mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-30 05:51:45 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/cjson: security bump to version 1.7.19

Browse Source 
Fixes the following security issue:

CVE-2025-57052: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via
the decode_array_index_from_pointer function in cJSON_Utils.c, allowing
remote attackers to bypass array bounds checking and access restricted data
via malformed JSON pointer strings containing alphanumeric characters

https://nvd.nist.gov/vuln/detail/CVE-2025-57052
https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
74e1ff4994
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a93602c00b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Peter Korsgaard
2025-09-16 11:31:05 +02:00
committed by Arnout Vandecappelle
parent ca3e495b29
commit 8273db5669
3 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/cjson/0001-make_compatible_with_cmake_4.0.patch
View File

@@ -16,6 +16,8 @@ CMake Error at CMakeLists.txt:2 (cmake_minimum_required):
This change raises the minimum required CMake version to 3.5 and thus makes the project compatible with CMake 4.0 This change raises the minimum required CMake version to 3.5 and thus makes the project compatible with CMake 4.0
Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> Signed-off-by: Benoît Monin <benoit.monin@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter: update for 1.7.19
Upstream: https://github.com/DaveGamble/cJSON/pull/935 Upstream: https://github.com/DaveGamble/cJSON/pull/935
--- ---
CMakeLists.txt | 2 +- CMakeLists.txt | 2 +-
@@ -31,4 +33,4 @@ index 36a6cb57..9428da58 100644
+cmake_minimum_required(VERSION 3.5) +cmake_minimum_required(VERSION 3.5)
project(cJSON project(cJSON
VERSION 1.7.18 VERSION 1.7.19

2
package/cjson/cjson.hash
View File

@@ -1,3 +1,3 @@
# Locally computed: # Locally computed:
sha256 3aa806844a03442c00769b83e99970be70fbef03735ff898f4811dd03b9f5ee5 cjson-1.7.18.tar.gz sha256 7fa616e3046edfa7a28a32d5f9eacfd23f92900fe1f8ccd988c1662f30454562 cjson-1.7.19.tar.gz
sha256 a36dda207c36db5818729c54e7ad4e8b0c6fba847491ba64f372c1a2037b6d5c LICENSE sha256 a36dda207c36db5818729c54e7ad4e8b0c6fba847491ba64f372c1a2037b6d5c LICENSE

2
package/cjson/cjson.mk
View File

@@ -4,7 +4,7 @@
# #
################################################################################ ################################################################################
CJSON_VERSION = 1.7.18 CJSON_VERSION = 1.7.19
CJSON_SITE = $(call github,DaveGamble,cjson,v$(CJSON_VERSION)) CJSON_SITE = $(call github,DaveGamble,cjson,v$(CJSON_VERSION))
CJSON_INSTALL_STAGING = YES CJSON_INSTALL_STAGING = YES
CJSON_LICENSE = MIT CJSON_LICENSE = MIT