graphviz: fix CVE-2018-10196

This commit is contained in:
Symphorien Gibol 2018-09-23 18:22:53 +02:00
parent 0ae8ac8651
commit 5a9f7d1fe6
2 changed files with 21 additions and 3 deletions

View file

@ -2,12 +2,26 @@
{ stdenv, fetchFromGitLab, autoreconfHook, pkgconfig, cairo, expat, flex
, fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango
, yacc, xorg ? null, ApplicationServices ? null }:
, yacc, fetchpatch, xorg ? null, ApplicationServices ? null }:
assert stdenv.isDarwin -> ApplicationServices != null;
let
inherit (stdenv.lib) optionals optionalString;
raw_patch =
# https://gitlab.com/graphviz/graphviz/issues/1367 CVE-2018-10196
fetchpatch {
name = "CVE-2018-10196.patch";
url = https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff;
sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7";
excludes = ["tests/*"]; # we don't run them and they don't apply
};
# the patch needs a small adaption for older versions
patch = if stdenv.lib.versionAtLeast version "2.37" then raw_patch else
stdenv.mkDerivation {
inherit (raw_patch) name;
buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out";
};
in
stdenv.mkDerivation rec {
@ -37,6 +51,10 @@ stdenv.mkDerivation rec {
"--with-ltdl-include=${libtool}/include"
] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ];
patches = [
patch
];
postPatch = ''
for f in $(find . -name Makefile.in); do
substituteInPlace $f --replace "-lstdc++" "-lc++"

View file

@ -2926,9 +2926,9 @@ with pkgs;
* that do want 2.32 but not 2.0 or 2.36. Please give a day's notice for
* objections before removal. The feature is libgraph.
*/
graphviz_2_32 = lib.overrideDerivation (callPackage ../tools/graphics/graphviz/2.32.nix {
graphviz_2_32 = (callPackage ../tools/graphics/graphviz/2.32.nix {
inherit (darwin.apple_sdk.frameworks) ApplicationServices;
}) (x: { configureFlags = x.configureFlags ++ ["--with-cgraph=no"];});
}).overrideAttrs(x: { configureFlags = x.configureFlags ++ ["--with-cgraph=no"];});
grin = callPackage ../tools/text/grin { };