mirror of
https://git.yoctoproject.org/poky
synced 2026-05-02 00:32:12 +02:00
d01be5cf84
This is a read past end of buffer issue in the json_parse test app, which can happened with malformed json data. It's not an issue with the library itself. For what ever reason this CVE has a base score of 9.8. Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-32292 Upstream issue: https://github.com/json-c/json-c/issues/654 The CVE is fixed with version 0.16 (which is already in all active branches of poky). (From OE-Core rev: a7b93651028b55d71b8db53ea831eee7fd539f33) Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
32 lines
1.1 KiB
BlitzBasic
32 lines
1.1 KiB
BlitzBasic
SUMMARY = "C bindings for apps which will manipulate JSON data"
|
|
DESCRIPTION = "JSON-C implements a reference counting object model that allows you to easily construct JSON objects in C."
|
|
HOMEPAGE = "https://github.com/json-c/json-c/wiki"
|
|
LICENSE = "MIT"
|
|
LIC_FILES_CHKSUM = "file://COPYING;md5=de54b60fbbc35123ba193fea8ee216f2"
|
|
|
|
SRC_URI = " \
|
|
https://s3.amazonaws.com/json-c_releases/releases/${BP}.tar.gz \
|
|
file://run-ptest \
|
|
file://CVE-2021-32292.patch \
|
|
"
|
|
|
|
SRC_URI[sha256sum] = "b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6"
|
|
|
|
UPSTREAM_CHECK_URI = "https://github.com/${BPN}/${BPN}/tags"
|
|
UPSTREAM_CHECK_REGEX = "json-c-(?P<pver>\d+(\.\d+)+)-\d+"
|
|
|
|
RPROVIDES:${PN} = "libjson"
|
|
|
|
inherit cmake ptest
|
|
|
|
do_install_ptest() {
|
|
install -d ${D}/${PTEST_PATH}/tests
|
|
install ${B}/tests/test* ${D}/${PTEST_PATH}/tests
|
|
install ${S}/tests/*.test ${D}/${PTEST_PATH}/tests
|
|
install ${S}/tests/*.expected ${D}/${PTEST_PATH}/tests
|
|
install ${S}/tests/test-defs.sh ${D}/${PTEST_PATH}/tests
|
|
install ${S}/tests/valid*json ${D}/${PTEST_PATH}/tests
|
|
}
|
|
|
|
BBCLASSEXTEND = "native nativesdk"
|