From 4509181d6c3eeafd6c4f032926f0a6d01a011f93 Mon Sep 17 00:00:00 2001 From: Tal Walter Date: Sat, 22 May 2021 22:21:54 +0900 Subject: [PATCH] cereal: add patch for CVE-2020-11105 (#121574) Co-authored-by: Sandro --- pkgs/development/libraries/cereal/default.nix | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/cereal/default.nix b/pkgs/development/libraries/cereal/default.nix index d2321175f8b..958a92dec34 100644 --- a/pkgs/development/libraries/cereal/default.nix +++ b/pkgs/development/libraries/cereal/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchFromGitHub, cmake }: +{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }: stdenv.mkDerivation rec { pname = "cereal"; version = "1.3.0"; @@ -12,7 +12,19 @@ stdenv.mkDerivation rec { sha256 = "0hc8wh9dwpc1w1zf5lfss4vg5hmgpblqxbrpp1rggicpx9ar831p"; }; - cmakeFlagsArray = [ "-DJUST_INSTALL_CEREAL=yes" ]; + patches = [ + # https://nvd.nist.gov/vuln/detail/CVE-2020-11105 + # serialized std::shared_ptr variables cannot always be expected to + # serialize back into their original values. This can have any number of + # consequences, depending on the context within which this manifests. + (fetchpatch { + name = "CVE-2020-11105.patch"; + url = "https://github.com/USCiLab/cereal/commit/f27c12d491955c94583512603bf32c4568f20929.patch"; + sha256 = "CIkbJ7bAN0MXBhTXQdoQKXUmY60/wQvsdn99FaWt31w="; + }) + ]; + + cmakeFlags = [ "-DJUST_INSTALL_CEREAL=yes" ]; meta = with lib; { description = "A header-only C++11 serialization library";