openRuyi-tutorials/buildroot
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
81,471 Commits 2 Branches 459 Tags
master
Commit Graph
41 Commits
Author SHA1 Message Date
Peter Korsgaard a93602c00b package/cjson: security bump to version 1.7.19 
Fixes the following security issue:

CVE-2025-57052: cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via
the decode_array_index_from_pointer function in cJSON_Utils.c, allowing
remote attackers to bypass array bounds checking and access restricted data
via malformed JSON pointer strings containing alphanumeric characters

https://nvd.nist.gov/vuln/detail/CVE-2025-57052
https://x-0r.com/posts/cJSON-Array-Index-Parsing-Vulnerability
https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa4139126967f6d289b675b4b36fef
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.19

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
 2025-09-16 20:50:59 +02:00
Fabrice Fontaine 0c091c15ea package/cjson: security bump to version 1.7.18 
Add NULL check to cJSON_SetValuestring() (CVE-2024-31755)

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.18

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-05-14 23:01:04 +02:00
Fabrice Fontaine 449538348e package/cjson: security bump to version 1.7.17 
- Fix null reference in cJSON_SetValuestring (CVE-2023-50472)
- Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471)

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:09 +01:00
Fabrice Fontaine 654f18c617 package/cjson: bump to version 1.7.16 
https://github.com/DaveGamble/cJSON/releases/tag/v1.7.16

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-10-28 22:50:10 +02:00
Fabrice Fontaine edcf8b6d5f package/cjson: bump to version 1.7.15 
Fixes:
- Fix potential core dumped for strrchr
- Fix null pointer crash in cJSON_CreateXxArray
- Fix several null pointer problems on allocation failure
- Fix a possible dereference of null pointer

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.15

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
 2021-08-26 22:53:21 +02:00
Peter Seiderer 8b16476e80 package/cjson: bump version to 1.7.14 
Changelog ([1]):

  1.7.14 (Sep 3, 2020)
  Fixes:
    optimize the way to find tail node, see #503
    Fix WError error on macosx because NAN is a float. Thanks @sappo, see #484
    Fix some bugs in detach and replace. Thanks @miaoerduo, see #456

[1] https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2021-03-14 11:59:09 +01:00
Fabrice Fontaine d7ce1d034d package/cjson: bump to version 1.7.13 
Update indentation of hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2020-04-02 21:45:16 +02:00
Victor Huesca 69808c7536 package: remove 'v' prefix from github-fetched packages 
On Github, a large number of projects name their tag vXYZ (i.e v3.0,
v0.1, etc.). In some packages we do:

 <pkg>_VERSION = v0.3
 <pkg>_SITE = $(call github foo,bar,$(<pkg>_VERSION))

And in some other packages we do:

 <pkg>_VERSION = 0.3
 <pkg>_SITE = $(call github foo,bar,v$(<pkg>_VERSION))

I.e in one case we consider the version to be v0.3, in the other case
we consider 0.3 to be the version.

The problem with v0.3 is that when used in conjunction with
release-monitoring.org, it doesn't work very well, because
release-monitoring.org has the concept of "version prefix" and using
that they drop the "v" prefix for the version.

Therefore, a number of packages in Buildroot have a version that
doesn't match with release-monitoring.org because Buildroot has 'v0.3'
and release-monitoring.org has '0.3'.

Since really the version number of 0.3, is makes sense to update our
packages to drop this 'v'.

This commit only addresses the (common) case of github packages where
the prefix is simply 'v'. Other cases will be handled by separate
commits. Also, there are a few cases that couldn't be handled
mechanically that aren't covered by this commit.

Signed-off-by: Victor Huesca <victor.huesca@bootlin.com>
[Arnout: don't change flatbuffers, json-for-modern-cpp, libpagekite,
 python-scapy3k, softether]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
 2019-06-19 22:27:55 +02:00
Fabrice Fontaine 2ee83e0b1a package/cjson: security bump to version 1.7.12 
Fix infinite loop in cJSON_Minify (potential Denial of Service), see
https://github.com/DaveGamble/cJSON/issues/354

