summary refs log tree commit diff
path: root/pkgs/development/libraries
diff options
context:
space:
mode:
Diffstat (limited to 'pkgs/development/libraries')
-rw-r--r--pkgs/development/libraries/gdbm/default.nix17
-rw-r--r--pkgs/development/libraries/gettext/default.nix29
-rw-r--r--pkgs/development/libraries/glew/1.10.nix4
-rw-r--r--pkgs/development/libraries/glew/default.nix4
-rw-r--r--pkgs/development/libraries/glib/default.nix4
-rw-r--r--pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch209
-rw-r--r--pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch33
-rw-r--r--pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch115
-rw-r--r--pkgs/development/libraries/glibc/common.nix10
-rw-r--r--pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch42
-rw-r--r--pkgs/development/libraries/libelf/default.nix5
-rw-r--r--pkgs/development/libraries/libelf/dont-hardcode-ar.patch (renamed from pkgs/development/libraries/libelf/cross-ar.patch)0
-rw-r--r--pkgs/development/libraries/libev/default.nix4
-rw-r--r--pkgs/development/libraries/libiconv/default.nix12
-rw-r--r--pkgs/development/libraries/libiconv/libiconv-1.14-reloc.patch269
-rw-r--r--pkgs/development/libraries/libiconv/libiconv-1.14-wchar.patch102
-rw-r--r--pkgs/development/libraries/libmicrohttpd/default.nix4
-rw-r--r--pkgs/development/libraries/libxslt/default.nix6
-rw-r--r--pkgs/development/libraries/mesa/default.nix4
-rw-r--r--pkgs/development/libraries/ncurses/default.nix7
-rw-r--r--pkgs/development/libraries/openldap/default.nix4
-rw-r--r--pkgs/development/libraries/openssl/1.0.1-cygwin64.patch136
-rw-r--r--pkgs/development/libraries/openssl/default.nix1
-rw-r--r--pkgs/development/libraries/sqlite/default.nix6
-rw-r--r--pkgs/development/libraries/zlib/default.nix60
-rw-r--r--pkgs/development/libraries/zlib/disable-cygwin-widechar.patch13
26 files changed, 500 insertions, 600 deletions
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index de77b4c99b8..86d9bd64988 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, lib, buildPlatform, fetchurl }:
 
 stdenv.mkDerivation rec {
   name = "gdbm-1.13";
@@ -10,9 +10,22 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
+  # Linking static stubs on cygwin requires correct ordering.
+  # Consider upstreaming this.
+
+  # Disable dbmfetch03.at test because it depends on unlink()
+  # failing on a link in a chmod -w directory, which cygwin
+  # apparently allows.
+  postPatch = lib.optionalString buildPlatform.isCygwin ''
+      substituteInPlace tests/Makefile.in --replace \
+        '_LDADD = ../src/libgdbm.la ../compat/libgdbm_compat.la' \
+        '_LDADD = ../compat/libgdbm_compat.la ../src/libgdbm.la'
+      substituteInPlace tests/testsuite.at --replace \
+        'm4_include([dbmfetch03.at])' ""
+  '';
   configureFlags = [ "--enable-libgdbm-compat" ];
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "GNU dbm key/value database library";
 
     longDescription =
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 7d555ba4d06..d7058884104 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, libiconv, xz }:
+{ stdenv, lib, hostPlatform, fetchurl, libiconv, xz }:
 
 stdenv.mkDerivation rec {
   name = "gettext-${version}";
@@ -18,15 +18,6 @@ stdenv.mkDerivation rec {
   LDFLAGS = if stdenv.isSunOS then "-lm -lmd -lmp -luutil -lnvpair -lnsl -lidmap -lavl -lsec" else "";
 
   configureFlags = [ "--disable-csharp" "--with-xz" ]
-     ++ lib.optionals stdenv.isCygwin [
-            "--disable-java"
-            "--disable-native-java"
-            # Share the cache among the various `configure' runs.
-            "--config-cache"
-            "--with-included-gettext"
-            "--with-included-glib"
-            "--with-included-libcroco"
-        ]
      # avoid retaining reference to CF during stdenv bootstrap
      ++ lib.optionals stdenv.isDarwin [
             "gt_cv_func_CFPreferencesCopyAppValue=no"
@@ -38,6 +29,9 @@ stdenv.mkDerivation rec {
    substituteInPlace gettext-tools/projects/KDE/trigger --replace "/bin/pwd" pwd
    substituteInPlace gettext-tools/projects/GNOME/trigger --replace "/bin/pwd" pwd
    substituteInPlace gettext-tools/src/project-id --replace "/bin/pwd" pwd
+  '' + lib.optionalString hostPlatform.isCygwin ''
+    sed -i -e "s/\(cldr_plurals_LDADD = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
+    sed -i -e "s/\(libgettextsrc_la_LDFLAGS = \)/\\1..\/gnulib-lib\/libxml_rpl.la /" gettext-tools/src/Makefile.in
   '';
 
   # On cross building, gettext supposes that the wchar.h from libc
@@ -49,11 +43,9 @@ stdenv.mkDerivation rec {
       echo gl_cv_func_wcwidth_works=yes > cachefile
       configureFlags="$configureFlags --cache-file=`pwd`/cachefile"
     fi
-  '' + lib.optionalString stdenv.isCygwin ''
-    sed -i -e "s/\(am_libgettextlib_la_OBJECTS = \)error.lo/\\1/" gettext-tools/gnulib-lib/Makefile.in
   '';
 
-  nativeBuildInputs = [ xz xz.bin ] ++ stdenv.lib.optional (!stdenv.isLinux) libiconv; # HACK, see #10874 (and 14664)
+  nativeBuildInputs = [ xz xz.bin ] ++ stdenv.lib.optional (!stdenv.isLinux && !hostPlatform.isCygwin) libiconv; # HACK, see #10874 (and 14664)
 
   enableParallelBuilding = true;
 
@@ -89,14 +81,3 @@ stdenv.mkDerivation rec {
 // stdenv.lib.optionalAttrs stdenv.isDarwin {
   makeFlags = "CFLAGS=-D_FORTIFY_SOURCE=0";
 }
-
-// stdenv.lib.optionalAttrs stdenv.isCygwin {
-  patchPhase =
-   # Make sure `error.c' gets compiled and is part of `libgettextlib.la'.
-   # This fixes:
-   # gettext-0.18.1.1/gettext-tools/src/msgcmp.c:371: undefined reference to `_error_message_count'
-  '' 
-   sed -i gettext-tools/gnulib-lib/Makefile.in \
-          -e 's/am_libgettextlib_la_OBJECTS =/am_libgettextlib_la_OBJECTS = error.lo/g'
-   '';
-}
diff --git a/pkgs/development/libraries/glew/1.10.nix b/pkgs/development/libraries/glew/1.10.nix
index b2e1b26704f..159bf47e130 100644
--- a/pkgs/development/libraries/glew/1.10.nix
+++ b/pkgs/development/libraries/glew/1.10.nix
@@ -38,8 +38,8 @@ stdenv.mkDerivation rec {
     cp -r README.txt LICENSE.txt doc $out/share/doc/glew
   '';
 
-  makeFlags = if hostPlatform == buildPlatform then null else [
-    "SYSTEM=${if hostPlatform.isMinGW then "mingw" else hostPlatform.parsed.kernel}"
+  makeFlags = [
+    "SYSTEM=${if hostPlatform.isMinGW then "mingw" else hostPlatform.parsed.kernel.name}"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/glew/default.nix b/pkgs/development/libraries/glew/default.nix
index ecf1e914a7b..814e4496b77 100644
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@@ -39,8 +39,8 @@ stdenv.mkDerivation rec {
     rm $out/lib/*.a
   '';
 
