mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-25 11:30:37 -09:00
11f509d1d2
- CVE-2026-41254:
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in
cmslut.c because the overflow check is performed after the
multiplication.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-41254
- da6110b1d1
- e0641b1828
- CVE-2026-42798:
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer
overflow in ParseCube in cmscgats.c.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42798
- 6a68601982
(cherry picked from commit c409050184)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
40 lines
1.0 KiB
Makefile
40 lines
1.0 KiB
Makefile
################################################################################
|
|
#
|
|
# lcms2
|
|
#
|
|
################################################################################
|
|
|
|
LCMS2_VERSION = 2.16
|
|
LCMS2_SITE = http://downloads.sourceforge.net/project/lcms/lcms/$(LCMS2_VERSION)
|
|
LCMS2_LICENSE = MIT
|
|
LCMS2_LICENSE_FILES = LICENSE
|
|
LCMS2_CPE_ID_VENDOR = littlecms
|
|
LCMS2_CPE_ID_PRODUCT = little_cms
|
|
LCMS2_INSTALL_STAGING = YES
|
|
# tiff is only used by tificc sample
|
|
LCMS2_CONF_OPTS = --without-tiff
|
|
|
|
# 0001-Fix-integer-overflow-in-CubeSize.patch
|
|
# 0002-check-overflow.patch
|
|
LCMS2_IGNORE_CVES += CVE-2026-41254
|
|
|
|
# 0003-Fix-for-ParseCube-integer-overflow-in-LUT-allocation.patch
|
|
LCMS2_IGNORE_CVES += CVE-2026-42798
|
|
|
|
ifeq ($(BR2_PACKAGE_JPEG),y)
|
|
LCMS2_CONF_OPTS += --with-jpeg
|
|
LCMS2_DEPENDENCIES += jpeg
|
|
else
|
|
LCMS2_CONF_OPTS += --without-jpeg
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
LCMS2_CONF_OPTS += --with-zlib
|
|
LCMS2_DEPENDENCIES += zlib
|
|
else
|
|
LCMS2_CONF_OPTS += --without-zlib
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|
|
$(eval $(host-autotools-package))
|