chromium: Temporarily use bundled zlib.

Well, after looking a bit more thoroughly through the zlib patch from the
Chromium team, it seams, that this really fix an issue that hasn't yet been
applied upstream. Unfortunately neither Chromium nor Zlib give more information
about that issue. Maybe they're waiting until its resolved upstream and thus the
temporary patch?

The bad news is, that the fix for the vulnerability is incomplete in Chromium
and covers only the use cases of Chromium itself, so we can't include that
patched version in nixpkgs zlib derivation.

Until the issue is fixed upstream we're hereby safer off turning it off in
Chromium and thus use the bundled and patched version.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>

1 files changed, 4 insertions, 17 deletions

diff --git a/pkgs/applications/networking/browsers/chromium/default.nix b/pkgs/applications/networking/browsers/chromium/default.nix
index 59b05e94911f..7dee8f3d296c 100644
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -63,13 +63,13 @@ let
     use_system_stlport = true;
     use_system_xdg_utils = true;
     use_system_yasm = true;
-    use_system_zlib = true;
+    use_system_zlib = false; # http://crbug.com/143623
 
     use_system_harfbuzz = false;
     use_system_icu = false;
-    use_system_libwebp = false; # See chromium issue #133161
+    use_system_libwebp = false; # http://crbug.com/133161
     use_system_skia = false;
-    use_system_sqlite = false; # See chromium issue #22208
+    use_system_sqlite = false; # http://crbug.com/22208
     use_system_v8 = false;
   };
 
@@ -84,18 +84,6 @@ let
     pre22 = versionOlder sourceInfo.version "22.0.0.0";
   in if pre22 then ./enable_seccomp.patch else ./enable_seccomp22.patch;
 
-  # XXX: this reverts r151720 to prevent http://crbug.com/143623
-  maybeRevertZlibChanges = let
-    below22_91 = versionOlder sourceInfo.version "22.0.1229.91";
-    patch = fetchurl {
-      name = "revert-r151720";
-      url = "http://git.chromium.org/gitweb/?p=chromium.git;a=commitdiff_plain;"
-          + "hp=4419ec6414b33b6b19bb2e380b4998ed5193ecab;"
-          + "h=0fabb4fda7059a8757422e8a44e70deeab28e698";
-      sha256 = "0n0d6mkg89g8q63cifapzpg9dxfs2n6xvk4k13szhymvf67b77pf";
-    };
-  in optional (below22_91) patch;
-
 in stdenv.mkDerivation rec {
   name = "${packageName}-${version}";
   packageName = "chromium";
@@ -129,8 +117,7 @@ in stdenv.mkDerivation rec {
 
   patches = optional (!cfg.selinux) seccompPatch
          ++ optional cfg.cups ./cups_allow_deprecated.patch
-         ++ optional cfg.pulseaudio ./pulseaudio_array_bounds.patch
-         ++ maybeRevertZlibChanges;
+         ++ optional cfg.pulseaudio ./pulseaudio_array_bounds.patch;
 
   postPatch = optionalString cfg.openssl ''
     cat $opensslPatches | patch -p1 -d third_party/openssl/openssl