Skip to content

v3.0 upgrade libmicrohttpd to v1.0.1 #4971

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 1 commit into
base: v3.0
Choose a base branch
from
Draft

v3.0 upgrade libmicrohttpd to v1.0.1 #4971

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deps/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,7 +133,7 @@ curl: curl/curl/lib/.libs/libcurl.a
libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a:
cd libmicrohttpd && rm -rf libmicrohttpd-*/ || true
cd libmicrohttpd && tar -zxf libmicrohttpd-*.tar.gz
# cd libmicrohttpd/libmicrohttpd && patch src/microhttpd/connection.c < ../connection.c-snprintf-overflow.patch
cd libmicrohttpd && ln -fsT libmicrohttpd-*/ libmicrohttpd
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The upgrade to libmicrohttpd v1.0.1 involves removing the application of connection.c-snprintf-overflow.patch (previously on the old line 136) and introducing a symbolic link here for the library directory.

While the symlink approach (ln -fsT libmicrohttpd-*/ libmicrohttpd) is a good enhancement for managing the library version, it's crucial to ensure the removed patch is genuinely obsolete.

Could you please confirm that the snprintf overflow issue, which connection.c-snprintf-overflow.patch was intended to fix, has been addressed in libmicrohttpd v1.0.1? Verifying this is essential to prevent the reintroduction of any potential vulnerabilities (like buffer overflows) that the patch might have mitigated.

cd libmicrohttpd/libmicrohttpd && ./configure --enable-https && CC=${CC} CXX=${CXX} ${MAKE}

microhttpd: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a
Expand Down
20 changes: 0 additions & 20 deletions deps/libmicrohttpd/connection.c-snprintf-overflow.patch
View file
Open in desktop

This file was deleted.

2 changes: 1 addition & 1 deletion deps/libmicrohttpd/libmicrohttpd
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
libmicrohttpd-0.9.77
libmicrohttpd-1.0.1/
Binary file removed deps/libmicrohttpd/libmicrohttpd-0.9.77.tar.gz
View file
Open in desktop
Binary file not shown.
Binary file added deps/libmicrohttpd/libmicrohttpd-1.0.1.tar.gz
View file
Open in desktop
Binary file not shown.
Loading