91895774f8
This fixes the following CVEs:
- CVE-2025-5914
Libarchive: double free at archive_read_format_rar_seek_data()
in archive_read_support_format_rar.c
https://www.cve.org/CVERecord?id=CVE-2025-5914
- CVE-2025-5915
Libarchive: heap buffer over read in copy_from_lzss_window()
at archive_read_support_format_rar.c
https://www.cve.org/CVERecord?id=CVE-2025-5915
- CVE-2025-5916
Libarchive: integer overflow while reading warc files
at archive_read_support_format_warc.c
https://www.cve.org/CVERecord?id=CVE-2025-5916
- CVE-2025-5917
Libarchive: off by one error in build_ustar_entry_name()
at archive_write_set_format_pax.c
https://www.cve.org/CVERecord?id=CVE-2025-5917
- CVE-2025-5918
Libarchive: reading past eof may be triggered for piped file streams
https://www.cve.org/CVERecord?id=CVE-2025-5918
See the release notes:
- https://github.com/libarchive/libarchive/releases/tag/v3.8.0
- https://github.com/libarchive/libarchive/releases/tag/v3.8.1
In addition to the version bump, the following changes are required:
- The COPYING file has been edited upstream because of filename change on a
sub-licensed component; see
c26f037745
- The upstream "sha256sums" is currently unavailable, so the archive checksum
has been computed locally
- Drop patches for libiconv in configure.ac, which has been properly addressed
upstream in https://github.com/libarchive/libarchive/pull/2611
- Following the above, AUTORECONF is not needed any longer
- Drop mbedtls patch that has been applied upstream
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 95db5707df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
171 lines
3.9 KiB
Makefile
171 lines
3.9 KiB
Makefile
################################################################################
|
|
#
|
|
# libarchive
|
|
#
|
|
################################################################################
|
|
|
|
LIBARCHIVE_VERSION = 3.8.1
|
|
LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz
|
|
LIBARCHIVE_SITE = https://www.libarchive.de/downloads
|
|
LIBARCHIVE_INSTALL_STAGING = YES
|
|
LIBARCHIVE_LICENSE = BSD-2-Clause, BSD-3-Clause, CC0-1.0, OpenSSL, Apache-2.0
|
|
LIBARCHIVE_LICENSE_FILES = COPYING
|
|
LIBARCHIVE_CPE_ID_VENDOR = libarchive
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDTAR),y)
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdtar=static
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdtar=shared
|
|
endif
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-bsdtar
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDCPIO),y)
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdcpio=static
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdcpio=shared
|
|
endif
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-bsdcpio
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDCAT),y)
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdcat=static
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdcat=shared
|
|
endif
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-bsdcat
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDUNZIP),y)
|
|
ifeq ($(BR2_STATIC_LIBS),y)
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdunzip=static
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --enable-bsdunzip=shared
|
|
endif
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-bsdunzip
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ACL),y)
|
|
LIBARCHIVE_DEPENDENCIES += acl
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-acl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ATTR),y)
|
|
LIBARCHIVE_DEPENDENCIES += attr
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --disable-xattr
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_BZIP2),y)
|
|
LIBARCHIVE_CONF_OPTS += --with-bz2lib
|
|
LIBARCHIVE_DEPENDENCIES += bzip2
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-bz2lib
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_EXPAT),y)
|
|
LIBARCHIVE_DEPENDENCIES += expat
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-expat
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBICONV),y)
|
|
LIBARCHIVE_DEPENDENCIES += libiconv
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-libiconv-prefix
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LIBXML2),y)
|
|
LIBARCHIVE_DEPENDENCIES += libxml2
|
|
LIBARCHIVE_CONF_ENV += XML2_CONFIG=$(STAGING_DIR)/usr/bin/xml2-config
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-xml2
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LZ4),y)
|
|
LIBARCHIVE_CONF_OPTS += --with-lz4
|
|
LIBARCHIVE_DEPENDENCIES += lz4
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-lz4
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_LZO),y)
|
|
LIBARCHIVE_DEPENDENCIES += lzo
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-lzo2
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_MBEDTLS),y)
|
|
LIBARCHIVE_DEPENDENCIES += mbedtls
|
|
LIBARCHIVE_CONF_OPTS += --with-mbedtls
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-mbedtls
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_NETTLE),y)
|
|
LIBARCHIVE_DEPENDENCIES += nettle
|
|
LIBARCHIVE_CONF_OPTS += --with-nettle
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-nettle
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_OPENSSL),y)
|
|
LIBARCHIVE_DEPENDENCIES += openssl
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-openssl
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZLIB),y)
|
|
LIBARCHIVE_DEPENDENCIES += zlib
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-zlib
|
|
endif
|
|
|
|
# libarchive requires LZMA with thread support in the toolchain
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_THREADS)$(BR2_PACKAGE_XZ),yy)
|
|
LIBARCHIVE_DEPENDENCIES += xz
|
|
LIBARCHIVE_CONF_OPTS += --with-lzma
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-lzma
|
|
endif
|
|
|
|
ifeq ($(BR2_PACKAGE_ZSTD),y)
|
|
LIBARCHIVE_DEPENDENCIES += zstd
|
|
LIBARCHIVE_CONF_OPTS += --with-zstd
|
|
else
|
|
LIBARCHIVE_CONF_OPTS += --without-zstd
|
|
endif
|
|
|
|
# The only user of host-libarchive needs zlib support
|
|
HOST_LIBARCHIVE_DEPENDENCIES = host-zlib
|
|
# needed for autoreconf
|
|
HOST_LIBARCHIVE_DEPENDENCIES += host-pkgconf
|
|
HOST_LIBARCHIVE_CONF_OPTS = \
|
|
--disable-bsdtar \
|
|
--disable-bsdcpio \
|
|
--disable-bsdcat \
|
|
--disable-acl \
|
|
--disable-xattr \
|
|
--without-bz2lib \
|
|
--without-expat \
|
|
--without-libiconv-prefix \
|
|
--without-xml2 \
|
|
--without-lz4 \
|
|
--without-lzo2 \
|
|
--without-mbedtls \
|
|
--without-nettle \
|
|
--without-openssl \
|
|
--without-lzma \
|
|
--without-zstd
|
|
|
|
$(eval $(autotools-package))
|
|
$(eval $(host-autotools-package))
|