From 5a9f7d1fe65238f49c3337580ea599077033a1f4 Mon Sep 17 00:00:00 2001 From: Symphorien Gibol Date: Sun, 23 Sep 2018 18:22:53 +0200 Subject: [PATCH] graphviz: fix CVE-2018-10196 --- pkgs/tools/graphics/graphviz/base.nix | 20 +++++++++++++++++++- pkgs/top-level/all-packages.nix | 4 ++-- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/pkgs/tools/graphics/graphviz/base.nix b/pkgs/tools/graphics/graphviz/base.nix index 68ff84c7495..db21df9b5d0 100644 --- a/pkgs/tools/graphics/graphviz/base.nix +++ b/pkgs/tools/graphics/graphviz/base.nix @@ -2,12 +2,26 @@ { stdenv, fetchFromGitLab, autoreconfHook, pkgconfig, cairo, expat, flex , fontconfig, gd, gettext, gts, libdevil, libjpeg, libpng, libtool, pango -, yacc, xorg ? null, ApplicationServices ? null }: +, yacc, fetchpatch, xorg ? null, ApplicationServices ? null }: assert stdenv.isDarwin -> ApplicationServices != null; let inherit (stdenv.lib) optionals optionalString; + raw_patch = + # https://gitlab.com/graphviz/graphviz/issues/1367 CVE-2018-10196 + fetchpatch { + name = "CVE-2018-10196.patch"; + url = https://gitlab.com/graphviz/graphviz/uploads/30f8f0b00e357c112ac35fb20241604a/p.diff; + sha256 = "074qx6ch9blrnlilmz7p96fkiz2va84x2fbqdza5k4808rngirc7"; + excludes = ["tests/*"]; # we don't run them and they don't apply + }; + # the patch needs a small adaption for older versions + patch = if stdenv.lib.versionAtLeast version "2.37" then raw_patch else + stdenv.mkDerivation { + inherit (raw_patch) name; + buildCommand = "sed s/dot_root/agroot/g ${raw_patch} > $out"; + }; in stdenv.mkDerivation rec { @@ -37,6 +51,10 @@ stdenv.mkDerivation rec { "--with-ltdl-include=${libtool}/include" ] ++ stdenv.lib.optional (xorg == null) [ "--without-x" ]; + patches = [ + patch + ]; + postPatch = '' for f in $(find . -name Makefile.in); do substituteInPlace $f --replace "-lstdc++" "-lc++" diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 0062289d204..77e6cfcaebe 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -2926,9 +2926,9 @@ with pkgs; * that do want 2.32 but not 2.0 or 2.36. Please give a day's notice for * objections before removal. The feature is libgraph. */ - graphviz_2_32 = lib.overrideDerivation (callPackage ../tools/graphics/graphviz/2.32.nix { + graphviz_2_32 = (callPackage ../tools/graphics/graphviz/2.32.nix { inherit (darwin.apple_sdk.frameworks) ApplicationServices; - }) (x: { configureFlags = x.configureFlags ++ ["--with-cgraph=no"];}); + }).overrideAttrs(x: { configureFlags = x.configureFlags ++ ["--with-cgraph=no"];}); grin = callPackage ../tools/text/grin { };