diff options
| author | Baruch Siach <baruch@tkos.co.il> | 2016-11-10 19:54:39 +0200 |
|---|---|---|
| committer | Thomas Petazzoni <thomas.petazzoni@free-electrons.com> | 2016-11-11 15:07:43 +0100 |
| commit | 7a21e6e9e3095197267d11c0844e94d648d5f379 (patch) | |
| tree | bf738cd2fc88dcd3981de078adc0c5f88a70af34 /package/jasper/jasper.mk | |
| parent | 4f04be1659f186765f506c68f5bfbf6845fc40dc (diff) | |
jasper: security bump to version 1.900.22
Fixes:
CVE-2016-8693: Double free vulnerability in mem_close
CVE-2016-8692: Divide by zero in jpc_dec_process_siz
CVE-2016-8691: Divide by zero in jpc_dec_process_siz
CVE-2016-8690: Null pointer dereference in bmp_getdata triggered by crafted
BMP image
CVE-2016-2089: matrix rows_ NULL pointer dereference in jas_matrix_clip()
CVE-2016-8886: memory allocation failure in jas_malloc
CVE-2016-8887: Null pointer dereference in jp2_colr_destroy
CVE-2016-8884, CVE-2016-8885: Null pointer dereference in bmp_getdata
(incomplete fix for CVE-2016-8690)
CVE-2016-8880: Heap buffer overflow in jpc_dec_cp_setfromcox()
CVE-2016-8881: Heap buffer overflow in jpc_getuint16()
CVE-2016-8882: Null pointer access in jpc_pi_destroy
CVE-2016-8883: Assert in jpc_dec_tiledecode()
Drop upstream patches.
Change SITE to the official download location, since the current one does not
have the updated version. Unfortunately, the official site only offers tar.gz.
Fix license. It is "based on the MIT license", but not exactly the same
(http://www.ece.uvic.ca/~frodo/jasper/; under "Legal Issues").
Drop autoreconf; the autotools version has been updated since commit
324ccec90d (jasper: autoreconf to fix rpath issue) that introduced it.
Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Diffstat (limited to 'package/jasper/jasper.mk')
| -rw-r--r-- | package/jasper/jasper.mk | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/package/jasper/jasper.mk b/package/jasper/jasper.mk index db86ae88e..4616fed18 100644 --- a/package/jasper/jasper.mk +++ b/package/jasper/jasper.mk @@ -4,15 +4,12 @@ # ################################################################################ -JASPER_VERSION = 1.900.1 -JASPER_SITE = http://sources.openelec.tv/devel -JASPER_SOURCE = jasper-$(JASPER_VERSION).tar.bz2 +JASPER_VERSION = 1.900.22 +JASPER_SITE = http://www.ece.uvic.ca/~frodo/jasper/software JASPER_INSTALL_STAGING = YES JASPER_DEPENDENCIES = jpeg -JASPER_LICENSE = MIT +JASPER_LICENSE = JasPer License Version 2.0 JASPER_LICENSE_FILES = LICENSE -# needed to fix rpath issue (http://autobuild.buildroot.net/results/307/307cac65287420252a5bb64715d9a1edd90e72fa/) -JASPER_AUTORECONF = YES # Xtensa gcc is unable to generate correct code with -O0 enabled by # --enable-debug. Allow package build but disable debug. |