From 30f6c5ae79407dbbe82f0992c355bd0f9b69a2ad Mon Sep 17 00:00:00 2001 From: Praveen Kumar Date: Fri, 24 Oct 2025 17:25:09 +0530 Subject: cjson: upgrade 1.7.18 -> 1.7.19 This includes CVE-fix for CVE-2023-26819. Removed CVE-2025-57052, as the issue was already resolved in v1.7.19. Changelog: ========== https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md Signed-off-by: Praveen Kumar Signed-off-by: Anuj Mittal --- .../cjson/cjson/CVE-2025-57052.patch | 33 ---------------- meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb | 46 ---------------------- meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb | 45 +++++++++++++++++++++ 3 files changed, 45 insertions(+), 79 deletions(-) delete mode 100644 meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch delete mode 100644 meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb create mode 100644 meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb (limited to 'meta-oe/recipes-devtools') diff --git a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch b/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch deleted file mode 100644 index ed3d4a7eba..0000000000 --- a/meta-oe/recipes-devtools/cjson/cjson/CVE-2025-57052.patch +++ /dev/null @@ -1,33 +0,0 @@ -From e53a1413304382d562176bed91609e00b4fcf87e Mon Sep 17 00:00:00 2001 -From: Lee -Date: Fri, 5 Sep 2025 14:53:20 +0800 -Subject: [PATCH] fix the incorrect check in decode_array_index_from_pointer - (#957) - -this fixes CVE-2025-57052 - -CVE: CVE-2025-57052 -Upstream-Status: Backport [https://github.com/DaveGamble/cJSON/commit/74e1ff4994aa] - -(cherry picked from commit 74e1ff4994aa4139126967f6d289b675b4b36fef) -Signed-off-by: Shubham Pushpkar ---- - cJSON_Utils.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/cJSON_Utils.c b/cJSON_Utils.c -index 63651df..8fa24f8 100644 ---- a/cJSON_Utils.c -+++ b/cJSON_Utils.c -@@ -282,7 +282,7 @@ static cJSON_bool decode_array_index_from_pointer(const unsigned char * const po - return 0; - } - -- for (position = 0; (pointer[position] >= '0') && (pointer[0] <= '9'); position++) -+ for (position = 0; (pointer[position] >= '0') && (pointer[position] <= '9'); position++) - { - parsed_index = (10 * parsed_index) + (size_t)(pointer[position] - '0'); - --- -2.44.1 - diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb deleted file mode 100644 index 67d536cf24..0000000000 --- a/meta-oe/recipes-devtools/cjson/cjson_1.7.18.bb +++ /dev/null @@ -1,46 +0,0 @@ -DESCRIPTION = "Ultralightweight JSON parser in ANSI C" -HOMEPAGE = "https://github.com/DaveGamble/cJSON" -SECTION = "libs" -LICENSE = "MIT" -LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0" - -SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \ - file://run-ptest \ - file://CVE-2025-57052.patch \ - " -SRCREV = "acc76239bee01d8e9c858ae2cab296704e52d916" - -S = "${WORKDIR}/git" - -inherit cmake pkgconfig ptest - -RDEPENDS:${PN}-ptest += "cmake" - -do_install_ptest() { - # create directories - install -d ${D}${PTEST_PATH} ${D}${PTEST_PATH}/tests ${D}${PTEST_PATH}/fuzzing - install -d ${D}${PTEST_PATH}/tests/inputs ${D}${PTEST_PATH}/tests/json-patch-tests - # CTestTestfiles.cmake contain fully defined path generated by cmake. - # Change the fully defined path to ptest path on the target - sed s#${B}#${PTEST_PATH}# ${B}/CTestTestfile.cmake > ${D}${PTEST_PATH}/CTestTestfile.cmake - sed s#${B}#${PTEST_PATH}# ${B}/tests/CTestTestfile.cmake > ${D}${PTEST_PATH}/tests/CTestTestfile.cmake - sed s#${B}#${PTEST_PATH}# ${B}/fuzzing/CTestTestfile.cmake > ${D}${PTEST_PATH}/fuzzing/CTestTestfile.cmake - # The cmake files also contain full paths to original CMakeLists.txt file in _BACKTRACE_TRIPLES property; - # these are not needed for successful ptests as we don't install the CMakeLists.txt files anyway. - sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/CTestTestfile.cmake - sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/tests/CTestTestfile.cmake - sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/fuzzing/CTestTestfile.cmake - # install test artifacts - install ${B}/cJSON_test ${D}${PTEST_PATH} - install ${B}/tests/cjson_add ${B}/tests/*_tests ${B}/tests/parse_* ${B}/tests/print_* ${B}/tests/readme_examples ${D}${PTEST_PATH}/tests/ - install ${B}/tests/inputs/* ${D}${PTEST_PATH}/tests/inputs - install ${B}/fuzzing/fuzz_main ${D}${PTEST_PATH}/fuzzing -} - -EXTRA_OECMAKE += "\ - -DENABLE_CJSON_UTILS=On \ - -DENABLE_CUSTOM_COMPILER_FLAGS=OFF \ - -DBUILD_SHARED_AND_STATIC_LIBS=On \ -" - -BBCLASSEXTEND = "native nativesdk" diff --git a/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb new file mode 100644 index 0000000000..799eb119d6 --- /dev/null +++ b/meta-oe/recipes-devtools/cjson/cjson_1.7.19.bb @@ -0,0 +1,45 @@ +DESCRIPTION = "Ultralightweight JSON parser in ANSI C" +HOMEPAGE = "https://github.com/DaveGamble/cJSON" +SECTION = "libs" +LICENSE = "MIT" +LIC_FILES_CHKSUM = "file://LICENSE;md5=218947f77e8cb8e2fa02918dc41c50d0" + +SRC_URI = "git://github.com/DaveGamble/cJSON.git;branch=master;protocol=https \ + file://run-ptest \ + " +SRCREV = "c859b25da02955fef659d658b8f324b5cde87be3" + +S = "${WORKDIR}/git" + +inherit cmake pkgconfig ptest + +RDEPENDS:${PN}-ptest += "cmake" + +do_install_ptest() { + # create directories + install -d ${D}${PTEST_PATH} ${D}${PTEST_PATH}/tests ${D}${PTEST_PATH}/fuzzing + install -d ${D}${PTEST_PATH}/tests/inputs ${D}${PTEST_PATH}/tests/json-patch-tests + # CTestTestfiles.cmake contain fully defined path generated by cmake. + # Change the fully defined path to ptest path on the target + sed s#${B}#${PTEST_PATH}# ${B}/CTestTestfile.cmake > ${D}${PTEST_PATH}/CTestTestfile.cmake + sed s#${B}#${PTEST_PATH}# ${B}/tests/CTestTestfile.cmake > ${D}${PTEST_PATH}/tests/CTestTestfile.cmake + sed s#${B}#${PTEST_PATH}# ${B}/fuzzing/CTestTestfile.cmake > ${D}${PTEST_PATH}/fuzzing/CTestTestfile.cmake + # The cmake files also contain full paths to original CMakeLists.txt file in _BACKTRACE_TRIPLES property; + # these are not needed for successful ptests as we don't install the CMakeLists.txt files anyway. + sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/CTestTestfile.cmake + sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/tests/CTestTestfile.cmake + sed -i s#${S}#${PTEST_PATH}#g ${D}${PTEST_PATH}/fuzzing/CTestTestfile.cmake + # install test artifacts + install ${B}/cJSON_test ${D}${PTEST_PATH} + install ${B}/tests/cjson_add ${B}/tests/*_tests ${B}/tests/parse_* ${B}/tests/print_* ${B}/tests/readme_examples ${D}${PTEST_PATH}/tests/ + install ${B}/tests/inputs/* ${D}${PTEST_PATH}/tests/inputs + install ${B}/fuzzing/fuzz_main ${D}${PTEST_PATH}/fuzzing +} + +EXTRA_OECMAKE += "\ + -DENABLE_CJSON_UTILS=On \ + -DENABLE_CUSTOM_COMPILER_FLAGS=OFF \ + -DBUILD_SHARED_AND_STATIC_LIBS=On \ +" + +BBCLASSEXTEND = "native nativesdk" -- cgit v1.2.3-54-g00ecf