mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 07:51:59 -09:00
9c9c531d0b
The commit [1] introduced fixes for the following CVEs: - CVE-2017-8372: The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b, if NDEBUG is omitted, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted audio file. - CVE-2017-8373: The mad_layer_III function in layer3.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted audio file. - CVE-2017-8374: The mad_bit_skip function in bit.c in Underbit MAD libmad 0.15.1b allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted audio file. In commit [2], the patches ended up not being applied anymore because the APPLY_PATCHES step was called before the patch content exists. This commit import the fixes in Buildroot. [1]858df3643fpackage/libmad: switch to debian to fix CVEs [2]b21184a877package/libmad: update the patches to be applied with fuzz 0 Signed-off-by: Thomas Perale <thomas.perale@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
48 lines
1.6 KiB
Makefile
48 lines
1.6 KiB
Makefile
################################################################################
|
|
#
|
|
# libmad
|
|
#
|
|
################################################################################
|
|
|
|
LIBMAD_VERSION = 0.15.1b
|
|
LIBMAD_SOURCE = libmad_$(LIBMAD_VERSION).orig.tar.gz
|
|
LIBMAD_SITE = \
|
|
http://snapshot.debian.org/archive/debian/20190310T213528Z/pool/main/libm/libmad
|
|
LIBMAD_INSTALL_STAGING = YES
|
|
LIBMAD_LICENSE = GPL-2.0+
|
|
LIBMAD_LICENSE_FILES = COPYING
|
|
|
|
# 0004-md_size.patch
|
|
LIBMAD_IGNORE_CVES += CVE-2017-8372 CVE-2017-8373
|
|
|
|
# 0005-length-check.patch
|
|
LIBMAD_IGNORE_CVES += CVE-2017-8374
|
|
|
|
# Force autoreconf to be able to use a more recent libtool script, that
|
|
# is able to properly behave in the face of a missing C++ compiler.
|
|
LIBMAD_AUTORECONF = YES
|
|
|
|
# libmad has some assembly function that is not present in Thumb mode:
|
|
# Error: selected processor does not support `smull r6,r7,r3,r1' in Thumb mode
|
|
# so, we deactivate Thumb mode
|
|
ifeq ($(BR2_ARM_INSTRUCTIONS_THUMB),y)
|
|
LIBMAD_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -marm"
|
|
endif
|
|
|
|
define LIBMAD_INSTALL_STAGING_PC
|
|
$(INSTALL) -D package/libmad/mad.pc \
|
|
$(STAGING_DIR)/usr/lib/pkgconfig/mad.pc
|
|
endef
|
|
|
|
LIBMAD_POST_INSTALL_STAGING_HOOKS += LIBMAD_INSTALL_STAGING_PC
|
|
|
|
LIBMAD_CONF_OPTS = \
|
|
--disable-debugging \
|
|
$(if $(BR2_PACKAGE_LIBMAD_OPTIMIZATION_SPEED),--enable-speed) \
|
|
$(if $(BR2_PACKAGE_LIBMAD_OPTIMIZATION_ACCURACY),--enable-accuracy) \
|
|
--$(if $(BR2_PACKAGE_LIBMAD_SSO),enable,disable)-sso \
|
|
--$(if $(BR2_PACKAGE_LIBMAD_ASO),enable,disable)-aso \
|
|
--$(if $(BR2_PACKAGE_LIBMAD_STRICT_ISO),enable,disable)-strict-iso
|
|
|
|
$(eval $(autotools-package))
|