public/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libmad: fix three CVE from 2017

Browse Source 
* add patch for CVE-2017-8372 and CVE-2017-8373
* add patch for CVE-2017-8374
* add patch for x86_64 platforms
* fetch existing patches from remote sources
This commit is contained in:
c0bw3b
2019-11-11 19:35:53 +01:00
committed by Robert Helgesson
parent 73b88e17dd
commit 92edb06109
4 changed files with 43 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/development/libraries/libmad/default.nix
+43 -13
View File
@@ -1,27 +1,57 @@
{stdenv, fetchurl, autoconf}:
{ stdenv, fetchurl, fetchpatch, autoconf }:
stdenv.mkDerivation rec {
name = "libmad-0.15.1b";
pname = "libmad";
version = "0.15.1b";
src = fetchurl {
url = "mirror://sourceforge/mad/${name}.tar.gz";
sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
};
patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
patches = [
(fetchpatch {
url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
})
(fetchpatch {
url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
})
(fetchpatch {
url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
})
(fetchpatch {
name = "CVE-2017-8372-CVE-2017-8373.patch";
url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
})
(fetchpatch {
name = "CVE-2017-8374.patch";
url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
})
]
# optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
# It is included here in order to fix a build failure in Clang
# But it may be useful to fix other, currently unknown problems as well
++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
++ stdenv.lib.optionals stdenv.cc.isClang [
(fetchpatch {
url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
})
];
# The -fforce-mem flag has been removed in GCC 4.3.
postPatch = ''
substituteInPlace configure.ac --replace "-fforce-mem" ""
substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
'';
nativeBuildInputs = [ autoconf ];
# The -fforce-mem flag has been removed in GCC 4.3.
preConfigure = ''
autoconf
substituteInPlace configure --replace "-fforce-mem" ""
substituteInPlace configure --replace "arch=\"-march=i486\"" ""
'';
preConfigure = "autoconf";
meta = with stdenv.lib; {
homepage = https://sourceforge.net/projects/mad/;