-  makeFlags = if hostPlatform == buildPlatform then null else [
-    "SYSTEM=${if hostPlatform.isMinGW then "mingw" else hostPlatform.parsed.kernel}"
+  makeFlags = [
+    "SYSTEM=${if hostPlatform.isMinGW then "mingw" else hostPlatform.parsed.kernel.name}"
   ];
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/libraries/glib/default.nix b/pkgs/development/libraries/glib/default.nix
index 96175d04a4e..84c04468277 100644
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, gettext, perl, python
+{ stdenv, hostPlatform, fetchurl, pkgconfig, gettext, perl, python
 , libiconv, libintlOrEmpty, zlib, libffi, pcre, libelf
 # use utillinuxMinimal to avoid circular dependency (utillinux, systemd, glib)
 , utillinuxMinimal ? null
@@ -9,7 +9,7 @@
 
 with stdenv.lib;
 
-assert stdenv.isFreeBSD || stdenv.isDarwin || stdenv.cc.isGNU;
+assert stdenv.isFreeBSD || stdenv.isDarwin || stdenv.cc.isGNU || hostPlatform.isCygwin;
 assert stdenv.isLinux -> utillinuxMinimal != null;
 
 # TODO:
diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch
new file mode 100644
index 00000000000..68e2798181f
--- /dev/null
+++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_AUDIT.patch
@@ -0,0 +1,209 @@
+From ba67ba3275d47e0080f0e5f09d9f5102c000c97e Mon Sep 17 00:00:00 2001
+Message-Id: <ba67ba3275d47e0080f0e5f09d9f5102c000c97e.1495998948.git.fweimer@redhat.com>
+In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
+References: <cover.1495998948.git.fweimer@redhat.com>
+From: Florian Weimer <fweimer@redhat.com>
+Date: Sun, 28 May 2017 20:44:52 +0200
+Subject: [PATCH 3/3] rtld: Reject overly long LD_AUDIT path elements
+To: libc-alpha@sourceware.org
+
+Also only process the last LD_AUDIT entry.
+---
+ elf/rtld.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++---------
+ 1 file changed, 95 insertions(+), 15 deletions(-)
+
+diff --git a/elf/rtld.c b/elf/rtld.c
+index 30f0cae..89d8573 100644
+--- a/elf/rtld.c
++++ b/elf/rtld.c
+@@ -116,13 +116,95 @@ dso_name_valid_for_suid (const char *p)
+   return *p != '\0';
+ }
+ 
+-/* List of auditing DSOs.  */
++/* LD_AUDIT variable contents.  Must be processed before the
++   audit_list below.  */
++const char *audit_list_string;
++
++/* Cyclic list of auditing DSOs.  audit_list->next is the first
++   element.  */
+ static struct audit_list
+ {
+   const char *name;
+   struct audit_list *next;
+ } *audit_list;
+ 
++/* Iterator for audit_list_string followed by audit_list.  */
++struct audit_list_iter
++{
++  /* Tail of audit_list_string still needing processing, or NULL.  */
++  const char *audit_list_tail;
++
++  /* The list element returned in the previous iteration.  NULL before
++     the first element.  */
++  struct audit_list *previous;
++
++  /* Scratch buffer for returning a name which is part of
++     audit_list_string.  */
++#ifdef PATH_MAX
++  char fname[PATH_MAX];
++#else
++  char fname[4096];
++#endif
++};
++
++/* Initialize an audit list iterator.  */
++static void
++audit_list_iter_init (struct audit_list_iter *iter)
++{
++  iter->audit_list_tail = audit_list_string;
++  iter->previous = NULL;
++}
++
++/* Iterate through both audit_list_string and audit_list.  */
++static const char *
++audit_list_iter_next (struct audit_list_iter *iter)
++{
++  if (iter->audit_list_tail != NULL)
++    {
++      /* First iterate over audit_list_string.  */
++      while (*iter->audit_list_tail != '\0')
++	{
++	  /* Split audit list at colon.  */
++	  size_t len = strcspn (iter->audit_list_tail, ":");
++	  if (len > 0 && len < sizeof(iter->fname))
++	    {
++	      memcpy (iter->fname, iter->audit_list_tail, len);
++	      iter->fname[len] = '\0';
++	    }
++	  else
++	    /* Do not return this name to the caller.  */
++	    iter->fname[0] = '\0';
++
++	  /* Skip over the substring and the following delimiter.  */
++	  iter->audit_list_tail += len;
++	  if (*iter->audit_list_tail == ':')
++	    ++iter->audit_list_tail;
++
++	  /* If the name is valid, return it.  */
++	  if (dso_name_valid_for_suid (iter->fname))
++	    return iter->fname;
++	  /* Otherwise, wrap around and try the next name.  */
++	}
++      /* Fall through to the procesing of audit_list.  */
++    }
++
++  if (iter->previous == NULL)
++    {
++      if (audit_list == NULL)
++	/* No pre-parsed audit list.  */
++	return NULL;
++      /* Start of audit list.  The first list element is at
++	 audit_list->next (cyclic list).  */
++      iter->previous = audit_list->next;
++      return iter->previous->name;
++    }
++  if (iter->previous == audit_list)
++    /* Cyclic list wrap-around.  */
++    return NULL;
++  iter->previous = iter->previous->next;
++  return iter->previous->name;
++}
++
+ #ifndef HAVE_INLINED_SYSCALLS
+ /* Set nonzero during loading and initialization of executable and
+    libraries, cleared before the executable's entry point runs.  This
+@@ -1290,11 +1368,13 @@ of this helper program; chances are you did not intend to run this program.\n\
+     GL(dl_rtld_map).l_tls_modid = _dl_next_tls_modid ();
+ 
+   /* If we have auditing DSOs to load, do it now.  */
+-  if (__glibc_unlikely (audit_list != NULL))
++  bool need_security_init = true;
++  if (__glibc_unlikely (audit_list != NULL)
++      || __glibc_unlikely (audit_list_string != NULL))
+     {
+-      /* Iterate over all entries in the list.  The order is important.  */
+       struct audit_ifaces *last_audit = NULL;
+-      struct audit_list *al = audit_list->next;
++      struct audit_list_iter al_iter;
++      audit_list_iter_init (&al_iter);
+ 
+       /* Since we start using the auditing DSOs right away we need to
+ 	 initialize the data structures now.  */
+@@ -1305,9 +1385,14 @@ of this helper program; chances are you did not intend to run this program.\n\
+ 	 use different values (especially the pointer guard) and will
+ 	 fail later on.  */
+       security_init ();
++      need_security_init = false;
+ 
+-      do
++      while (true)
+ 	{
++	  const char *name = audit_list_iter_next (&al_iter);
++	  if (name == NULL)
++	    break;
++
+ 	  int tls_idx = GL(dl_tls_max_dtv_idx);
+ 
+ 	  /* Now it is time to determine the layout of the static TLS
+@@ -1316,7 +1401,7 @@ of this helper program; chances are you did not intend to run this program.\n\
+ 	     no DF_STATIC_TLS bit is set.  The reason is that we know
+ 	     glibc will use the static model.  */
+ 	  struct dlmopen_args dlmargs;
+-	  dlmargs.fname = al->name;
++	  dlmargs.fname = name;
+ 	  dlmargs.map = NULL;
+ 
+ 	  const char *objname;
+@@ -1329,7 +1414,7 @@ of this helper program; chances are you did not intend to run this program.\n\
+ 	    not_loaded:
+ 	      _dl_error_printf ("\
+ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
+-				al->name, err_str);
++				name, err_str);
+ 	      if (malloced)
+ 		free ((char *) err_str);
+ 	    }
+@@ -1433,10 +1518,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
+ 		  goto not_loaded;
+ 		}
+ 	    }
+-
+-	  al = al->next;
+ 	}
+-      while (al != audit_list->next);
+ 
+       /* If we have any auditing modules, announce that we already
