[Buildroot] [PATCH 1/1] package/libmodplug: update to git version

[Thomas Petazzoni]

Hello,

On Mon, 19 Dec 2022 17:39:34 +0000
Gleb Mazovetskiy <glex.spb at gmail.com> wrote:

> The libmodplug release has not been updated for over 5 years.
> The git version contains many bug fixes, including for OOB
> accesses, unaligned reads and writes, etc.
> 
> This git repository is the official home of libmodplug (by the original
> author), however a new release does not seem likely anytime soon:
> there are multiple open issues in the repository asking the author to
> tag a release, all without a response.
> 
> Update buildroot to the current version of libmodplug from the official
> git repository. The build system changed from autotools to cmake since
> the last version.
> 
> Signed-off-by: Gleb Mazovetskiy <glex.spb at gmail.com>
> ---
>  package/libmodplug/libmodplug.hash | 2 +-
>  package/libmodplug/libmodplug.mk   | 6 +++---
>  2 files changed, 4 insertions(+), 4 deletions(-)

I've applied, but with the following addition:

+# Our version is actually newer than this, but having this allows to
+# not have reports about CVEs for versions older than 0.8.9.0.
+LIBMODPLUG_CPE_ID_VERSION = 0.8.9.0

Indeed, with your change as-is, the results at
http://autobuild.buildroot.net/stats/master.html would have shown that
all known CVEs of libmodplug apply to our package... even though they
in fact affect older releases. This is due to the fact that with the
new version being a Git commit hash, it cannot be compared with the
stable version numbers known in the CVE database.

By making this variable value be 0.8.9.0, we allow the CVE matching
logic to exclude CVEs affecting versions older than 0.8.9.0, which we
now we are not affected by, as we have a newer code base than 0.8.9.0.

Thanks for your contribution!

Best regards,

Thomas Petazzoni
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com