package/iperf3: add patch to fix CVE-2025-54350

Fixes the following vulnerability:

    In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion
    failure and application exit upon a malformed authentication attempt.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-54350
  - 4eab661da0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

package/iperf3/0002-Prevent-crash-due-to-assertion-failures-on-malformed-authentication-attempt.patch

@@ -0,0 +1,35 @@
+From de932ea16bc959f839d28d370f0602de52c5def1 Mon Sep 17 00:00:00 2001
+From: "Bruce A. Mah" <bmah@es.net>
+Date: Tue, 24 Jun 2025 15:58:21 -0700
+Subject: [PATCH] Prevent crash due to assertion failures on malformed
+ authentication attempt.
+
+Reported by Han Lee (Apple Information Security)
+
+CVE: CVE-2025-54350
+Upstream: https://github.com/esnet/iperf/commit/de932ea16bc959f839d28d370f0602de52c5def1
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/iperf_auth.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/iperf_auth.c b/src/iperf_auth.c
+index 72e85fc9a..b9f2bc0f2 100644
+--- a/src/iperf_auth.c
++++ b/src/iperf_auth.c
+@@ -28,7 +28,6 @@
+ #include "iperf_config.h"
+ 
+ #include <string.h>
+-#include <assert.h>
+ #include <time.h>
+ #include <sys/types.h>
+ /* FreeBSD needs _WITH_GETLINE to enable the getline() declaration */
+@@ -152,7 +151,6 @@ int Base64Decode(const char* b64message, unsigned char** buffer, size_t* length)
+ 
+     BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL); //Do not use newlines to flush buffer
+     *length = BIO_read(bio, *buffer, strlen(b64message));
+-    assert(*length == decodeLen); //length should equal decodeLen, else something went horribly wrong
+     BIO_free_all(bio);
+ 
+     return (0); //success

package/iperf3/iperf3.mk

@@ -14,6 +14,9 @@ IPERF3_CPE_ID_VENDOR = es
 # 0001-Fix-off-by-one-head-overflow-in-auth.patch
 IPERF3_IGNORE_CVES += CVE-2025-54349
 
+# 0002-Prevent-crash-due-to-assertion-failures-on-malformed-authentication-attempt.patch
+IPERF3_IGNORE_CVES += CVE-2025-54350
+
 IPERF3_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -D_GNU_SOURCE"
 
 ifeq ($(BR2_PACKAGE_OPENSSL),y)