+ 	 have two objects loaded.  */
+@@ -1700,7 +1782,7 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
+   if (tcbp == NULL)
+     tcbp = init_tls ();
+ 
+-  if (__glibc_likely (audit_list == NULL))
++  if (__glibc_likely (need_security_init))
+     /* Initialize security features.  But only if we have not done it
+        earlier.  */
+     security_init ();
+@@ -2331,9 +2413,7 @@ process_dl_audit (char *str)
+   char *p;
+ 
+   while ((p = (strsep) (&str, ":")) != NULL)
+-    if (p[0] != '\0'
+-	&& (__builtin_expect (! __libc_enable_secure, 1)
+-	    || strchr (p, '/') == NULL))
++    if (dso_name_valid_for_suid (p))
+       {
+ 	/* This is using the local malloc, not the system malloc.  The
+ 	   memory can never be freed.  */
+@@ -2397,7 +2477,7 @@ process_envvars (enum mode *modep)
+ 	      break;
+ 	    }
+ 	  if (memcmp (envline, "AUDIT", 5) == 0)
+-	    process_dl_audit (&envline[6]);
++	    audit_list_string = &envline[6];
+ 	  break;
+ 
+ 	case 7:
+-- 
+2.9.4
+
diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
new file mode 100644
index 00000000000..88b1925fa12
--- /dev/null
+++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
@@ -0,0 +1,33 @@
+From 4d009d39ac9ede0369e268554a181b428f177a80 Mon Sep 17 00:00:00 2001
+Message-Id: <4d009d39ac9ede0369e268554a181b428f177a80.1495998948.git.fweimer@redhat.com>
+In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
+References: <cover.1495998948.git.fweimer@redhat.com>
+From: Florian Weimer <fweimer@redhat.com>
+Date: Sun, 28 May 2017 20:37:40 +0200
+Subject: [PATCH 1/3] rtld: Completely ignore LD_LIBRARY_PATH for AT_SECURE=1
+ programs
+To: libc-alpha@sourceware.org
+
+LD_LIBRARY_PATH can only be used to reorder system search paths, which
+is not useful functionality.
+---
+ elf/rtld.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/elf/rtld.c b/elf/rtld.c
+index 319ef06..824b6cf 100644
+--- a/elf/rtld.c
++++ b/elf/rtld.c
+@@ -2419,7 +2419,8 @@ process_envvars (enum mode *modep)
+ 
+ 	case 12:
+ 	  /* The library search path.  */
+-	  if (memcmp (envline, "LIBRARY_PATH", 12) == 0)
++	  if (!__libc_enable_secure
++	      && memcmp (envline, "LIBRARY_PATH", 12) == 0)
+ 	    {
+ 	      library_path = &envline[13];
+ 	      break;
+-- 
+2.9.4
+
diff --git a/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch
new file mode 100644
index 00000000000..76be2a3308f
--- /dev/null
+++ b/pkgs/development/libraries/glibc/CVE-2017-1000366-rtld-LD_PRELOAD.patch
@@ -0,0 +1,115 @@
+From 65ff0b7a085b85271ec8fde99f542281b495e3bc Mon Sep 17 00:00:00 2001
+Message-Id: <65ff0b7a085b85271ec8fde99f542281b495e3bc.1495998948.git.fweimer@redhat.com>
+In-Reply-To: <cover.1495998948.git.fweimer@redhat.com>
+References: <cover.1495998948.git.fweimer@redhat.com>
+From: Florian Weimer <fweimer@redhat.com>
+Date: Sun, 28 May 2017 20:57:40 +0200
+Subject: [PATCH 2/3] rtld: Reject overly long LD_PRELOAD path elements
+To: libc-alpha@sourceware.org
+
+---
+ elf/rtld.c | 69 +++++++++++++++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 53 insertions(+), 16 deletions(-)
+
+diff --git a/elf/rtld.c b/elf/rtld.c
+index 824b6cf..30f0cae 100644
+--- a/elf/rtld.c
++++ b/elf/rtld.c
+@@ -99,6 +99,22 @@ uintptr_t __pointer_chk_guard_local
+ strong_alias (__pointer_chk_guard_local, __pointer_chk_guard)
+ #endif
+ 
++/* Check that AT_SECURE=0, or that the passed name does not contain
++   directories and is not overly long.  Reject empty names
++   unconditionally.  */
++static bool
++dso_name_valid_for_suid (const char *p)
++{
++  if (__glibc_unlikely (__libc_enable_secure))
++    {
++      /* Ignore pathnames with directories for AT_SECURE=1
++	 programs, and also skip overlong names.  */
++      size_t len = strlen (p);
++      if (len >= NAME_MAX || memchr (p, '/', len) != NULL)
++	return false;
++    }
++  return *p != '\0';
++}
+ 
+ /* List of auditing DSOs.  */
+ static struct audit_list
+@@ -716,6 +732,46 @@ static const char *preloadlist attribute_relro;
+ /* Nonzero if information about versions has to be printed.  */
+ static int version_info attribute_relro;
+ 
++/* The LD_PRELOAD environment variable gives list of libraries
++   separated by white space or colons that are loaded before the
++   executable's dependencies and prepended to the global scope list.
++   (If the binary is running setuid all elements containing a '/' are
++   ignored since it is insecure.)  Return the number of preloads
++   performed.  */
++unsigned int
++handle_ld_preload (const char *preloadlist, struct link_map *main_map)
++{
++  unsigned int npreloads = 0;
++  const char *p = preloadlist;
++#ifdef PATH_MAX
++  char fname[PATH_MAX];
++#else
++  char fname[4096];
++#endif
++
++  while (*p != '\0')
++    {
++      /* Split preload list at space/colon.  */
++      size_t len = strcspn (p, " :");
++      if (len > 0 && len < sizeof(fname))
++	{
++	  memcpy (fname, p, len);
++	  fname[len] = '\0';
++	}
++      else
++	fname[0] = '\0';
++
++      /* Skip over the substring and the following delimiter.  */
++      p += len;
++      if (*p == ' ' || *p == ':')
++	++p;
++
++      if (dso_name_valid_for_suid (fname))
++	npreloads += do_preload (fname, main_map, "LD_PRELOAD");
++    }
++  return npreloads;
++}
++
+ static void
+ dl_main (const ElfW(Phdr) *phdr,
+ 	 ElfW(Word) phnum,
+@@ -1462,23 +1514,8 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
+ 
+   if (__glibc_unlikely (preloadlist != NULL))
+     {
+-      /* The LD_PRELOAD environment variable gives list of libraries
+-	 separated by white space or colons that are loaded before the
+-	 executable's dependencies and prepended to the global scope
+-	 list.  If the binary is running setuid all elements
+-	 containing a '/' are ignored since it is insecure.  */
+-      char *list = strdupa (preloadlist);
+-      char *p;
+-
+       HP_TIMING_NOW (start);
+-
+-      /* Prevent optimizing strsep.  Speed is not important here.  */
+-      while ((p = (strsep) (&list, " :")) != NULL)
+-	if (p[0] != '\0'
+-	    && (__builtin_expect (! __libc_enable_secure, 1)
+-		|| strchr (p, '/') == NULL))
+-	  npreloads += do_preload (p, main_map, "LD_PRELOAD");
+-
++      npreloads += handle_ld_preload (preloadlist, main_map);
+       HP_TIMING_NOW (stop);
+       HP_TIMING_DIFF (diff, start, stop);
+       HP_TIMING_ACCUM_NT (load_time, diff);
+-- 
+2.9.4
+
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index db80a8be299..647a34e95db 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -59,8 +59,16 @@ stdenv.mkDerivation ({
          "/bin:/usr/bin", which is inappropriate on NixOS machines. This
          patch extends the search path by "/run/current-system/sw/bin". */
       ./fix_path_attribute_in_getconf.patch
+
+      /* Stack Clash */
+      ./CVE-2017-1000366-rtld-LD_LIBRARY_PATH.patch
+      ./CVE-2017-1000366-rtld-LD_PRELOAD.patch
+      ./CVE-2017-1000366-rtld-LD_AUDIT.patch
     ]
-      ++ lib.optional stdenv.isi686 ./fix-i686-memchr.patch;
+    ++ lib.optionals stdenv.isi686 [
+      ./fix-i686-memchr.patch
+      ./i686-fix-vectorized-strcspn.patch
+    ];
 
