de7bc4ada2
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
23 lines
806 B
Makefile
23 lines
806 B
Makefile
################################################################################
|
|
#
|
|
# minizip-zlib
|
|
#
|
|
################################################################################
|
|
|
|
MINIZIP_ZLIB_VERSION = 1.3
|
|
MINIZIP_ZLIB_SOURCE = zlib-$(MINIZIP_ZLIB_VERSION).tar.xz
|
|
MINIZIP_ZLIB_SITE = http://www.zlib.net
|
|
MINIZIP_ZLIB_LICENSE = Zlib
|
|
MINIZIP_ZLIB_LICENSE_FILES = LICENSE
|
|
MINIZIP_ZLIB_INSTALL_STAGING = YES
|
|
MINIZIP_ZLIB_SUBDIR = contrib/minizip
|
|
# configure is not shipped in contrib/minizip
|
|
MINIZIP_ZLIB_AUTORECONF = YES
|
|
MINIZIP_ZLIB_DEPENDENCIES = zlib
|
|
# demos must be disabled to avoid a conflict with BR2_PACKAGE_MINIZIP_DEMOS
|
|
MINIZIP_ZLIB_CONF_OPTS = --disable-demos
|
|
# 0001-Reject-overflows-of-zip-header-fields-in-minizip.patch
|
|
MINIZIP_ZLIB_IGNORE_CVES += CVE-2023-45853
|
|
|
|
$(eval $(autotools-package))
|