3b645ffda6
Fix CVE-2023-27371: GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHD_create_post_processor() method. This allows an attacker to remotely send a malicious HTTP POST packet that includes one or more '\0' bytes in a multipart/form-data boundary field, which - assuming a specific heap layout - will result in an out-of-bounds read and a crash in the find_boundary() function. https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg00000.html Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
33 lines
1016 B
Makefile
33 lines
1016 B
Makefile
################################################################################
|
|
#
|
|
# libmicrohttpd
|
|
#
|
|
################################################################################
|
|
|
|
LIBMICROHTTPD_VERSION = 0.9.76
|
|
LIBMICROHTTPD_SITE = $(BR2_GNU_MIRROR)/libmicrohttpd
|
|
LIBMICROHTTPD_LICENSE_FILES = COPYING
|
|
LIBMICROHTTPD_CPE_ID_VENDOR = gnu
|
|
LIBMICROHTTPD_INSTALL_STAGING = YES
|
|
LIBMICROHTTPD_CONF_OPTS = --disable-curl --disable-examples
|
|
LIBMICROHTTPD_CFLAGS = $(TARGET_CFLAGS) -std=c99
|
|
|
|
LIBMICROHTTPD_CONF_ENV += CFLAGS="$(LIBMICROHTTPD_CFLAGS)"
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBMICROHTTPD_SSL),y)
|
|
LIBMICROHTTPD_LICENSE = LGPL-2.1+
|
|
LIBMICROHTTPD_DEPENDENCIES += host-pkgconf gnutls
|
|
LIBMICROHTTPD_CONF_OPTS += --enable-https --with-gnutls=$(STAGING_DIR)/usr
|
|
else
|
|
LIBMICROHTTPD_LICENSE = LGPL-2.1+ or eCos
|
|
LIBMICROHTTPD_CONF_OPTS += --disable-https
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
|
|
LIBMICROHTTPD_CONF_OPTS += --with-threads=auto
|
|
else
|
|
LIBMICROHTTPD_CONF_OPTS += --with-threads=none
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|