From 9e476fe740f4f7f2dbedd7294ed044fcf3e9f14f Mon Sep 17 00:00:00 2001 From: aszlig Date: Tue, 28 Jul 2020 02:14:06 +0200 Subject: [PATCH] synergy: Add patch to fix CVE-2020-15117 From the description of CVE-2020-15117: > In Synergy before version 1.12.0, a Synergy server can be crashed by > receiving a kMsgHelloBack packet with a client name length set to > 0xffffffff (4294967295) if the servers memory is less than 4 GB. It > was verified that this issue does not cause a crash through the > exception handler if the available memory of the Server is more than > 4GB. While I personally would consider this a pretty low-priority issue since Synergy usually is only used in local environment, it's nevertheless better to patch known issues. Since the fix is part of version 1.12, which doesn't have a stable release yet, I'm including the fix as a patch cherry-picked from the upstream commit. I originally had the CVE number as a comment prior to the fetchpatch call in question, but since @mweinelt mentioned that https://broken.sh/ uses the patch file name[1] to match whether the software in question has been patched, I've removed my initial comment as it would be redundant. [1]: https://github.com/andir/nix-vulnerability-scanner/blob/fb63998885462/src/report/nix_patches.rs#L83-L95 Signed-off-by: aszlig Fixes: https://github.com/NixOS/nixpkgs/issues/94007 --- pkgs/applications/misc/synergy/default.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/misc/synergy/default.nix b/pkgs/applications/misc/synergy/default.nix index 5c1cce19216..b0722e18eea 100644 --- a/pkgs/applications/misc/synergy/default.nix +++ b/pkgs/applications/misc/synergy/default.nix @@ -1,4 +1,4 @@ -{ stdenv, lib, fetchFromGitHub, cmake, openssl, qttools +{ stdenv, lib, fetchpatch, fetchFromGitHub, cmake, openssl, qttools , ApplicationServices, Carbon, Cocoa, CoreServices, ScreenSaver , xlibsWrapper, libX11, libXi, libXtst, libXrandr, xinput, avahi-compat , withGUI ? true, wrapQtAppsHook }: @@ -14,7 +14,14 @@ stdenv.mkDerivation rec { sha256 = "1jk60xw4h6s5crha89wk4y8rrf1f3bixgh5mzh3cq3xyrkba41gh"; }; - patches = [ ./build-tests.patch + patches = [ + ./build-tests.patch + (fetchpatch { + name = "CVE-2020-15117.patch"; + url = "https://github.com/symless/synergy-core/commit/" + + "0a97c2be0da2d0df25cb86dfd642429e7a8bea39.patch"; + sha256 = "03q8m5n50fms7fjfjgmqrgy9mrxwi9kkz3f3vlrs2x5h21dl6bmj"; + }) ] ++ lib.optional stdenv.isDarwin ./macos_build_fix.patch; # Since the included gtest and gmock don't support clang and the