14 files changed, 38 insertions, 15 deletions
diff --git a/pkgs/tools/graphics/barcode/default.nix b/pkgs/tools/graphics/barcode/default.nix
index b35b929da404..d6a31bd5c7f7 100644
--- a/pkgs/tools/graphics/barcode/default.nix
+++ b/pkgs/tools/graphics/barcode/default.nix
@@ -9,13 +9,14 @@ stdenv.mkDerivation rec {
     sha256 = "1indapql5fjz0bysyc88cmc54y8phqrbi7c76p71fgjp45jcyzp8";
   };
 
+  hardeningDisable = [ "format" ];
+
   meta = with stdenv.lib; {
     description = "GNU barcode generator";
     maintainers = with maintainers; [ raskin ];
     platforms = with platforms; allBut darwin;
     downloadPage = "http://ftp.gnu.org/gnu/barcode/";
     updateWalker = true;
-    inherit version;
     homepage = http://ftp.gnu.org/gnu/barcode/;
   };
 }
diff --git a/pkgs/tools/graphics/editres/default.nix b/pkgs/tools/graphics/editres/default.nix
index 78a66721b0c9..a3d343cea577 100644
--- a/pkgs/tools/graphics/editres/default.nix
+++ b/pkgs/tools/graphics/editres/default.nix
@@ -10,7 +10,9 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ pkgconfig libXt libXaw libXres utilmacros ];
 
-  preConfigure = "configureFlags=--with-appdefaultdir=$out/share/X11/app-defaults/editres";
+  configureFlags = "--with-appdefaultdir=$(out)/share/X11/app-defaults/editres";
+
+  hardeningDisable = [ "format" ];
 
   meta = {
     homepage = "http://cgit.freedesktop.org/xorg/app/editres/";
diff --git a/pkgs/tools/graphics/ggobi/default.nix b/pkgs/tools/graphics/ggobi/default.nix
index cf2c5598d2a9..e7fb3e773c1d 100644
--- a/pkgs/tools/graphics/ggobi/default.nix
+++ b/pkgs/tools/graphics/ggobi/default.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--with-all-plugins";
 
+  hardeningDisable = [ "format" ];
+
   meta = with stdenv.lib; {
     description = "Visualization program for exploring high-dimensional data";
     homepage = http://www.ggobi.org/;
diff --git a/pkgs/tools/graphics/graphviz/2.0.nix b/pkgs/tools/graphics/graphviz/2.0.nix
index 5fa78a3e3b8c..255ec2d536f6 100644
--- a/pkgs/tools/graphics/graphviz/2.0.nix
+++ b/pkgs/tools/graphics/graphviz/2.0.nix
@@ -12,10 +12,13 @@ stdenv.mkDerivation rec {
     sha256 = "39b8e1f2ba4cc1f5bdc8e39c7be35e5f831253008e4ee2c176984f080416676c";
   };
 
-  buildInputs = [pkgconfig xlibsWrapper libpng libjpeg expat libXaw yacc
+  buildInputs = [
+    pkgconfig xlibsWrapper libpng libjpeg expat libXaw yacc
     libtool fontconfig pango gd libwebp
-    ];
-  
+  ];
+
+  hardeningDisable = [ "format" "fortify" ];
+
   configureFlags =
     [ "--with-pngincludedir=${libpng.dev}/include"
       "--with-pnglibdir=${libpng.out}/lib"
diff --git a/pkgs/tools/graphics/graphviz/2.32.nix b/pkgs/tools/graphics/graphviz/2.32.nix
index edbe9cd33747..9c125433c3a6 100644
--- a/pkgs/tools/graphics/graphviz/2.32.nix
+++ b/pkgs/tools/graphics/graphviz/2.32.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation rec {
     ]
     ++ stdenv.lib.optional (xorg == null) "--without-x";
 
+  hardeningDisable = [ "fortify" ];
+
   preBuild = ''
     sed -e 's@am__append_5 *=.*@am_append_5 =@' -i lib/gvc/Makefile
   '';
diff --git a/pkgs/tools/graphics/graphviz/default.nix b/pkgs/tools/graphics/graphviz/default.nix
index 975c5dc13e8e..1162b338ed75 100644
--- a/pkgs/tools/graphics/graphviz/default.nix
+++ b/pkgs/tools/graphics/graphviz/default.nix
@@ -12,9 +12,11 @@ stdenv.mkDerivation rec {
     sha256 = "17l5czpvv5ilmg17frg0w4qwf89jzh2aglm9fgx0l0aakn6j7al1";
   };
 
+  hardeningDisable = [ "fortify" ];
+
   patches =
     [ ./0001-vimdot-lookup-vim-in-PATH.patch
-    
+
       # NOTE: Once this patch is removed, flex can probably be removed from
       # buildInputs.
       ./cve-2014-9157.patch
diff --git a/pkgs/tools/graphics/jbig2enc/default.nix b/pkgs/tools/graphics/jbig2enc/default.nix
index 8d0b7d2d9f49..0bb0bb00efa5 100644
--- a/pkgs/tools/graphics/jbig2enc/default.nix
+++ b/pkgs/tools/graphics/jbig2enc/default.nix
@@ -1,4 +1,6 @@
-{stdenv, fetchurl, leptonica, zlib, libwebp, giflib, libjpeg, libpng, libtiff }: stdenv.mkDerivation {
+{ stdenv, fetchurl, fetchpatch, leptonica, zlib, libwebp, giflib, libjpeg, libpng, libtiff }:
+
+stdenv.mkDerivation {
   name = "jbig2enc-0.28";
 
