e1af92592e
Fix the following CVEs: - CVE-2019-17533: Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed. - CVE-2019-20017: A stack-based buffer over-read was discovered in Mat_VarReadNextInfo5 in mat5.c in matio 1.5.17. - CVE-2019-20018: A stack-based buffer over-read was discovered in ReadNextCell in mat5.c in matio 1.5.17. - CVE-2019-20020: A stack-based buffer over-read was discovered in ReadNextStructField in mat5.c in matio 1.5.17. - CVE-2019-20052: A memory leak was discovered in Mat_VarCalloc in mat.c in matio 1.5.17 because SafeMulDims does not consider the rank==0 case. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
30 lines
917 B
Makefile
30 lines
917 B
Makefile
################################################################################
|
|
#
|
|
# matio
|
|
#
|
|
################################################################################
|
|
|
|
MATIO_VERSION = 1.5.17
|
|
MATIO_SITE = http://downloads.sourceforge.net/project/matio/matio/$(MATIO_VERSION)
|
|
MATIO_LICENSE = BSD-2-Clause
|
|
MATIO_LICENSE_FILES = COPYING
|
|
MATIO_DEPENDENCIES = zlib
|
|
MATIO_INSTALL_STAGING = YES
|
|
|
|
# 0001-Avoid-uninitialized-memory.patch
|
|
MATIO_IGNORE_CVES += CVE-2019-17533
|
|
# 0002-Fix-illegal-memory-access.patch
|
|
MATIO_IGNORE_CVES += CVE-2019-20017 CVE-2019-20020
|
|
# 0003-Fix-illegal-memory-access.patch
|
|
MATIO_IGNORE_CVES += CVE-2019-20017 CVE-2019-20018
|
|
# 0004-Fix-memory-leak.patch
|
|
MATIO_IGNORE_CVES += CVE-2019-20052
|
|
|
|
# va_copy()
|
|
MATIO_CONF_ENV = ac_cv_va_copy=yes
|
|
|
|
# mat73 require hdf5 (not available), extented-sparse take 2KB
|
|
MATIO_CONF_OPTS = --disable-mat73 --enable-extended-sparse
|
|
|
|
$(eval $(autotools-package))
|