   postPatch =
     # Needed for glibc to build with the gnumake 3.82
diff --git a/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch b/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch
new file mode 100644
index 00000000000..ba4ec7c60cb
--- /dev/null
+++ b/pkgs/development/libraries/glibc/i686-fix-vectorized-strcspn.patch
@@ -0,0 +1,42 @@
+From adc7e06fb412a2a1ee52f8cb788caf436335b9f3 Mon Sep 17 00:00:00 2001
+From: Florian Weimer <fweimer@redhat.com>
+Date: Wed, 14 Jun 2017 08:11:22 +0200
+Subject: [PATCH] i686: Add missing IS_IN (libc) guards to vectorized strcspn
+
+Since commit d957c4d3fa48d685ff2726c605c988127ef99395 (i386: Compile
+rtld-*.os with -mno-sse -mno-mmx -mfpmath=387), vector intrinsics can
+no longer be used in ld.so, even if the compiled code never makes it
+into the final ld.so link.  This commit adds the missing IS_IN (libc)
+guard to the SSE 4.2 strcspn implementation, so that it can be used from
+ld.so in the future.
+
+(cherry picked from commit 69052a3a95da37169a08f9e59b2cc1808312753c)
+---
+ ChangeLog                               | 5 +++++
+ sysdeps/i386/i686/multiarch/strcspn-c.c | 6 ++++--
+ sysdeps/i386/i686/multiarch/varshift.c  | 4 +++-
+ 3 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/sysdeps/i386/i686/multiarch/strcspn-c.c b/sysdeps/i386/i686/multiarch/strcspn-c.c
+index 6d61e19..ec230fb 100644
+--- a/sysdeps/i386/i686/multiarch/strcspn-c.c
++++ b/sysdeps/i386/i686/multiarch/strcspn-c.c
+@@ -1,2 +1,4 @@
+-#define __strcspn_sse2 __strcspn_ia32
+-#include <sysdeps/x86_64/multiarch/strcspn-c.c>
++#if IS_IN (libc)
++# define __strcspn_sse2 __strcspn_ia32
++# include <sysdeps/x86_64/multiarch/strcspn-c.c>
++#endif
+diff --git a/sysdeps/i386/i686/multiarch/varshift.c b/sysdeps/i386/i686/multiarch/varshift.c
+index 7760b96..6742a35 100644
+--- a/sysdeps/i386/i686/multiarch/varshift.c
++++ b/sysdeps/i386/i686/multiarch/varshift.c
+@@ -1 +1,3 @@
+-#include <sysdeps/x86_64/multiarch/varshift.c>
++#if IS_IN (libc)
++# include <sysdeps/x86_64/multiarch/varshift.c>
++#endif
+-- 
+2.9.3
+
diff --git a/pkgs/development/libraries/libelf/default.nix b/pkgs/development/libraries/libelf/default.nix
index dcd5d1d7a93..5cf74164f0f 100644
--- a/pkgs/development/libraries/libelf/default.nix
+++ b/pkgs/development/libraries/libelf/default.nix
@@ -11,9 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0vf7s9dwk2xkmhb79aigqm0x0yfbw1j0b9ksm51207qwr179n6jr";
   };
 
-  # TODO(@Ericson2314) Make unconditional next hash break
-  patches = if hostPlatform == buildPlatform then null else [
-    ./cross-ar.patch
+  patches = [
+    ./dont-hardcode-ar.patch
   ];
 
   doCheck = true;
diff --git a/pkgs/development/libraries/libelf/cross-ar.patch b/pkgs/development/libraries/libelf/dont-hardcode-ar.patch
index e282d9005db..e282d9005db 100644
--- a/pkgs/development/libraries/libelf/cross-ar.patch
+++ b/pkgs/development/libraries/libelf/dont-hardcode-ar.patch
diff --git a/pkgs/development/libraries/libev/default.nix b/pkgs/development/libraries/libev/default.nix
index 37e0c9b3431..d77337c912b 100644
--- a/pkgs/development/libraries/libev/default.nix
+++ b/pkgs/development/libraries/libev/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "libev-${version}";
-  version="4.22";
+  version="4.24";
 
   src = fetchurl {
     url = "http://dist.schmorp.de/libev/Attic/${name}.tar.gz";
-    sha256 = "1mhvy38g9947bbr0n0hzc34zwfvvfd99qgzpkbap8g2lmkl7jq3k";
+    sha256 = "08gqsza1czx0nf62nkk183jb0946yzjsymaacxbzdgcs8z9r6dcp";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index a056f148683..89946512410 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -13,11 +13,6 @@ stdenv.mkDerivation rec {
     sha256 = "0y1ij745r4p48mxq84rax40p10ln7fc7m243p8k8sia519i3dxfc";
   };
 
-  patches = lib.optionals stdenv.isCygwin [
-    ./libiconv-1.14-reloc.patch
-    ./libiconv-1.14-wchar.patch
-  ];
-
   postPatch =
     lib.optionalString ((hostPlatform != buildPlatform && hostPlatform.libc == "msvcrt") || stdenv.cc.nativeLibc)
       ''
@@ -25,12 +20,7 @@ stdenv.mkDerivation rec {
       '';
 
   configureFlags =
-  # On Cygwin, Libtool produces a `.dll.a', which is not a "real" DLL
-  # (Windows' linker would need to be used somehow to produce an actual
-  # DLL.)  Thus, build the static library too, and this is what Gettext
-  # will actually use.
-    lib.optional stdenv.isCygwin "--enable-static"
-    ++ lib.optional stdenv.isFreeBSD "--with-pic";
+    lib.optional stdenv.isFreeBSD "--with-pic";
 
