kumquat-buildroot/package/minizip-zlib/minizip-zlib.mk
Fabrice Fontaine de7bc4ada2 package/minizip-zlib: fix CVE-2023-45853
MiniZip in zlib through 1.3 has an integer overflow and resultant
heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long
filename, comment, or extra field. NOTE: MiniZip is not a supported part
of the zlib product.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:16:46 +02:00

23 lines
806 B
Makefile

################################################################################
#
# minizip-zlib
#
################################################################################
MINIZIP_ZLIB_VERSION = 1.3
MINIZIP_ZLIB_SOURCE = zlib-$(MINIZIP_ZLIB_VERSION).tar.xz
MINIZIP_ZLIB_SITE = http://www.zlib.net
MINIZIP_ZLIB_LICENSE = Zlib
MINIZIP_ZLIB_LICENSE_FILES = LICENSE
MINIZIP_ZLIB_INSTALL_STAGING = YES
MINIZIP_ZLIB_SUBDIR = contrib/minizip
# configure is not shipped in contrib/minizip
MINIZIP_ZLIB_AUTORECONF = YES
MINIZIP_ZLIB_DEPENDENCIES = zlib
# demos must be disabled to avoid a conflict with BR2_PACKAGE_MINIZIP_DEMOS
MINIZIP_ZLIB_CONF_OPTS = --disable-demos
# 0001-Reject-overflows-of-zip-header-fields-in-minizip.patch
MINIZIP_ZLIB_IGNORE_CVES += CVE-2023-45853
$(eval $(autotools-package))