From 499b75f0d28290efb0902f0bb41ea0ef827f00de Mon Sep 17 00:00:00 2001 From: Cole Munz Date: Thu, 9 Jul 2026 16:37:40 -0500 Subject: [PATCH] bump bundled faad2 to 2.10.1, fixes heap overflow (#2766) --- external/CMakeLists.txt | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt index 9d792d360..4c0c87196 100644 --- a/external/CMakeLists.txt +++ b/external/CMakeLists.txt @@ -300,9 +300,15 @@ if (NOT ZLIB_FOUND AND NOT USE_PRECOMPILED_LIBS) endif (NOT ZLIB_FOUND AND NOT USE_PRECOMPILED_LIBS) if (NOT FAAD_FOUND AND NOT USE_PRECOMPILED_LIBS) + # faad2 2.8.8 is the last version SourceForge ever hosted, and it predates the 2.9.0 fix + # for a heap overflow in excluded_channels() (knik0/faad2@942c3e0a: unbounded exclude_mask + # write in the DRC parser). Later releases only live on GitHub, whose source archives don't + # include a pre-built configure script (only configure.ac), so bootstrap it first -- same + # reason libusb above fetches a release tarball instead of a bare git checkout. ExternalProject_Add(faad - URL https://downloads.sourceforge.net/project/faac/faad2-src/faad2-2.8.0/faad2-2.8.8.tar.gz + URL https://github.com/knik0/faad2/archive/refs/tags/2.10.1.tar.gz PREFIX "${EXTERNAL_BUILD_LIBRARIES}/faad" + PATCH_COMMAND /bootstrap CONFIGURE_COMMAND /configure --prefix= TEST_COMMAND "" )