0a860f21e1
- Switch site to an active fork
- Send patch upstream
- Update indentation in hash file (two spaces)
- Fix the following CVEs:
- CVE-2018-14054: A double free exists in the MP4StringProperty class
in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again
in the destructor once an exception is triggered.
Fixed by
f09cceeee5
- CVE-2018-14325: In MP4v2 2.0.0, there is an integer underflow (with
resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.
Fixed by
e475013c6e
- CVE-2018-14326: In MP4v2 2.0.0, there is an integer overflow (with
resultant memory corruption) when resizing MP4Array for the ftyp
atom in mp4array.h.
Fixed by
70d823ccd8
- CVE-2018-14379: MP4Atom::factory in mp4atom.cpp in MP4v2 2.0.0
incorrectly uses the MP4ItemAtom data type in a certain case where
MP4DataAtom is required, which allows remote attackers to cause a
denial of service (memory corruption) or possibly have unspecified
other impact via a crafted MP4 file, because access to the data
structure has different expectations about layout as a result of
this type confusion.
Fixed by
73f38b4296
- CVE-2018-14403: MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0
mishandles substrings of atom names, leading to use of an
inappropriate data type for associated atoms. The resulting type
confusion can cause out-of-bounds memory access.
Fixed by
51cb6b36f6
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
26 lines
708 B
Makefile
26 lines
708 B
Makefile
################################################################################
|
|
#
|
|
# mp4v2
|
|
#
|
|
################################################################################
|
|
|
|
MP4V2_VERSION = 4.1.3
|
|
MP4V2_SITE = \
|
|
$(call github,TechSmith,mp4v2,Release-ThirdParty-MP4v2-$(MP4V2_VERSION))
|
|
MP4V2_INSTALL_STAGING = YES
|
|
MP4V2_LICENSE = MPL-1.1
|
|
MP4V2_LICENSE_FILES = COPYING
|
|
|
|
# help2man expects to be able to run utilities on the build machine to
|
|
# grab --help output which doesn't work when cross compiling, so
|
|
# disable it
|
|
MP4V2_CONF_ENV = ac_cv_prog_FOUND_HELP2MAN=no
|
|
|
|
ifeq ($(BR2_PACKAGE_MP4V2_UTIL),y)
|
|
MP4V2_CONF_OPTS += --enable-util
|
|
else
|
|
MP4V2_CONF_OPTS += --disable-util
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|