   crossAttrs = {
     # Disable stripping to avoid "libiconv.a: Archive has no index" (MinGW).
diff --git a/pkgs/development/libraries/libiconv/libiconv-1.14-reloc.patch b/pkgs/development/libraries/libiconv/libiconv-1.14-reloc.patch
deleted file mode 100644
index 005e3379d16..00000000000
--- a/pkgs/development/libraries/libiconv/libiconv-1.14-reloc.patch
+++ /dev/null
@@ -1,269 +0,0 @@
---- libiconv-1.14/lib/relocatable.c	2011-08-07 13:48:03.000000000 -0400
-+++ libiconv-1.14/lib/relocatable.c	2011-10-15 03:14:13.195133600 -0400
-@@ -2,20 +2,18 @@
-    Copyright (C) 2003-2006, 2008-2011 Free Software Foundation, Inc.
-    Written by Bruno Haible <bruno@clisp.org>, 2003.
- 
--   This program is free software; you can redistribute it and/or modify it
--   under the terms of the GNU Library General Public License as published
--   by the Free Software Foundation; either version 2, or (at your option)
--   any later version.
-+   This program is free software: you can redistribute it and/or modify
-+   it under the terms of the GNU Lesser General Public License as published by
-+   the Free Software Foundation; either version 2.1 of the License, or
-+   (at your option) any later version.
- 
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
--   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
--   Library General Public License for more details.
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU Lesser General Public License for more details.
- 
--   You should have received a copy of the GNU Library General Public
--   License along with this program; if not, write to the Free Software
--   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
--   USA.  */
-+   You should have received a copy of the GNU Lesser General Public License
-+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
- 
- 
- /* Tell glibc's <stdio.h> to provide a prototype for getline().
-@@ -87,6 +85,19 @@
- # define FILE_SYSTEM_PREFIX_LEN(P) 0
- #endif
- 
-+/* Whether to enable the more costly support for relocatable libraries.
-+   It allows libraries to be have been installed with a different original
-+   prefix than the program.  But it is quite costly, especially on Cygwin
-+   platforms, see below.  Therefore we enable it by default only on native
-+   Win32 platforms.  */
-+#ifndef ENABLE_COSTLY_RELOCATABLE
-+# if (defined _WIN32 || defined __WIN32__) && !defined __CYGWIN__
-+#  define ENABLE_COSTLY_RELOCATABLE 1
-+# else
-+#  define ENABLE_COSTLY_RELOCATABLE 0
-+# endif
-+#endif
-+
- /* Original installation prefix.  */
- static char *orig_prefix;
- static size_t orig_prefix_len;
-@@ -156,7 +167,7 @@
- #endif
- }
- 
--#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR)
-+#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE)
- 
- /* Convenience function:
-    Computes the current installation prefix, based on the original
-@@ -286,7 +297,7 @@
- 
- #endif /* !IN_LIBRARY || PIC */
- 
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
- 
- /* Full pathname of shared library, or NULL.  */
- static char *shared_library_fullname;
-@@ -332,7 +343,9 @@
- #if (defined __linux__ && (__GLIBC__ >= 2 || defined __UCLIBC__)) || defined __CYGWIN__
-   /* Linux has /proc/self/maps. glibc 2 and uClibc have the getline()
-      function.
--     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.  */
-+     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.
-+     But it is costly: ca. 0.3 ms on Linux, 3 ms on Cygwin 1.5, and 5 ms on
-+     Cygwin 1.7.  */
-   FILE *fp;
- 
-   /* Open the current process' maps file.  It describes one VMA per line.  */
-@@ -405,7 +418,7 @@
- const char *
- relocate (const char *pathname)
- {
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
-   static int initialized;
- 
-   /* Initialization code for a shared library.  */
---- libiconv-1.14/libcharset/lib/relocatable.c	2011-08-07 13:48:03.000000000 -0400
-+++ libiconv-1.14/libcharset/lib/relocatable.c	2011-10-15 03:14:27.878133600 -0400
-@@ -2,20 +2,18 @@
-    Copyright (C) 2003-2006, 2008-2011 Free Software Foundation, Inc.
-    Written by Bruno Haible <bruno@clisp.org>, 2003.
- 
--   This program is free software; you can redistribute it and/or modify it
--   under the terms of the GNU Library General Public License as published
--   by the Free Software Foundation; either version 2, or (at your option)
--   any later version.
-+   This program is free software: you can redistribute it and/or modify
-+   it under the terms of the GNU Lesser General Public License as published by
-+   the Free Software Foundation; either version 2.1 of the License, or
-+   (at your option) any later version.
- 
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
--   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
--   Library General Public License for more details.
-+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+   GNU Lesser General Public License for more details.
- 
--   You should have received a copy of the GNU Library General Public
--   License along with this program; if not, write to the Free Software
--   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
--   USA.  */
-+   You should have received a copy of the GNU Lesser General Public License
-+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
- 
- 
- /* Tell glibc's <stdio.h> to provide a prototype for getline().
-@@ -87,6 +85,19 @@
- # define FILE_SYSTEM_PREFIX_LEN(P) 0
- #endif
- 
-+/* Whether to enable the more costly support for relocatable libraries.
-+   It allows libraries to be have been installed with a different original
-+   prefix than the program.  But it is quite costly, especially on Cygwin
-+   platforms, see below.  Therefore we enable it by default only on native
-+   Win32 platforms.  */
-+#ifndef ENABLE_COSTLY_RELOCATABLE
-+# if (defined _WIN32 || defined __WIN32__) && !defined __CYGWIN__
-+#  define ENABLE_COSTLY_RELOCATABLE 1
-+# else
-+#  define ENABLE_COSTLY_RELOCATABLE 0
-+# endif
-+#endif
-+
- /* Original installation prefix.  */
- static char *orig_prefix;
- static size_t orig_prefix_len;
-@@ -156,7 +167,7 @@
- #endif
- }
- 
--#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR)
-+#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE)
- 
- /* Convenience function:
-    Computes the current installation prefix, based on the original
-@@ -286,7 +297,7 @@
- 
- #endif /* !IN_LIBRARY || PIC */
- 
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
- 
- /* Full pathname of shared library, or NULL.  */
- static char *shared_library_fullname;
-@@ -332,7 +343,9 @@
- #if (defined __linux__ && (__GLIBC__ >= 2 || defined __UCLIBC__)) || defined __CYGWIN__
-   /* Linux has /proc/self/maps. glibc 2 and uClibc have the getline()
-      function.
--     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.  */
-+     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.
-+     But it is costly: ca. 0.3 ms on Linux, 3 ms on Cygwin 1.5, and 5 ms on
-+     Cygwin 1.7.  */
-   FILE *fp;
- 
-   /* Open the current process' maps file.  It describes one VMA per line.  */
-@@ -405,7 +418,7 @@
- const char *
- relocate (const char *pathname)
- {
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
-   static int initialized;
- 
-   /* Initialization code for a shared library.  */
---- libiconv-1.14/srclib/relocatable.c	2011-08-07 09:42:06.000000000 -0400
-+++ libiconv-1.14/srclib/relocatable.c	2011-10-15 03:14:37.739133600 -0400
-@@ -3,16 +3,16 @@
-    Written by Bruno Haible <bruno@clisp.org>, 2003.
- 
-    This program is free software: you can redistribute it and/or modify
--   it under the terms of the GNU General Public License as published by
--   the Free Software Foundation; either version 3 of the License, or
-+   it under the terms of the GNU Lesser General Public License as published by
-+   the Free Software Foundation; either version 2.1 of the License, or
-    (at your option) any later version.
- 
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
--   GNU General Public License for more details.
-+   GNU Lesser General Public License for more details.
- 
--   You should have received a copy of the GNU General Public License
-+   You should have received a copy of the GNU Lesser General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
- 
- 
-@@ -85,6 +85,19 @@
- # define FILE_SYSTEM_PREFIX_LEN(P) 0
- #endif
- 
-+/* Whether to enable the more costly support for relocatable libraries.
-+   It allows libraries to be have been installed with a different original
-+   prefix than the program.  But it is quite costly, especially on Cygwin
-+   platforms, see below.  Therefore we enable it by default only on native
-+   Win32 platforms.  */
-+#ifndef ENABLE_COSTLY_RELOCATABLE
-+# if (defined _WIN32 || defined __WIN32__) && !defined __CYGWIN__
-+#  define ENABLE_COSTLY_RELOCATABLE 1
-+# else
-+#  define ENABLE_COSTLY_RELOCATABLE 0
-+# endif
-+#endif
-+
- /* Original installation prefix.  */
- static char *orig_prefix;
- static size_t orig_prefix_len;
-@@ -154,7 +167,7 @@
- #endif
- }
- 
--#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR)
-+#if !defined IN_LIBRARY || (defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE)
- 
- /* Convenience function:
-    Computes the current installation prefix, based on the original
-@@ -284,7 +297,7 @@
- 
- #endif /* !IN_LIBRARY || PIC */
- 
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
- 
- /* Full pathname of shared library, or NULL.  */
- static char *shared_library_fullname;
-@@ -330,7 +343,9 @@
- #if (defined __linux__ && (__GLIBC__ >= 2 || defined __UCLIBC__)) || defined __CYGWIN__
-   /* Linux has /proc/self/maps. glibc 2 and uClibc have the getline()
-      function.
--     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.  */
-+     Cygwin >= 1.5 has /proc/self/maps and the getline() function too.
-+     But it is costly: ca. 0.3 ms on Linux, 3 ms on Cygwin 1.5, and 5 ms on
-+     Cygwin 1.7.  */
-   FILE *fp;
- 
-   /* Open the current process' maps file.  It describes one VMA per line.  */
-@@ -403,7 +418,7 @@
- const char *
- relocate (const char *pathname)
- {
--#if defined PIC && defined INSTALLDIR
-+#if defined PIC && defined INSTALLDIR && ENABLE_COSTLY_RELOCATABLE
-   static int initialized;
- 
-   /* Initialization code for a shared library.  */
---- libiconv-1.14/srcm4/gnulib-comp.m4	2011-08-07 09:42:12.000000000 -0400
-+++ libiconv-1.14/srcm4/gnulib-comp.m4	2011-08-30 02:40:45.597317000 -0400
-@@ -164,6 +164,7 @@ gl_UNISTD_MODULE_INDICATOR([readlink])
- gl_RELOCATABLE([$gl_source_base])
- if test $RELOCATABLE = yes; then
-   AC_LIBOBJ([progreloc])
-+  AC_LIBOBJ([relocatable])
- fi
- gl_FUNC_READLINK_SEPARATE
- gl_CANONICALIZE_LGPL_SEPARATE
diff --git a/pkgs/development/libraries/libiconv/libiconv-1.14-wchar.patch b/pkgs/development/libraries/libiconv/libiconv-1.14-wchar.patch
deleted file mode 100644
index 0e4ddd931bb..00000000000
--- a/pkgs/development/libraries/libiconv/libiconv-1.14-wchar.patch
+++ /dev/null
@@ -1,102 +0,0 @@
---- libiconv-1.14/libcharset/lib/localcharset.c	2011-02-28 17:43:35.000000000 -0500
-+++ libiconv-1.14/libcharset/lib/localcharset.c	2011-08-28 00:16:57.238000000 -0400
-@@ -54,10 +54,6 @@
- #   include <locale.h>
- #  endif
- # endif
--# ifdef __CYGWIN__
--#  define WIN32_LEAN_AND_MEAN
--#  include <windows.h>
--# endif
- #elif defined WIN32_NATIVE
- # define WIN32_LEAN_AND_MEAN
- # include <windows.h>
-@@ -124,7 +120,7 @@
-   cp = charset_aliases;
-   if (cp == NULL)
-     {
--#if !(defined DARWIN7 || defined VMS || defined WIN32_NATIVE || defined __CYGWIN__)
-+#if !(defined DARWIN7 || defined VMS || defined WIN32_NATIVE)
-       const char *dir;
-       const char *base = "charset.alias";
-       char *file_name;
-@@ -309,7 +305,7 @@
-            "DECKOREAN" "\0" "EUC-KR" "\0";
- # endif
- 
--# if defined WIN32_NATIVE || defined __CYGWIN__
-+# if defined WIN32_NATIVE
-       /* To avoid the troubles of installing a separate file in the same
-          directory as the DLL and of retrieving the DLL's directory at
-          runtime, simply inline the aliases here.  */
-@@ -365,64 +361,12 @@
- 
- # if HAVE_LANGINFO_CODESET
- 
--  /* Most systems support nl_langinfo (CODESET) nowadays.  */
--  codeset = nl_langinfo (CODESET);
--
--#  ifdef __CYGWIN__
--  /* Cygwin < 1.7 does not have locales.  nl_langinfo (CODESET) always
--     returns "US-ASCII".  Return the suffix of the locale name from the
--     environment variables (if present) or the codepage as a number.  */
--  if (codeset != NULL && strcmp (codeset, "US-ASCII") == 0)
--    {
--      const char *locale;
--      static char buf[2 + 10 + 1];
--
--      locale = getenv ("LC_ALL");
--      if (locale == NULL || locale[0] == '\0')
--        {
--          locale = getenv ("LC_CTYPE");
--          if (locale == NULL || locale[0] == '\0')
--            locale = getenv ("LANG");
--        }
--      if (locale != NULL && locale[0] != '\0')
--        {
--          /* If the locale name contains an encoding after the dot, return
--             it.  */
--          const char *dot = strchr (locale, '.');
--
--          if (dot != NULL)
--            {
--              const char *modifier;
--
--              dot++;
--              /* Look for the possible @... trailer and remove it, if any.  */
--              modifier = strchr (dot, '@');
--              if (modifier == NULL)
--                return dot;
--              if (modifier - dot < sizeof (buf))
--                {
--                  memcpy (buf, dot, modifier - dot);
--                  buf [modifier - dot] = '\0';
--                  return buf;
--                }
--            }
--        }
--
--      /* Woe32 has a function returning the locale's codepage as a number:
--         GetACP().  This encoding is used by Cygwin, unless the user has set
--         the environment variable CYGWIN=codepage:oem (which very few people
--         do).
--         Output directed to console windows needs to be converted (to
--         GetOEMCP() if the console is using a raster font, or to
--         GetConsoleOutputCP() if it is using a TrueType font).  Cygwin does
--         this conversion transparently (see winsup/cygwin/fhandler_console.cc),
--         converting to GetConsoleOutputCP().  This leads to correct results,
--         except when SetConsoleOutputCP has been called and a raster font is
--         in use.  */
--      sprintf (buf, "CP%u", GetACP ());
--      codeset = buf;
--    }
--#  endif
-+  /* Most systems support nl_langinfo (CODESET) nowadays.
-+     POSIX allows that the returned pointer may point to a static area that
-+     may be overwritten by subsequent calls to setlocale or nl_langinfo. */
-+  static char codeset_buf[64];
-+  codeset_buf[0] = '\0';
-+  codeset = strncat (codeset_buf, nl_langinfo (CODESET), sizeof (codeset_buf));
- 
- # else
- 
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index 0a1fe70bd1d..23e6a37f918 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, libgcrypt, curl, gnutls, pkgconfig }:
 
