lz4-1.9.3

system/base/lz4/files/8301a21.patch

@@ -0,0 +1,22 @@
+From 8301a21773ef61656225e264f4f06ae14462bca7 Mon Sep 17 00:00:00 2001
+From: Jasper Lievisse Adriaanse <j@jasper.la>
+Date: Fri, 26 Feb 2021 15:21:20 +0100
+Subject: [PATCH] Fix potential memory corruption with negative memmove() size
+
+---
+ lib/lz4.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/lz4.c b/lib/lz4.c
+index 5f524d01d..c2f504ef3 100644
+--- a/lib/lz4.c
++++ b/lib/lz4.c
+@@ -1749,7 +1749,7 @@ LZ4_decompress_generic(
+                  const size_t dictSize         /* note : = 0 if noDict */
+                  )
+ {
+-    if (src == NULL) { return -1; }
++    if ((src == NULL) || (outputSize < 0)) { return -1; }
+ 
+     {   const BYTE* ip = (const BYTE*) src;
+         const BYTE* const iend = ip + srcSize;

system/base/lz4/pspec.xml

@@ -12,12 +12,15 @@
         <IsA>library</IsA>
         <Summary>Extremely fast compression algorithm</Summary>
         <Description>LZ4 is an extremely fast loss-less compression algorithm, providing compression speed at 400 MB/s per core, scalable with multi-core CPU. It also features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.</Description>
-        <Archive sha1sum="4dc36f29d7b4e5b45b114be2674068200714abb3" type="targz">https://github.com/lz4/lz4/archive/v1.9.2.tar.gz</Archive>
+        <Archive sha1sum="5a19554ef404a609123b756ddcbbb677df838f05" type="targz">https://github.com/lz4/lz4/archive/v1.9.3.tar.gz</Archive>
         <BuildDependencies>
             <Dependency>make</Dependency>
             <Dependency>glibc-devel</Dependency>
             <Dependency>diffutils</Dependency>
         </BuildDependencies>
+        <Patches>
+            <Patch level="1">8301a21.patch</Patch>
+        </Patches>
     </Source>
 
     <Package>
@@ -45,6 +48,13 @@
     </Package>
 
     <History>
+        <Update release="3">
+            <Date>2021-09-28</Date>
+            <Version>1.9.3</Version>
+            <Comment>Version bump.</Comment>
+            <Name>Mustafa Cinasal</Name>
+            <Email>muscnsl@gmail.com</Email>
+        </Update>
         <Update release="2">
             <Date>2020-12-09</Date>
             <Version>1.9.2</Version>