f77fb7b585
Fixes the following security issues: CVE-2017-12858: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors. CVE-2017-14107: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive. For more details, see https://blogs.gentoo.org/ago/2017/09/01/libzip-use-after-free-in-_zip_buffer_free-zip_buffer-c/ https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ libzip-1.3.0 also adds optional bzip2 support, so handle that. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
23 lines
573 B
Makefile
23 lines
573 B
Makefile
################################################################################
|
|
#
|
|
# libzip
|
|
#
|
|
################################################################################
|
|
|
|
LIBZIP_VERSION = 1.3.0
|
|
LIBZIP_SITE = http://www.nih.at/libzip
|
|
LIBZIP_SOURCE = libzip-$(LIBZIP_VERSION).tar.xz
|
|
LIBZIP_LICENSE = BSD-3-Clause
|
|
LIBZIP_LICENSE_FILES = LICENSE
|
|
LIBZIP_INSTALL_STAGING = YES
|
|
LIBZIP_DEPENDENCIES = zlib
|
|
|
|
ifeq ($(BR2_PACKAGE_BZIP2),y)
|
|
LIBZIP_CONF_OPTS += --with-bzip2
|
|
LIBZIP_DEPENDENCIES += bzip2
|
|
else
|
|
LIBZIP_CONF_OPTS += --without-bzip2
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|