 stdenv.mkDerivation rec {
-  name = "libmicrohttpd-0.9.53";
+  name = "libmicrohttpd-0.9.55";
 
   src = fetchurl {
     url = "mirror://gnu/libmicrohttpd/${name}.tar.gz";
-    sha256 = "1i1c7hwjmc4n31cgmfycgi8xsnm3kyc4zzdd4dir6i0z70nyq5cv";
+    sha256 = "1y6h1slav5l6k8zyb01dpw65dscdgxxgfa3a0z9qnn7jr66sn70c";
   };
 
   outputs = [ "out" "dev" "devdoc" "info" ];
diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index a9e98d41e75..118b8af5a6f 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -19,6 +19,12 @@ stdenv.mkDerivation rec {
 
   patches = stdenv.lib.optional stdenv.isSunOS ./patch-ah.patch;
 
+  # fixes: can't build x86_64-unknown-cygwin shared library unless -no-undefined is specified
+  postPatch = optionalString hostPlatform.isCygwin ''
+    substituteInPlace tests/plugins/Makefile.in \
+      --replace 'la_LDFLAGS =' 'la_LDFLAGS = $(WIN32_EXTRA_LDFLAGS)'
+  '';
+
   outputs = [ "bin" "dev" "out" "doc" ] ++ stdenv.lib.optional pythonSupport "py";
 
   buildInputs = [ libxml2.dev ] ++ stdenv.lib.optionals pythonSupport [ libxml2.py python2 ];
diff --git a/pkgs/development/libraries/mesa/default.nix b/pkgs/development/libraries/mesa/default.nix
index d606fcd1548..e1bd4255636 100644
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@@ -67,7 +67,7 @@ let
 in
 
 let
-  version = "17.1.2";
+  version = "17.1.4";
   branch  = head (splitString "." version);
   driverLink = "/run/opengl-driver" + optionalString stdenv.isi686 "-32";
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
       "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
       "https://launchpad.net/mesa/trunk/${version}/+download/mesa-${version}.tar.xz"
     ];
-    sha256 = "0937804f43746339b1f9540d8f9c8b4a1bb3d3eec0e4020eac283b8799798239";
+    sha256 = "06f3b0e6a28f0d20b7f3391cf67fe89ae98ecd0a686cd545da76557b6cec9cad";
   };
 
   prePatch = "patchShebangs .";
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 46283e371aa..e6db7af6ee2 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -46,6 +46,9 @@ stdenv.mkDerivation rec {
   buildInputs = lib.optional (mouseSupport && stdenv.isLinux) gpm;
 
   preConfigure = ''
+    # These paths end up in the default lookup chain.
+    export TERMINFO_DIRS=/etc/terminfo
+
     export PKG_CONFIG_LIBDIR="$dev/lib/pkgconfig"
     mkdir -p "$PKG_CONFIG_LIBDIR"
     configureFlagsArray+=(
@@ -61,8 +64,6 @@ stdenv.mkDerivation rec {
            -e '/CPPFLAGS="$CPPFLAGS/s/ -D_XOPEN_SOURCE_EXTENDED//' \
         configure
     CFLAGS=-D_XOPEN_SOURCE_EXTENDED
-  '' + lib.optionalString stdenv.isCygwin ''
-    sed -i -e 's,LIB_SUFFIX="t,LIB_SUFFIX=",' configure
   '';
 
   enableParallelBuilding = true;
@@ -122,7 +123,7 @@ stdenv.mkDerivation rec {
     moveToOutput "bin/tset" "$out"
   '';
 