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2019-05-18 18:24:17 +02:00
Fabrice Fontaine a45a3997d8 package/cjson: security bump to version 1.7.11 
Fix a bug where cJSON_Minify could overflow it's buffer, both reading
and writing: https://github.com/DaveGamble/cJSON/issues/338.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2019-04-15 21:40:14 +02:00
Fabrice Fontaine 397bb048d5 package/cjson: bump to version 1.7.10 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2019-01-13 14:15:21 +01:00
Fabrice Fontaine 2c57dc0469 cjson: bump to version 1.7.7 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2018-05-25 16:22:11 +02:00
Fabrice Fontaine eed67b2c6b cjson: bump to version 1.7.6 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2018-04-15 20:36:51 +02:00
Fabrice Fontaine 8625eca940 cjson: bump to version 1.7.5 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2018-03-29 16:05:54 +02:00
Fabrice Fontaine b405d31b48 cjson: bump to version 1.7.4 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2018-03-05 21:13:34 +01:00
Fabrice Fontaine 1063e9ef80 cjson: bump to version 1.7.3 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2018-02-14 21:43:16 +01:00
Fabrice Fontaine 73569ed6f8 cjson: bump to version 1.7.2 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2018-02-08 23:07:02 +01:00
Fabrice Fontaine bdfb180d58 cjson: bump to version 1.7.1 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2018-01-12 19:54:31 +01:00
Matt Weber b6314a1811 cjson: update LICENSE hash for 1.7.0 
No change to the contents but indentation.

Fixes:
http://autobuild.buildroot.net/results/626/626f01bb2e769914d471e70665f7f2909e1f5fe2/

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2018-01-07 23:47:45 +01:00
Fabrice Fontaine 579b87423f cjson: bump to version 1.7.0 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2018-01-07 15:05:07 +01:00
Fabrice Fontaine 8e5aefed8b cjson: add hash for license file 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-12-03 00:00:55 +01:00
Fabrice Fontaine 6c306f675f cjson: bump to version 1.6.0 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-10-31 20:09:53 +01:00
Fabrice Fontaine d60315ef39 cjson: bump to version 1.5.6 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-07-06 23:21:19 +02:00
Fabrice Fontaine 37ce45f1cc cjson: bump to version 1.5.5 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-06-17 15:38:25 +02:00
Bernd Kuhls c5e7405009 package/cjson: bump version to v1.5.3 
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-05-24 16:01:56 +02:00
Vicente Olivert Riera 6a72aea616 cjson: bump version to v1.5.2 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-05-10 23:44:31 +02:00
Vicente Olivert Riera 148b1c4cee cjson: bump version to 1.5.1 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-05-08 21:00:02 +02:00
Vicente Olivert Riera da0cc47c6f cjson: bump version to v1.4.7 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-04-20 23:12:56 +02:00
Vicente Olivert Riera 5380e6996f cjson: bump version to v1.4.6 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-04-12 23:00:12 +02:00
Vicente Olivert Riera 1e5085f9ba cjson: bump version to v1.4.5 
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-03-29 21:51:25 +02:00
Fabrice Fontaine a655a74d1a cjson: bump to version 1.4.4 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-03-25 14:37:09 +01:00
Fabrice Fontaine a521a33799 cjson: bump to version 1.4.3 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-03-20 21:56:29 +01:00
Fabrice Fontaine d8972e4fe7 cjson: bump to version 1.4.2 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-03-17 22:36:40 +01:00
Fabrice Fontaine 81f55e4309 cjson: bump to version 1.4.0 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-03-06 21:22:35 +01:00
Fabrice Fontaine 27f17ace1b cjson: bump to version 1.3.2 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2017-03-01 21:50:06 +01:00
Fabrice Fontaine 5e5219b84d cjson: bump to version 1.3.0 
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-02-19 23:01:20 +01:00
Vicente Olivert Riera 130b9dcea1 cjson: security bump to version v1.2.1 
Fixes a potential NULL pointer dereference in
cJSONUtils_InplaceDecodePointerString():

https://github.com/DaveGamble/cJSON/issues/96

[Peter: extend commit message, mention (potential) security impact]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-01-31 23:48:32 +01:00
Vicente Olivert Riera 8cd0f493d6 cjson: bump version to v1.2.0 
Also remove the patch since it's already contained in this release.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2017-01-09 15:08:19 +01:00
Fabrice Fontaine 4f11de1a60 cjson: fix error with sh4a and powerpc 
Fixes:
 - http://autobuild.buildroot.net/results/3d899790acdc5c21733ff6f7f5a1b500e862ea0a

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2016-12-15 22:10:30 +01:00
Fabrice Fontaine 190c5117c0 cjson: bump to version 1.1.0 
Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2016-12-10 09:11:02 +01:00
Fabrice Fontaine c8824a428b cjson: bump to version v1.0.2 
This is a major update in cjson:
 - project site moved from sourceforge to github
 - project recommends to use the new cmake buildsystem instead of the
   legacy make
 - BR2_STATIC_LIBS is now OK (README does not mention issue anymore)
 - As include path and library name have changed, tinycbor has to be
   updated
 - As cjson can now be built as a static library, fix a bug in
   json2cbor compilation from tinycbor package

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
 2016-12-04 15:40:07 +01:00