1 files changed, 57 insertions, 0 deletions
diff --git a/nixpkgs/pkgs/development/libraries/taglib/default.nix b/nixpkgs/pkgs/development/libraries/taglib/default.nix
new file mode 100644
index 000000000000..c553405878f2
--- /dev/null
+++ b/nixpkgs/pkgs/development/libraries/taglib/default.nix
@@ -0,0 +1,57 @@
+{ stdenv, fetchurl, cmake, fetchpatch
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "taglib";
+  version = "1.11.1";
+
+  src = fetchurl {
+    url = "http://taglib.org/releases/${pname}-${version}.tar.gz";
+    sha256 = "0ssjcdjv4qf9liph5ry1kngam1y7zp8fzr9xv4wzzrma22kabldn";
+  };
+
+  patches = [
+    (fetchpatch {
+      # https://github.com/taglib/taglib/issues/829
+      name = "CVE-2017-12678.patch";
+      url = "https://github.com/taglib/taglib/commit/eb9ded1206f18.patch";
+      sha256 = "1bvpxsvmlpi3by7myzss9kkpdkv405612n8ff68mw1ambj8h1m90";
+    })
+
+    (fetchpatch {
+      # https://github.com/taglib/taglib/pull/869
+      name = "CVE-2018-11439.patch";
+      url = "https://github.com/taglib/taglib/commit/272648ccfcccae30e002ccf34a22e075dd477278.patch";
+      sha256 = "0p397qq4anvcm0p8xs68mxa8hg6dl07chg260lc6k2929m34xv72";
+    })
+
+    (fetchpatch {
+      # many consumers of taglib have started vendoring taglib due to this bug
+      name = "fix_ogg_corruption.patch";
+      url = "https://github.com/taglib/taglib/commit/9336c82da3a04552168f208cd7a5fa4646701ea4.patch";
+      sha256 = "01wlwk4gmfxdg5hjj9jmrain7kia89z0zsdaf5gn3nibmy5bq70r";
+    })
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ zlib ];
+
+  cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://taglib.org/";
+    repositories.git = "git://github.com/taglib/taglib.git";
+    description = "A library for reading and editing audio file metadata.";
+    longDescription = ''
+      TagLib is a library for reading and editing the meta-data of several
+      popular audio formats. Currently it supports both ID3v1 and ID3v2 for MP3
+      files, Ogg Vorbis comments and ID3 tags and Vorbis comments in FLAC, MPC,
+      Speex, WavPack, TrueAudio, WAV, AIFF, MP4 and ASF files.
+    '';
+    license = with licenses; [ lgpl3 mpl11 ];
+    inherit (cmake.meta) platforms;
+    maintainers = with maintainers; [ ttuegel ];
+  };
+}