   src = fetchurl {
diff --git a/pkgs/tools/graphics/netpbm/default.nix b/pkgs/tools/graphics/netpbm/default.nix
index bebf7680ded3..3c724ccc2b83 100644
--- a/pkgs/tools/graphics/netpbm/default.nix
+++ b/pkgs/tools/graphics/netpbm/default.nix
@@ -3,11 +3,11 @@
 , enableX11 ? false, libX11 }:
 
 stdenv.mkDerivation rec {
-  name = "netpbm-10.66.00";
+  name = "netpbm-10.70.00";
 
   src = fetchurl {
     url = "mirror://gentoo/distfiles/${name}.tar.xz";
-    sha256 = "1z33pxdir92m7jlvp5c2q44gxwj7jyf8skiqkr71kgirw4w4zsbz";
+    sha256 = "14vxmzbwsy4rzrqjnzr4cvz1s0amacq69faps3v1j1kr05lcns0j";
   };
 
   postPatch = /* CVE-2005-2471, from Arch */ ''
@@ -15,8 +15,6 @@ stdenv.mkDerivation rec {
       --replace '"-DSAFER"' '"-DPARANOIDSAFER"'
   '';
 
-  NIX_CFLAGS_COMPILE = "-fPIC"; # Gentoo adds this on every platform
-
   buildInputs =
     [ pkgconfig flex zlib perl libpng libjpeg libxml2 makeWrapper libtiff ]
     ++ lib.optional enableX11 libX11;
diff --git a/pkgs/tools/graphics/nifskope/default.nix b/pkgs/tools/graphics/nifskope/default.nix
index decd6fb56fd3..f66d01ef7aa3 100644
--- a/pkgs/tools/graphics/nifskope/default.nix
+++ b/pkgs/tools/graphics/nifskope/default.nix
@@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  hardeningDisable = [ "format" ];
+
   # Inspired by linux-install/nifskope.spec.in.
   installPhase =
     ''
diff --git a/pkgs/tools/graphics/plotutils/default.nix b/pkgs/tools/graphics/plotutils/default.nix
index 6a7a6745c87c..abcbabea596c 100644
--- a/pkgs/tools/graphics/plotutils/default.nix
+++ b/pkgs/tools/graphics/plotutils/default.nix
@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
 
   configureFlags = "--enable-libplotter"; # required for pstoedit
 
+  hardeningDisable = [ "format" ];
+
   doCheck = true;
 
   meta = {
diff --git a/pkgs/tools/graphics/pngcheck/default.nix b/pkgs/tools/graphics/pngcheck/default.nix
index 38efa0236b2e..6814a06e3b95 100644
--- a/pkgs/tools/graphics/pngcheck/default.nix
+++ b/pkgs/tools/graphics/pngcheck/default.nix
@@ -8,9 +8,7 @@ stdenv.mkDerivation rec {
     sha256 = "0pzkj1bb4kdybk6vbfq9s0wzdm5szmrgixkas3xmbpv4mhws1w3p";
   };
 
-  # configurePhase = ''
-  #   sed -i s,/usr,$out, Makefile
-  # '';
+  hardeningDisable = [ "format" ];
 
   makefile = "Makefile.unx";
   makeFlags = "ZPATH=${zlib.static}/lib";
diff --git a/pkgs/tools/graphics/qrcode/default.nix b/pkgs/tools/graphics/qrcode/default.nix
index f0e86ddfb1de..f39071b394c1 100644
--- a/pkgs/tools/graphics/qrcode/default.nix
+++ b/pkgs/tools/graphics/qrcode/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchgit}:
+{ stdenv, fetchgit }:
 let
   s =
   rec {
@@ -16,14 +16,19 @@ in
 stdenv.mkDerivation {
   inherit (s) name version;
   inherit buildInputs;
+
   src = fetchgit {
     inherit (s) rev url sha256;
   };
+
+  hardeningDisable = [ "fortify" ];
+
   installPhase = ''
     mkdir -p "$out"/{bin,share/doc/qrcode}
     cp qrcode "$out/bin"
     cp DOCUMENTATION LICENCE "$out/share/doc/qrcode"
   '';
+
   meta = {
     inherit (s) version;
     description = ''A small QR-code tool'';
diff --git a/pkgs/tools/graphics/transfig/default.nix b/pkgs/tools/graphics/transfig/default.nix
index 3e8e824d1c65..948bba6d459f 100644
--- a/pkgs/tools/graphics/transfig/default.nix
+++ b/pkgs/tools/graphics/transfig/default.nix
@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
   buildInputs = [zlib libjpeg libpng imake];
   inherit libpng;
 
+  hardeningDisable = [ "format" ];
+
   patches = [prefixPatch1 prefixPatch2 prefixPatch3 varargsPatch gensvgPatch];
 
   prefixPatch1 =
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index 2751da42a4c3..9a181e7d087d 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
     [ imagemagickBig pkgconfig python pygtk perl libX11
       libv4l qt4 lzma gtk2 autoreconfHook ];
 
+  hardeningDisable = [ "fortify" ];
+
   meta = with stdenv.lib; {
     description = "Bar code reader";
     longDescription = ''