mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
373b98b5a8
Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS
(Denial of Service) due to improper parsing of a multipart/form-data
boundary in the postprocessor.c MHD_create_post_processor() method. This
allows an attacker to remotely send a malicious HTTP POST packet that
includes one or more '\0' bytes in a multipart/form-data boundary field,
which - assuming a specific heap layout - will result in an
out-of-bounds read and a crash in the find_boundary() function.
https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3b645ffda6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
33 lines
1016 B
Makefile
33 lines
1016 B
Makefile
################################################################################
|
|
#
|
|
# libmicrohttpd
|
|
#
|
|
################################################################################
|
|
|
|
LIBMICROHTTPD_VERSION = 0.9.76
|
|
LIBMICROHTTPD_SITE = $(BR2_GNU_MIRROR)/libmicrohttpd
|
|
LIBMICROHTTPD_LICENSE_FILES = COPYING
|
|
LIBMICROHTTPD_CPE_ID_VENDOR = gnu
|
|
LIBMICROHTTPD_INSTALL_STAGING = YES
|
|
LIBMICROHTTPD_CONF_OPTS = --disable-curl --disable-examples
|
|
LIBMICROHTTPD_CFLAGS = $(TARGET_CFLAGS) -std=c99
|
|
|
|
LIBMICROHTTPD_CONF_ENV += CFLAGS="$(LIBMICROHTTPD_CFLAGS)"
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBMICROHTTPD_SSL),y)
|
|
LIBMICROHTTPD_LICENSE = LGPL-2.1+
|
|
LIBMICROHTTPD_DEPENDENCIES += host-pkgconf gnutls
|
|
LIBMICROHTTPD_CONF_OPTS += --enable-https --with-gnutls=$(STAGING_DIR)/usr
|
|
else
|
|
LIBMICROHTTPD_LICENSE = LGPL-2.1+ or eCos
|
|
LIBMICROHTTPD_CONF_OPTS += --disable-https
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
|
|
LIBMICROHTTPD_CONF_OPTS += --with-threads=auto
|
|
else
|
|
LIBMICROHTTPD_CONF_OPTS += --with-threads=none
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|