diff options
Diffstat (limited to 'pkgs/development/libraries')
8 files changed, 68 insertions, 5 deletions
diff --git a/pkgs/development/libraries/freetype/cve-2017-8105.patch b/pkgs/development/libraries/freetype/cve-2017-8105.patch new file mode 100644 index 00000000000..dc4327a52a8 --- /dev/null +++ b/pkgs/development/libraries/freetype/cve-2017-8105.patch @@ -0,0 +1,27 @@ +http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=f958c48ee43 + +diff --git a/src/psaux/t1decode.c b/src/psaux/t1decode.c +index af7b465..7dd4513 100644 +--- a/src/psaux/t1decode.c ++++ b/src/psaux/t1decode.c +@@ -780,10 +780,19 @@ + /* point without adding any point to the outline */ + idx = decoder->num_flex_vectors++; + if ( idx > 0 && idx < 7 ) ++ { ++ /* in malformed fonts it is possible to have other */ ++ /* opcodes in the middle of a flex (which don't */ ++ /* increase `num_flex_vectors'); we thus have to */ ++ /* check whether we can add a point */ ++ if ( FT_SET_ERROR( t1_builder_check_points( builder, 1 ) ) ) ++ goto Syntax_Error; ++ + t1_builder_add_point( builder, + x, + y, + (FT_Byte)( idx == 3 || idx == 6 ) ); ++ } + } + break; + + diff --git a/pkgs/development/libraries/freetype/cve-2017-8287.patch b/pkgs/development/libraries/freetype/cve-2017-8287.patch new file mode 100644 index 00000000000..7ccf4f3278b --- /dev/null +++ b/pkgs/development/libraries/freetype/cve-2017-8287.patch @@ -0,0 +1,22 @@ +http://git.savannah.gnu.org/cgit/freetype/freetype2.git/commit/?id=3774fc08b + +diff --git a/src/psaux/psobjs.c b/src/psaux/psobjs.c +index d18e821..0baf836 100644 +--- a/src/psaux/psobjs.c ++++ b/src/psaux/psobjs.c +@@ -1718,6 +1718,14 @@ + first = outline->n_contours <= 1 + ? 0 : outline->contours[outline->n_contours - 2] + 1; + ++ /* in malformed fonts it can happen that a contour was started */ ++ /* but no points were added */ ++ if ( outline->n_contours && first == outline->n_points ) ++ { ++ outline->n_contours--; ++ return; ++ } ++ + /* We must not include the last point in the path if it */ + /* is located on the first point. */ + if ( outline->n_points > 1 ) + diff --git a/pkgs/development/libraries/freetype/default.nix b/pkgs/development/libraries/freetype/default.nix index 287a0742440..9b2c6fe11e1 100644 --- a/pkgs/development/libraries/freetype/default.nix +++ b/pkgs/development/libraries/freetype/default.nix @@ -48,6 +48,9 @@ in stdenv.mkDerivation { ./pcf-config-long-family-names.patch ./disable-pcf-long-family-names.patch ./enable-table-validation.patch + # remove the two CVE patches after updating to >= 2.8 + ./cve-2017-8105.patch + ./cve-2017-8287.patch ] ++ optional useEncumberedCode ./enable-subpixel-rendering.patch; diff --git a/pkgs/development/libraries/libftdi/default.nix b/pkgs/development/libraries/libftdi/default.nix index 36f4a04c9df..f0d05c0b263 100644 --- a/pkgs/development/libraries/libftdi/default.nix +++ b/pkgs/development/libraries/libftdi/default.nix @@ -12,6 +12,9 @@ stdenv.mkDerivation rec { propagatedBuildInputs = [ libusb ]; + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" ''; + meta = { description = "A library to talk to FTDI chips using libusb"; homepage = http://www.intra2net.com/en/developer/libftdi/; diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index c6705703149..a23e3704035 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -12,10 +12,10 @@ stdenv.mkDerivation rec { }; prePatch =let - # https://lwn.net/Vulnerabilities/711777/ + # https://lwn.net/Vulnerabilities/711777/ and more patched in *-6 -> *-7 debian = fetchurl { - url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-5.debian.tar.xz; - sha256 = "1ribxdn89wx3nllcyh7ql3dx6wpr1h7z3waglz1w7dklxm43q67l"; + url = http://http.debian.net/debian/pool/main/t/tiff/tiff_4.0.7-6.debian.tar.xz; + sha256 = "9c9048c28205bdbeb5ba36c7a194d0cd604bd137c70961607bfc8a079be5fa31"; }; in '' tar xf '${debian}' diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix index e9edda698f4..b6ca7a0a476 100644 --- a/pkgs/development/libraries/mesa/default.nix +++ b/pkgs/development/libraries/mesa/default.nix @@ -67,7 +67,7 @@ let in let - version = "17.0.4"; + version = "17.0.6"; branch = head (splitString "." version); driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32"; in @@ -82,7 +82,7 @@ stdenv.mkDerivation { "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz" "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz" ]; - sha256 = "1269dc8545a193932a0779b2db5bce9be4a5f6813b98c38b93b372be8362a346"; + sha256 = "17d60jjzg4ddm95gk2cqx0xz6b9anmmz6ax4majwr3gis2yg7v49"; }; prePatch = "patchShebangs ."; diff --git a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix index 915a6bcae8a..23a45dd44ed 100644 --- a/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix +++ b/pkgs/development/libraries/qt-5/5.6/qtwebkit/default.nix @@ -31,5 +31,9 @@ qtSubmodule { }; in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ] ++ [ dlopen-webkit-udev ]; + + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" ''; + meta.maintainers = with stdenv.lib.maintainers; [ abbradar ]; } diff --git a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix index 881acb442e8..bee3786ef32 100644 --- a/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix +++ b/pkgs/development/libraries/qt-5/5.8/qtwebkit/default.nix @@ -39,5 +39,9 @@ qtSubmodule { in optionals flashplayerFix [ dlopen-webkit-nsplugin dlopen-webkit-gtk ] ++ optionals (!stdenv.isDarwin) [ dlopen-webkit-udev ] ++ optionals (stdenv.isDarwin) [ ./0004-icucore-darwin.patch ]; + + # Hack to avoid TMPDIR in RPATHs. + preFixup = ''rm -rf "$(pwd)" && mkdir "$(pwd)" ''; + meta.maintainers = with stdenv.lib.maintainers; [ abbradar periklis ]; } |