Make error: Expat-2.1.0 renamed on sourceforge

pfalcon / esp-open-sdk

Free and open (as much as possible) integrated SDK for ESP8266/ESP8285 chips

1.97k stars 623 forks source link

Make error: Expat-2.1.0 renamed on sourceforge #384

Open emailbsuv opened 3 years ago

scubasteve1488 commented 3 years ago

I had no luck with modifying config files to adapt to rename. Easiest solution I've found.

Download "expat2.3.0-RENAMED-VULNERABLE-PLEASE-USE-2.4.1-INSTEAD.tar.gz" from: https://sourceforge.net/projects/expat/files/expat/

rename to expat2.3.0.tar.gz and move to /esp-open-sdk/crosstool-NG/.build/tarballs/

cd /esp_open_sdk/ make

EtchedPixels commented 3 years ago

Not very smart - expat 2.3 has serious security holes and was deliberately moved. Your build is now totally vulnerable to attack. The better fix is to use expat 2.4.1 or later like it tells you to.

derbroti commented 3 years ago

For completeness:

edit crosstool-NG/config/companion_libs/expat.in
replace all occurrences of 2.1.0 with 2.4.1 (This includes the underscore ones like: "EXPAT_V_2_4_1")
run make and everything will be fine

jose1711 commented 2 years ago

And since expat 2.4.1 is now also vulnerable it must be changed to 2.4.7.