-  preFixup = ''
+  preFixup = lib.optionalString (!hostPlatform.isCygwin) ''
     rm "$out"/lib/*.a
   '';
 
diff --git a/pkgs/development/libraries/openldap/default.nix b/pkgs/development/libraries/openldap/default.nix
index 05c03dcd842..7155d0f48a8 100644
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@@ -1,11 +1,11 @@
 { stdenv, fetchurl, openssl, cyrus_sasl, db, groff, libtool }:
 
 stdenv.mkDerivation rec {
-  name = "openldap-2.4.44";
+  name = "openldap-2.4.45";
 
   src = fetchurl {
     url = "http://www.openldap.org/software/download/OpenLDAP/openldap-release/${name}.tgz";
-    sha256 = "0044p20hx07fwgw2mbwj1fkx04615hhs1qyx4mawj2bhqvrnppnp";
+    sha256 = "091qvwk5dkcpp17ziabcnh3rg3m7qwzw2pihfcd1d5fdxgywzmnd";
   };
 
   # TODO: separate "out" and "bin"
diff --git a/pkgs/development/libraries/openssl/1.0.1-cygwin64.patch b/pkgs/development/libraries/openssl/1.0.1-cygwin64.patch
deleted file mode 100644
index 63112abf3a3..00000000000
--- a/pkgs/development/libraries/openssl/1.0.1-cygwin64.patch
+++ /dev/null
@@ -1,136 +0,0 @@
---- openssl-1.0.1e/config      2014-10-23 15:53:23.436600000 +0200
-+++ openssl-1.0.1e/config      2014-10-23 15:55:33.837000000 +0200
-@@ -832,6 +832,7 @@
-   # these are all covered by the catchall below
-   # *-dgux) OUT="dgux" ;;
-   mips-sony-newsos4) OUT="newsos4-gcc" ;;
-+  x86_64-*-cygwin) OUT="Cygwin-x86_64" ;;
-   *-*-cygwin_pre1.3) OUT="Cygwin-pre1.3" ;;
-   *-*-cygwin) OUT="Cygwin" ;;
-   t3e-cray-unicosmk) OUT="cray-t3e" ;;
---- openssl-1.0.1e/Configure	2013-02-17 17:06:18.682058900 -0600
-+++ openssl-1.0.1e/Configure	2013-02-17 16:38:08.000000000 -0600
-@@ -550,6 +550,7 @@ my %table=(
- "Cygwin-pre1.3", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
- "Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall:::CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:coff:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
- "debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
-+"Cygwin-x86_64", "gcc:-DTERMIOS -DL_ENDIAN -O3 -Wall:::CYGWIN32::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:mingw64:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
- 
- # NetWare from David Ward (dsward@novell.com)
- # requires either MetroWerks NLM development tools, or gcc / nlmconv
-@@ -1128,7 +1129,7 @@ foreach (sort @experimental)
- 
- my $IsMK1MF=scalar grep /^$target$/,@MK1MF_Builds;
- 
--$exe_ext=".exe" if ($target eq "Cygwin" || $target eq "DJGPP" || $target =~ /^mingw/);
-+$exe_ext=".exe" if ($target =~ /^Cygwin/ || $target eq "DJGPP" || $target =~ /^mingw/);
- $exe_ext=".nlm" if ($target =~ /netware/);
- $exe_ext=".pm"  if ($target =~ /vos/);
- $openssldir="/usr/local/ssl" if ($openssldir eq "" and $prefix eq "");
---- openssl-1.0.1e/Makefile.org	2013-02-11 09:26:04.000000000 -0600
-+++ openssl-1.0.1e/Makefile.org	2013-02-17 16:38:08.000000000 -0600
-@@ -326,9 +326,9 @@ clean-shared:
- 			done; \
- 		fi; \
- 		( set -x; rm -f lib$$i$(SHLIB_EXT) ); \
--		if [ "$(PLATFORM)" = "Cygwin" ]; then \
-+		case "$(PLATFORM)" in Cygwin*)  \
- 			( set -x; rm -f cyg$$i$(SHLIB_EXT) lib$$i$(SHLIB_EXT).a ); \
--		fi; \
-+		esac; \
- 	done
- 
- link-shared:
-@@ -571,11 +571,7 @@ install_sw:
- 		do \
- 			if [ -f "$$i" -o -f "$$i.a" ]; then \
- 			(       echo installing $$i; \
--				if [ "$(PLATFORM)" != "Cygwin" ]; then \
--					cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
--					chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
--					mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i; \
--				else \
-+				case "$(PLATFORM)" in Cygwin*) \
- 					c=`echo $$i | sed 's/^lib\(.*\)\.dll\.a/cyg\1-$(SHLIB_VERSION_NUMBER).dll/'`; \
- 					cp $$c $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c.new; \
- 					chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/bin/$$c.new; \
-@@ -583,7 +579,12 @@ install_sw:
- 					cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
- 					chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
- 					mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i; \
--				fi ); \
-+					;; \
-+				*) \
-+					cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
-+					chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new; \
-+					mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/$$i; \
-+				esac ); \
- 				if expr $(PLATFORM) : 'mingw' > /dev/null; then \
- 				(	case $$i in \
- 						*crypto*) i=libeay32.dll;; \
-@@ -643,9 +644,9 @@ install_docs:
- 	@pod2man="`cd ./util; ./pod2mantest $(PERL)`"; \
- 	here="`pwd`"; \
- 	filecase=; \
--	if [ "$(PLATFORM)" = "DJGPP" -o "$(PLATFORM)" = "Cygwin" -o "$(PLATFORM)" = "mingw" ]; then \
-+	case "$(PLATFORM)" in DJGPP|Cygwin*|mingw*) \
- 		filecase=-i; \
--	fi; \
-+	esac; \
- 	set -e; for i in doc/apps/*.pod; do \
- 		fn=`basename $$i .pod`; \
- 		sec=`$(PERL) util/extract-section.pl 1 < $$i`; \
---- openssl-1.0.1e/engines/ccgost/Makefile	2013-02-11 09:26:04.000000000 -0600
-+++ openssl-1.0.1e/engines/ccgost/Makefile	2013-02-17 17:05:47.759290200 -0600
-@@ -45,7 +45,11 @@ install:
- 		set -e; \
- 		echo installing $(LIBNAME); \
- 		pfx=lib; \
--		if [ "$(PLATFORM)" != "Cygwin" ]; then \
-+		case "$(PLATFORM)" in Cygwin*) \
-+			sfx=".so"; \
-+			cp cyg$(LIBNAME).dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx.new; \
-+			;; \
-+		*) \
- 			case "$(CFLAGS)" in \
- 			*DSO_BEOS*) sfx=".so";; \
- 			*DSO_DLFCN*) sfx=`expr "$(SHLIB_EXT)" : '.*\(\.[a-z][a-z]*\)' \| ".so"`;; \
-@@ -54,10 +58,7 @@ install:
- 			*) sfx=".bad";; \
- 			esac; \
- 			cp $${pfx}$(LIBNAME)$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx.new; \
--		else \
--			sfx=".so"; \
--			cp cyg$(LIBNAME).dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx.new; \
--		fi; \
-+		esac; \
- 		chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx.new; \
- 		mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$${pfx}$(LIBNAME)$$sfx; \
- 	fi
---- openssl-1.0.1i/engines/Makefile	2014-10-23 16:08:19.360200000 +0200
-+++ openssl-1.0.1i/engines/Makefile	2014-10-23 16:10:54.205800000 +0200
-@@ -111,7 +111,11 @@
- 		for l in $(LIBNAMES); do \
- 			( echo installing $$l; \
- 			  pfx=lib; \
--			  if [ "$(PLATFORM)" != "Cygwin" ]; then \
-+			  case "$(PLATFORM)" in Cygwin*) \
-+				sfx=".so"; \
-+				cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
-+				;; \
-+			  *) \
- 				case "$(CFLAGS)" in \
- 				*DSO_BEOS*)	sfx=".so";;	\
- 				*DSO_DLFCN*)	sfx=`expr "$(SHLIB_EXT)" : '.*\(\.[a-z][a-z]*\)' \| ".so"`;;	\
-@@ -120,10 +124,7 @@
- 				*)		sfx=".bad";;	\
- 				esac; \
- 				cp $$pfx$$l$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
--			  else \
--				sfx=".so"; \
--				cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
--			  fi; \
-+			  esac; \
- 			  chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
- 			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
- 		done; \
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index b3ce2fdbbb0..2120e60ec6a 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -24,7 +24,6 @@ let
       ++ [ ./nix-ssl-cert-file.patch ]
       ++ optional (versionOlder version "1.1.0")
           (if stdenv.isDarwin then ./use-etc-ssl-certs-darwin.patch else ./use-etc-ssl-certs.patch)
-      ++ optional stdenv.isCygwin ./1.0.1-cygwin64.patch
       ++ optional (versionOlder version "1.0.2" && hostPlatform.isDarwin)
            ./darwin-arch.patch;
 
