7bb7c0a231
Fix the following vulnerability:
- CVE-2025-46688
quickjs-ng through 0.9.0 has an incorrect size calculation in
JS_ReadBigInt for a BigInt, leading to a heap-based buffer overflow.
QuickJS before 2025-04-26 is also affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-46688
- 1eb05e44fa
The patch is different from upstream since the BigInt implementation has
been added post 2024-01-13 (see commit [1]). The BigInt fix has been
stripped out to only keep the buffer overflow in the string
implementation.
On master the following CVE has been addressed with commit [2].
[1] 61e8b94428
[2] c5c7c44fa5 package/quickjs: bump to version 2025-04-26
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
50 lines
1.2 KiB
Makefile
50 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# quickjs
|
|
#
|
|
################################################################################
|
|
|
|
QUICKJS_VERSION = 2024-01-13
|
|
QUICKJS_SOURCE = quickjs-$(QUICKJS_VERSION).tar.xz
|
|
QUICKJS_SITE = https://bellard.org/quickjs
|
|
QUICKJS_LICENSE = MIT
|
|
QUICKJS_LICENSE_FILES = LICENSE
|
|
QUICKJS_CPE_ID_VALID = YES
|
|
QUICKJS_INSTALL_STAGING = YES
|
|
|
|
# 0001-fixed-buffer-overflow-in-bjson-string-and-bigint-reader.patch
|
|
QUICKJS_IGNORE_CVES += CVE-2025-46688
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
|
|
QUICKJS_EXTRA_LIBS += -latomic
|
|
endif
|
|
|
|
define QUICKJS_BUILD_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
|
|
CROSS_PREFIX="$(TARGET_CROSS)" \
|
|
EXTRA_LIBS="$(QUICKJS_EXTRA_LIBS)" \
|
|
all
|
|
endef
|
|
|
|
define QUICKJS_INSTALL_STAGING_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
|
|
CROSS_PREFIX="$(TARGET_CROSS)" \
|
|
EXTRA_LIBS="$(QUICKJS_EXTRA_LIBS)" \
|
|
DESTDIR=$(STAGING_DIR) \
|
|
STRIP=/bin/true \
|
|
PREFIX=/usr \
|
|
install
|
|
endef
|
|
|
|
define QUICKJS_INSTALL_TARGET_CMDS
|
|
$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
|
|
CROSS_PREFIX="$(TARGET_CROSS)" \
|
|
EXTRA_LIBS="$(QUICKJS_EXTRA_LIBS)" \
|
|
DESTDIR=$(TARGET_DIR) \
|
|
STRIP=/bin/true \
|
|
PREFIX=/usr \
|
|
install
|
|
endef
|
|
|
|
$(eval $(generic-package))
|