nss/nss/coreconf/Linux.mk 2017-08-29 23:47:26.318915759 +0530 +@@ -147,7 +147,7 @@ + # Also, -z defs conflicts with Address Sanitizer, which emits relocations # against the libsanitizer runtime built into the main executable. ZDEFS_FLAG = -Wl,-z,defs - ifneq ($(USE_ASAN),1) -DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -+DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -Wl,-z,origin '-Wl,-rpath,$$ORIGIN' - endif - LDFLAGS += $(ARCHFLAG) ++DSO_LDOPTS += $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) $(if $(filter-out $(OS),ANDROID),-Wl$(COMMA)-z$(COMMA)origin '-Wl$(COMMA)-rpath$(COMMA)$$ORIGIN') + LDFLAGS += $(ARCHFLAG) -z noexecstack -@@ -189,8 +192,13 @@ + # On Maemo, we need to use the -rpath-link flag for even the standard system +@@ -177,8 +177,13 @@ endif endif @@ -111,9 +106,8 @@ diff -ru a/nss/coreconf/Linux.mk b/nss/coreconf/Linux.mk # The -rpath '$$ORIGIN' linker option instructs this library to search for its # dependencies in the same directory where it resides. -diff -ru a/nss/coreconf/rules.mk b/nss/coreconf/rules.mk ---- a/a/nss/coreconf/rules.mk 2014-09-29 16:46:38.188421578 +0100 -+++ b/b/nss/coreconf/rules.mk 2014-09-29 16:47:42.986012244 +0100 +--- a/nss.org/nss/coreconf/rules.mk 2017-08-29 23:44:13.646044832 +0530 ++++ b/nss/nss/coreconf/rules.mk 2017-08-29 23:47:37.442966042 +0530 @@ -261,7 +261,7 @@ ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET))) $(AR) $(subst /,\\,$(OBJS)) @@ -123,34 +117,43 @@ diff -ru a/nss/coreconf/rules.mk b/nss/coreconf/rules.mk endif $(RANLIB) $@ -diff -ru a/nss/coreconf/SunOS5.mk b/nss/coreconf/SunOS5.mk ---- a/a/nss/coreconf/SunOS5.mk 2014-09-29 16:46:38.175421471 +0100 -+++ b/b/nss/coreconf/SunOS5.mk 2014-09-29 16:47:42.985012235 +0100 -@@ -48,8 +48,12 @@ +--- a/nss.org/nss/coreconf/SunOS5.mk 2017-08-29 23:44:13.646044832 +0530 ++++ b/nss/nss/coreconf/SunOS5.mk 2017-08-29 23:45:00.902258445 +0530 +@@ -48,8 +48,11 @@ # OPTIMIZER += -mno-omit-leaf-frame-pointer -fno-omit-frame-pointer endif else - CC = cc - CCC = CC -+# CC is taken from environment automatically. -+# CC = cc -+# Use CXX from environment. -+# CCC = CC -+ CCC = $(CXX) -+ ++ # CC is taken from environment automatically. ++ # CC = cc ++ # Use CXX from environment. ++ # CCC = CC ++ CCC = $(CXX) ASFLAGS += -Wa,-P OS_CFLAGS += $(NOMD_OS_CFLAGS) $(ARCHFLAG) ifndef BUILD_OPT -diff -ru a/nss/Makefile b/nss/Makefile ---- a/a/nss/Makefile 2014-09-29 16:46:38.171421425 +0100 -+++ b/b/nss/Makefile 2014-09-29 16:47:42.987012253 +0100 +--- a/nss.org/nss/coreconf/Werror.mk 2017-08-29 23:44:13.646044832 +0530 ++++ b/nss/nss/coreconf/Werror.mk 2017-08-29 23:44:23.994091608 +0530 +@@ -94,7 +94,8 @@ + endif #ndef NSS_ENABLE_WERROR + + ifeq ($(NSS_ENABLE_WERROR),1) +- WARNING_CFLAGS += -Werror ++ # We do not treat warnings as errors. ++ # WARNING_CFLAGS += -Werror + else + # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions. + # Use this to disable use of that #pragma and the warnings it suppresses. +--- a/nss.org/nss/Makefile 2017-08-29 23:44:13.402043729 +0530 ++++ b/nss/nss/Makefile 2017-08-29 23:44:39.774162939 +0530 @@ -1,3 +1,5 @@ +export AR +export RANLIB #! gmake # # This Source Code Form is subject to the terms of the Mozilla Public -@@ -91,10 +91,10 @@ +@@ -89,10 +91,10 @@ NSPR_CONFIGURE_ENV = CC=gcc CXX=g++ endif ifdef CC @@ -163,16 +166,3 @@ diff -ru a/nss/Makefile b/nss/Makefile endif # Remove -arch definitions. NSPR can't handle that. NSPR_CONFIGURE_ENV := $(filter-out -arch x86_64,$(NSPR_CONFIGURE_ENV)) -diff -ru nss.orig/nss/coreconf/Werror.mk nss/nss/coreconf/Werror.mk ---- a/nss.orig/nss/coreconf/Werror.mk 2016-02-12 15:36:18.000000000 +0100 -+++ b/nss/nss/coreconf/Werror.mk 2016-02-23 23:58:15.119584046 +0100 -@@ -94,7 +94,8 @@ - endif #ndef NSS_ENABLE_WERROR - - ifeq ($(NSS_ENABLE_WERROR),1) -- WARNING_CFLAGS += -Werror -+# We do not treat warnings as errors. -+# WARNING_CFLAGS += -Werror - else - # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions. - # Use this to disable use of that #pragma and the warnings it suppresses. diff --git a/external/nss/nss.vs2015.patch b/external/nss/nss.vs2015.patch index de4f8762fd5b..c3e6b5a5acaa 100644 --- a/external/nss/nss.vs2015.patch +++ b/external/nss/nss.vs2015.patch @@ -10,3 +10,13 @@ diff -ru nss.org/nss/coreconf/WIN32.mk nss/nss/coreconf/WIN32.mk ifeq ($(_MSC_VER_GE_12),1) OS_CFLAGS += -FS endif +--- a/nss/nss/gtests/nss_bogo_shim/nss_bogo_shim.cc 2018-08-08 11:08:42.922939267 +0200 ++++ b/nss/nss/gtests/nss_bogo_shim/nss_bogo_shim.cc 2018-08-08 11:08:47.778929835 +0200 +@@ -6,6 +6,7 @@ + #include "config.h" + + #include ++#include + #include + #include + #include -- cgit