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index a8031716230..5230df99524 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -3,11 +3,11 @@
 assert interactive -> readline != null && ncurses != null;
 
 stdenv.mkDerivation {
-  name = "sqlite-3.17.0";
+  name = "sqlite-3.19.3";
 
   src = fetchurl {
-    url = "http://sqlite.org/2017/sqlite-autoconf-3170000.tar.gz";
-    sha256 = "0k472gq0p706jq4529p60znvw02hdf172qxgbdv59q0n7anqbr54";
+    url = "http://sqlite.org/2017/sqlite-autoconf-3190300.tar.gz";
+    sha256 = "00b3l2qglpl1inx21fckiwxnfq5xf6441flc79rqg7zdvh1rq4h6";
   };
 
   outputs = [ "bin" "dev" "out" ];
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 40334f0b462..ef9f2569c45 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -4,10 +4,9 @@
 , static ? false
 }:
 
-let version = "1.2.11"; in
-
 stdenv.mkDerivation rec {
   name = "zlib-${version}";
+  version = "1.2.11";
 
   src = fetchurl {
     urls =
@@ -17,7 +16,9 @@ stdenv.mkDerivation rec {
     sha256 = "c3e5e9fdd5004dcb542feda5ee4f0ff0744628baf8ed2dd5d66f8ca1197cb1a1";
   };
 
-  postPatch = stdenv.lib.optionalString stdenv.isDarwin ''
+  patches = stdenv.lib.optional hostPlatform.isCygwin ./disable-cygwin-widechar.patch;
+
+  postPatch = stdenv.lib.optionalString hostPlatform.isDarwin ''
     substituteInPlace configure \
       --replace '/usr/bin/libtool' 'ar' \
       --replace 'AR="libtool"' 'AR="ar"' \
@@ -28,14 +29,6 @@ stdenv.mkDerivation rec {
   setOutputFlags = false;
   outputDoc = "dev"; # single tiny man3 page
 
-  # TODO(@Dridus) CC set by cc-wrapper setup-hook, so just empty out the preConfigure script when cross building, but leave the old incorrect script when not
-  # cross building to avoid hash breakage. Once hash breakage is acceptable, remove preConfigure entirely.
-  preConfigure = stdenv.lib.optionalString (hostPlatform == buildPlatform) ''
-    if test -n "$crossConfig"; then
-      export CC=$crossConfig-gcc
-    fi
-  '';
-
   # FIXME needs gcc 4.9 in bootstrap tools
   hardeningDisable = [ "stackprotector" ];
 
@@ -47,36 +40,41 @@ stdenv.mkDerivation rec {
     # jww (2015-01-06): Sometimes this library install as a .so, even on
     # Darwin; others time it installs as a .dylib.  I haven't yet figured out
     # what causes this difference.
-  + stdenv.lib.optionalString stdenv.isDarwin ''
+  + stdenv.lib.optionalString hostPlatform.isDarwin ''
     for file in $out/lib/*.so* $out/lib/*.dylib* ; do
       install_name_tool -id "$file" $file
     done
+  ''
+    # Non-typical naming confuses libtool which then refuses to use zlib's DLL
+    # in some cases, e.g. when compiling libpng.
+  + stdenv.lib.optionalString (hostPlatform.libc == "msvcrt") ''
+    ln -s zlib1.dll $out/bin/libz.dll
   '';
 
   # As zlib takes part in the stdenv building, we don't want references
   # to the bootstrap-tools libgcc (as uses to happen on arm/mips)
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!stdenv.isDarwin) "-static-libgcc";
+  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (!hostPlatform.isDarwin) "-static-libgcc";
 
-  crossAttrs = {
-    dontStrip = static;
-    configurePlatforms = [];
-  } // stdenv.lib.optionalAttrs (hostPlatform.libc == "msvcrt") {
-    installFlags = [
-      "BINARY_PATH=$(out)/bin"
-      "INCLUDE_PATH=$(dev)/include"
-      "LIBRARY_PATH=$(out)/lib"
-    ];
-    makeFlags = [
-      "-f" "win32/Makefile.gcc"
-      "PREFIX=${stdenv.cc.prefix}"
-    ] ++ stdenv.lib.optional (!static) "SHARED_MODE=1";
+  dontStrip = hostPlatform != buildPlatform && static;
+  configurePlatforms = [];
 
-    # Non-typical naming confuses libtool which then refuses to use zlib's DLL
-    # in some cases, e.g. when compiling libpng.
-    postInstall = postInstall + "ln -s zlib1.dll $out/bin/libz.dll";
-  };
+  installFlags = stdenv.lib.optionals (hostPlatform.libc == "msvcrt") [
+    "BINARY_PATH=$(out)/bin"
+    "INCLUDE_PATH=$(dev)/include"
+    "LIBRARY_PATH=$(out)/lib"
+  ];
+
+  makeFlags = [
+    "PREFIX=${stdenv.cc.prefix}"
+  ] ++ stdenv.lib.optionals (hostPlatform.libc == "msvcrt") [
+    "-f" "win32/Makefile.gcc"
+  ] ++ stdenv.lib.optionals (!static) [
+    "SHARED_MODE=1"
+  ];
 
-  passthru.version = version;
+  passthru = {
+    inherit version;
+  };
 
   meta = with stdenv.lib; {
     description = "Lossless data-compression library";
diff --git a/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch b/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch
new file mode 100644
index 00000000000..3de4978c306
--- /dev/null
+++ b/pkgs/development/libraries/zlib/disable-cygwin-widechar.patch
@@ -0,0 +1,13 @@
+diff --git a/gzguts.h b/gzguts.h
+index 990a4d2..6378d46 100644
+--- a/gzguts.h
++++ b/gzguts.h
+@@ -39,7 +39,7 @@
+ #  include <io.h>
+ #endif
+ 
+-#if defined(_WIN32) || defined(__CYGWIN__)
++#if defined(_WIN32)
+ #  define WIDECHAR
+ #endif
+