mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
3c312f149b
For release notes since version 5.4.3, see: https://github.com/assimp/assimp/releases This fixes the following vulnerabilities: - CVE-2025-2750: A vulnerability, which was classified as critical, was found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation leads to out-of-bounds write. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. https://www.cve.org/CVERecord?id=CVE-2025-2750 - CVE-2025-2751: A vulnerability has been found in Open Asset Import Library Assimp 5.4.3 and classified as problematic. This vulnerability affects the function Assimp::CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp of the component CSM File Handler. The manipulation of the argument na leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. https://www.cve.org/CVERecord?id=CVE-2025-2751 - CVE-2025-2757: A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function AI_MD5_PARSE_STRING_IN_QUOTATION of the file code/AssetLib/MD5/MD5Parser.cpp of the component MD5 File Handler. The manipulation of the argument data leads to heap-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. https://www.cve.org/CVERecord?id=CVE-2025-2757 - CVE-2025-3158: A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. Affected by this issue is the function Assimp::LWO::AnimResolver::UpdateAnimRangeSetup of the file code/AssetLib/LWO/LWOAnimation.cpp of the component LWO File Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. https://www.cve.org/CVERecord?id=CVE-2025-3158 Also, drop local security patches that have been applied upstream Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> [Julien: add link to relase notes] Signed-off-by: Julien Olivain <ju.o@free.fr>
46 lines
1.4 KiB
Makefile
46 lines
1.4 KiB
Makefile
################################################################################
|
|
#
|
|
# assimp
|
|
#
|
|
################################################################################
|
|
|
|
ASSIMP_VERSION = 6.0.2
|
|
ASSIMP_SITE = $(call github,assimp,assimp,v$(ASSIMP_VERSION))
|
|
ASSIMP_LICENSE = BSD-3-Clause
|
|
ASSIMP_LICENSE_FILES = LICENSE
|
|
ASSIMP_CPE_ID_VENDOR = assimp
|
|
ASSIMP_DEPENDENCIES = zlib
|
|
ASSIMP_INSTALL_STAGING = YES
|
|
|
|
# relocation truncated to fit: R_68K_GOT16O. We also need to disable
|
|
# optimizations to not run into "Error: value -43420 out of range"
|
|
# assembler issues.
|
|
ifeq ($(BR2_m68k),y)
|
|
ASSIMP_CXXFLAGS += -mxgot -O0
|
|
endif
|
|
|
|
# just like m68k coldfire, mips64 also has some limitations on the GOT
|
|
# size for large libraries, which can be overcome by passing
|
|
# -mxgot. Solves "relocation truncated to fit: R_MIPS_CALL16" issues.
|
|
ifeq ($(BR2_mips64)$(BR2_mips64el),y)
|
|
ASSIMP_CXXFLAGS += -mxgot
|
|
endif
|
|
|
|
# workaround SuperH compiler failure when static linking (i.e -fPIC is
|
|
# not passed) in gcc versions 5.x or older. The -Os optimization level
|
|
# causes a "unable to find a register to spill in class
|
|
# 'GENERAL_REGS'" error. -O2 works fine.
|
|
ifeq ($(BR2_sh):$(BR2_STATIC_LIBS):$(BR2_TOOLCHAIN_GCC_AT_LEAST_6),y:y:)
|
|
ASSIMP_CXXFLAGS += -O2
|
|
endif
|
|
|
|
ifeq ($(BR2_TOOLCHAIN_HAS_GCC_BUG_85180),y)
|
|
ASSIMP_CXXFLAGS += -O0
|
|
endif
|
|
|
|
ASSIMP_CONF_OPTS += -DASSIMP_BUILD_TESTS=OFF \
|
|
-DASSIMP_WARNINGS_AS_ERRORS=OFF \
|
|
-DCMAKE_CXX_FLAGS="$(TARGET_CXXFLAGS) $(ASSIMP_CXXFLAGS)"
|
|
|
|
$(eval $(cmake-package))
|