f44ee51eb9
At the moment, package stats indicates that libmpeg2 is affected by
https://nvd.nist.gov/vuln/detail/CVE-2022-37416
However, this CVE applies to a completely different piece of software,
that has the same name "libmpeg2" [1].
To avoid the confusion, let's add a proper CPE vendor to Buildroot's libmpeg2.
The library itself does not clearly identify any vendor name, and there isn't
any existing CPE on the NVD website. Since this library is not updated for
many years (maybe even before the introduction of the CPE system), but the
code is somehow related to the Videolan project, let's add this as the
vendor, which sould solve the matched CVE issue.
[1] https://github.com/ittiam-systems/libmpeg2
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: fix typo in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 585ee147dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
39 lines
1.2 KiB
Makefile
39 lines
1.2 KiB
Makefile
################################################################################
|
|
#
|
|
# libmpeg2
|
|
#
|
|
################################################################################
|
|
|
|
LIBMPEG2_VERSION = 0.5.1
|
|
# Gitlab repository does not have a 0.5.1 git tag,
|
|
# use the corresponding commit sha instead
|
|
LIBMPEG2_VERSION_SHA = 41f78cf4d30d0da0a24c8ecbc38b0c9dfd43f871
|
|
LIBMPEG2_SOURCE = libmpeg2-v$(LIBMPEG2_VERSION_SHA).tar.gz
|
|
LIBMPEG2_SITE = https://code.videolan.org/videolan/libmpeg2/-/archive/$(LIBMPEG2_VERSION_SHA)
|
|
LIBMPEG2_LICENSE = GPL-2.0+
|
|
LIBMPEG2_LICENSE_FILES = COPYING
|
|
LIBMPEG2_INSTALL_STAGING = YES
|
|
LIBMPEG2_AUTORECONF = YES
|
|
LIBMPEG2_CONF_OPTS = --without-x --disable-directx
|
|
|
|
LIBMPEG2_CPE_ID_VENDOR = videolan
|
|
|
|
ifeq ($(BR2_PACKAGE_SDL),y)
|
|
LIBMPEG2_CONF_ENV += ac_cv_prog_SDLCONFIG=$(STAGING_DIR)/usr/bin/sdl-config
|
|
LIBMPEG2_CONF_OPTS += --enable-sdl
|
|
LIBMPEG2_DEPENDENCIES += sdl
|
|
else
|
|
LIBMPEG2_CONF_OPTS += --disable-sdl
|
|
endif
|
|
|
|
ifneq ($(BR2_PACKAGE_LIBMPEG2_BINS),y)
|
|
define LIBMPEG2_REMOVE_BINS
|
|
rm -f $(addprefix $(TARGET_DIR)/usr/bin/,\
|
|
mpeg2dec corrupt_mpeg2 extract_mpeg2)
|
|
endef
|
|
|
|
LIBMPEG2_POST_INSTALL_TARGET_HOOKS += LIBMPEG2_REMOVE_BINS
|
|
endif
|
|
|
|
$(eval $(autotools-package))
|