CVE-2019-12900 #8
Conversation
| flag system-bzlib | ||
| description: | ||
| Use system bzlib rather than the bundled sources | ||
| default: True | ||
| manual: True |
There was a problem hiding this comment.
This is the right default, imo.
Using bundled C sources should be the last resort. Even under windows you can build against bzip2 just fine: https://packages.msys2.org/base/mingw-w64-bzip2
Unfortunately, upstream does not provide a pkg-config file, so we can't use the auto fallback mechanism.
There was a problem hiding this comment.
I understand your position, but my experience with other packages is that practically it would force Windows users to stay on the older, vulnerable version of bzlib.
There was a problem hiding this comment.
Well, feel free to cherry-pick the first commit then, which keeps the old behavior.
There was a problem hiding this comment.
Thanks, I'll merge and revert the second commit then.
|
Thanks! |
2 participants
No description provided.