mirror of
https://git.busybox.net/buildroot.git
synced 2024-11-27 15:33:28 +08:00
26a46564f3
Fix CVE-2020-11105: An issue was discovered in USC iLab cereal through 1.3.0. It employs caching of std::shared_ptr values, using the raw pointer address as a unique identifier. This becomes problematic if an std::shared_ptr variable goes out of scope and is freed, and a new std::shared_ptr is allocated at the same address. Serialization fidelity thereby becomes dependent upon memory layout. In short, serialized std::shared_ptr variables cannot always be expected to serialize back into their original values. This can have any number of consequences, depending on the context within which this manifests. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
23 lines
882 B
Makefile
23 lines
882 B
Makefile
################################################################################
|
|
#
|
|
# cereal
|
|
#
|
|
################################################################################
|
|
|
|
CEREAL_VERSION = 1.3.0
|
|
CEREAL_SITE = $(call github,USCiLab,cereal,v$(CEREAL_VERSION))
|
|
# For licensing, see also: https://github.com/USCiLab/cereal/issues/609
|
|
CEREAL_LICENSE = BSD-3-Clause (cereal), Zlib (base64.hpp), MIT (rapidjson), BSL-1.0 or MIT (rapidxml)
|
|
CEREAL_LICENSE_FILES = LICENSE include/cereal/external/base64.hpp include/cereal/external/rapidjson/rapidjson.h include/cereal/external/rapidxml/license.txt
|
|
CEREAL_CPE_ID_VENDOR = usc
|
|
CEREAL_INSTALL_STAGING = YES
|
|
CEREAL_INSTALL_TARGET = NO
|
|
CEREAL_CONF_OPTS = \
|
|
-DTHREAD_SAFE=ON \
|
|
-DJUST_INSTALL_CEREAL=ON
|
|
|
|
# 0001-Store-a-copy-of-each-serialized-shared_ptr-within-the-archive.patch
|
|
CEREAL_IGNORE_CVES += CVE-2020-11105
|
|
|
|
$(eval $(cmake-package))
|