From 17b9663f09e4d12a35a2528847cc6eebfe90b167 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas.gerbet@enalean.com>
Date: Tue, 10 Oct 2023 12:44:27 +0200
Subject: [PATCH] libcue: apply patch for CVE-2023-43641

https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/
(cherry picked from commit 6335cf6cdf865792499ce2590313b5f5885ddc0c)
---
 pkgs/development/libraries/libcue/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/libcue/default.nix b/pkgs/development/libraries/libcue/default.nix
index 0b03ec6ee0b2..cdae594d9b68 100644
--- a/pkgs/development/libraries/libcue/default.nix
+++ b/pkgs/development/libraries/libcue/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, bison, flex }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, bison, flex }:
 
 stdenv.mkDerivation rec {
   pname = "libcue";
@@ -11,6 +11,14 @@ stdenv.mkDerivation rec {
     sha256 = "1iqw4n01rv2jyk9lksagyxj8ml0kcfwk67n79zy1r6zv1xfp5ywm";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2023-43641.patch";
+      url = "https://github.com/lipnitsk/libcue/commit/fdf72c8bded8d24cfa0608b8e97f2eed210a920e.patch";
+      hash = "sha256-NjnSMUfman/SwLFWDIhtz2jCOLfpXGGGjO3QwRGURNg=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake bison flex ];
 
   doCheck = false; # fails all the tests (ctest)