minidlna: update to 1.3.3

Fixes CVE-2023-33476:
  ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable
  to Buffer Overflow. The vulnerability is caused by incorrect
  validation logic when handling HTTP requests using chunked transport
  encoding. This results in other code later using attacker-controlled
  chunk values that exceed the length of the allocated buffer,
  resulting in out-of-bounds read/write.

Signed-off-by: Robert Högberg <robert.hogberg@gmail.com>
This commit is contained in:
Robert Högberg 2023-06-11 23:55:23 +02:00 committed by Rosen Penev
parent 67af34188d
commit 77b4067754
2 changed files with 4 additions and 4 deletions

View File

@ -8,12 +8,12 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=minidlna
PKG_VERSION:=1.3.2
PKG_VERSION:=1.3.3
PKG_RELEASE:=1
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
PKG_SOURCE_URL:=@SF/minidlna
PKG_HASH:=222ce45a1a60c3ce3de17527955d38e5ff7a4592d61db39577e6bf88e0ae1cb0
PKG_HASH:=39026c6d4a139b9180192d1c37225aa3376fdf4f1a74d7debbdbb693d996afa4
PKG_MAINTAINER:=
PKG_LICENSE:=GPL-2.0-or-later BSD-3-Clause

View File

@ -105,7 +105,7 @@ Subject: [PATCH] Mark all instances of magic_container_s as const
{
int ret;
@@ -1301,7 +1301,7 @@ BrowseContentDirectory(struct upnphttp *
@@ -1305,7 +1305,7 @@ BrowseContentDirectory(struct upnphttp *
"<Result>"
"&lt;DIDL-Lite"
CONTENT_DIRECTORY_SCHEMAS;
@ -114,7 +114,7 @@ Subject: [PATCH] Mark all instances of magic_container_s as const
char *zErrMsg = NULL;
char *sql, *ptr;
struct Response args;
@@ -1823,7 +1823,7 @@ SearchContentDirectory(struct upnphttp *
@@ -1828,7 +1828,7 @@ SearchContentDirectory(struct upnphttp *
"<Result>"
"&lt;DIDL-Lite"
CONTENT_DIRECTORY_SCHEMAS;