mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-08 23:51:08 -09:00
e6423ca550
Fixes the following security issue: CVE-2025-57052: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters https://nvd.nist.gov/vuln/detail/CVE-2025-57052 https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability74e1ff4994https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19 Signed-off-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Julien Olivain <ju.o@free.fr> (cherry picked from commita93602c00b) Signed-off-by: Thomas Perale <thomas.perale@mind.be>
35 lines
1.0 KiB
Makefile
35 lines
1.0 KiB
Makefile
################################################################################
|
|
#
|
|
# cjson
|
|
#
|
|
################################################################################
|
|
|
|
CJSON_VERSION = 1.7.19
|
|
CJSON_SITE = $(call github,DaveGamble,cjson,v$(CJSON_VERSION))
|
|
CJSON_INSTALL_STAGING = YES
|
|
CJSON_LICENSE = MIT
|
|
CJSON_LICENSE_FILES = LICENSE
|
|
CJSON_CPE_ID_VENDOR = davegamble
|
|
# Set ENABLE_CUSTOM_COMPILER_FLAGS to OFF in particular to disable
|
|
# -fstack-protector-strong which depends on BR2_TOOLCHAIN_HAS_SSP
|
|
CJSON_CONF_OPTS += \
|
|
-DENABLE_CJSON_TEST=OFF \
|
|
-DENABLE_CUSTOM_COMPILER_FLAGS=OFF
|
|
|
|
# If BUILD_SHARED_AND_STATIC_LIBS is set to OFF, cjson uses the
|
|
# standard BUILD_SHARED_LIBS option which is passed by the
|
|
# cmake-package infrastructure.
|
|
ifeq ($(BR2_SHARED_STATIC_LIBS),y)
|
|
CJSON_CONF_OPTS += -DBUILD_SHARED_AND_STATIC_LIBS=ON
|
|
else
|
|
CJSON_CONF_OPTS += -DBUILD_SHARED_AND_STATIC_LIBS=OFF
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_CJSON_UTILS),y)
|
|
CJSON_CONF_OPTS += -DENABLE_CJSON_UTILS=ON
|
|
else
|
|
CJSON_CONF_OPTS += -DENABLE_CJSON_UTILS=OFF
|
|
endif
|
|
|
|
$(eval $(cmake-package))
|