diff options
| author | Symphorien Gibol <symphorien+git@xlumurb.eu> | 2018-09-23 18:22:53 +0200 |
|---|---|---|
| committer | Symphorien Gibol <symphorien+git@xlumurb.eu> | 2018-09-23 18:24:41 +0200 |
| commit | 5a9f7d1fe65238f49c3337580ea599077033a1f4 (patch) | |
| tree | bf416a271da97df120dcab48d38be7823f7fb064 /pkgs/tools/graphics/graphviz | |
| parent | 0ae8ac86510aae6491f49964f0b8af99dc2869e9 (diff) | |
| download | nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar.gz nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar.bz2 nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar.lz nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar.xz nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.tar.zst nixlib-5a9f7d1fe65238f49c3337580ea599077033a1f4.zip | |
graphviz: fix CVE-2018-10196
Diffstat (limited to 'pkgs/tools/graphics/graphviz')
| -rw-r--r-- | pkgs/tools/graphics/graphviz/base.nix | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix index 68ff84c7495a..db21df9b5d0d 100644 --- a/pkgs/tools/graphics/graphviz/base.nix +++ b/pkgs/tools/graphics/graphviz/base.nix @@ -2,12 +2,26 @@ { stdenv, fetchFromGitLab, autoreconfHook, pkgconfig, cairo, expat, flex , fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango -, yacc, xorg ? null, ApplicationServices ? null }: +, yacc, fetchpatch, xorg ? null, ApplicationServices ? null }: assert stdenv.isDarwin -> ApplicationServices != null; let inherit (stdenv.lib) optionals optionalString; + raw_patch = + # https://gitlab.com/graphviz/graphviz/issues/1367 CVE-2018-10196 + fetchpatch { + name = "CVE-2018-10196.patch"; + url = https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff; + sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7"; + excludes = ["tests/*"]; # we don't run them and they don't apply + }; + # the patch needs a small adaption for older versions + patch = if stdenv.lib.versionAtLeast version "2.37" then raw_patch else + stdenv.mkDerivation { + inherit (raw_patch) name; + buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out"; + }; in stdenv.mkDerivation rec { @@ -37,6 +51,10 @@ stdenv.mkDerivation rec { "--with-ltdl-include=${libtool}/include" ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ]; + patches = [ + patch + ]; + postPatch = '' for f in $(find . -name Makefile.in); do substituteInPlace $f --replace "-lstdc++" "-lc++" |