kumquat-buildroot/package/wavpack/wavpack.mk
Fabrice Fontaine a9bff8a0b0 package/wavpack: fix CVE-2021-44269
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV
files. This issue triggered in function WavpackPackSamples of file
src/pack_utils.c, tainted variable cnt is too large, that makes pointer
sptr read beyond heap bound.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2022-03-18 22:38:07 +01:00

42 lines
1.3 KiB
Makefile

################################################################################
#
# wavpack
#
################################################################################
WAVPACK_VERSION = 5.4.0
WAVPACK_SITE = \
https://github.com/dbry/WavPack/releases/download/$(WAVPACK_VERSION)
WAVPACK_SOURCE = wavpack-$(WAVPACK_VERSION).tar.xz
WAVPACK_INSTALL_STAGING = YES
WAVPACK_DEPENDENCIES = $(if $(BR2_ENABLE_LOCALE),,libiconv)
WAVPACK_LICENSE = BSD-3-Clause
WAVPACK_LICENSE_FILES = COPYING
WAVPACK_CPE_ID_VENDOR = wavpack
# 0001-issue-110-sanitize-DSD-file-types-for-invalid-lengths.patch
WAVPACK_IGNORE_CVES += CVE-2021-44269
ifeq ($(BR2_PACKAGE_LIBICONV),y)
WAVPACK_CONF_OPTS += LIBS=-liconv
endif
ifeq ($(BR2_PACKAGE_OPENSSL),y)
WAVPACK_DEPENDENCIES += openssl
WAVPACK_CONF_OPTS += --enable-libcrypto
else
WAVPACK_CONF_OPTS += --disable-libcrypto
endif
# WavPack "autodetects" CPU type to enable ASM code. However, the assembly code
# for ARM is written for ARMv7 only and building WavPack for an ARM-non-v7
# architecture will fail. We explicitly enable ASM for the supported
# architectures x86, x64 and ARMv7 and disable it for all others.
ifeq ($(BR2_i386)$(BR2_x86_64)$(BR2_ARM_CPU_ARMV7A),y)
WAVPACK_CONF_OPTS += --enable-asm
else
WAVPACK_CONF_OPTS += --disable-asm
endif
$(eval $(autotools-package))