Merge branch 'staging-19.09' into release-19.09

x86_64-linux rebuilds have finished, so let's merge
to get the security fixes early.

pkgs/development/libraries/libssh/default.nix

@@ -1,11 +1,12 @@
 { stdenv, fetchurl, pkgconfig, cmake, zlib, openssl, libsodium }:
 
 stdenv.mkDerivation rec {
-  name = "libssh-0.8.7";
+  pname = "libssh";
+  version = "0.8.8";
 
   src = fetchurl {
-    url = "https://www.libssh.org/files/0.8/${name}.tar.xz";
-    sha256 = "14nmwfnnrhkwcfk5hn7azl905ivbh4wllmsbw5abd80b5yi4qc23";
+    url = "https://www.libssh.org/files/0.8/${pname}-${version}.tar.xz";
+    sha256 = "1qk5bm9r6199jbfk54f8w24vkl52051g8s3kmq4z2kdc6vbpy4jb";
   };
 
   postPatch = ''
@@ -22,6 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "SSH client library";
+    homepage = "https://libssh.org";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ sander ];
     platforms = platforms.all;

pkgs/servers/samba/4.x.nix

@@ -34,6 +34,11 @@ stdenv.mkDerivation rec {
     ./patch-source3__libads__kerberos_keytab.c.patch
     ./4.x-no-persistent-install-dynconfig.patch
     ./4.x-fix-makeflags-parsing.patch
+    (fetchurl {
+      name = "CVE-2019-14902+CVE-2019-14907+CVE-2019-19344.patch";
+      url = "https://www.samba.org/samba/ftp/patches/security/samba-4.10.11-security-2020-01-21.patch";
+      sha256 = "1mglfzyb6wv85rrlspqa0hlga1c9f3v123j2dvywrsp3waxhb651";
+    })
   ];
 
   nativeBuildInputs = optionals stdenv.isDarwin [ rpcgen fixDarwinDylibNames ];

pkgs/tools/archivers/cpio/CVE-2016-2037-out-of-bounds-write.patch

@@ -1,29 +0,0 @@
-diff --git a/src/copyin.c b/src/copyin.c
-index cde911e..032d35f 100644
---- a/src/copyin.c
-+++ b/src/copyin.c
-@@ -1385,6 +1385,8 @@ process_copy_in ()
-          break;
-        }
-
-+      if (file_hdr.c_namesize <= 1)
-+        file_hdr.c_name = xrealloc(file_hdr.c_name, 2);
-       cpio_safer_name_suffix (file_hdr.c_name, false, !no_abs_paths_flag,
-                              false);
-
-diff --git a/src/util.c b/src/util.c
-index 6ff6032..2763ac1 100644
---- a/src/util.c
-+++ b/src/util.c
-@@ -1411,7 +1411,10 @@ set_file_times (int fd,
- }
-
- /* Do we have to ignore absolute paths, and if so, does the filename
--   have an absolute path?  */
-+   have an absolute path?
-+   Before calling this function make sure that the allocated NAME buffer has
-+   capacity at least 2 bytes to allow us to store the "." string inside.  */
-+
- void
- cpio_safer_name_suffix (char *name, bool link_target, bool absolute_names,
-                        bool strip_leading_dots)

pkgs/tools/archivers/cpio/default.nix

@@ -1,30 +1,16 @@
-{ stdenv, fetchurl, fetchpatch }:
+{ stdenv, fetchurl }:
 
 let
-  version = "2.12";
+  version = "2.13";
   name = "cpio-${version}";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "mirror://gnu/cpio/${name}.tar.bz2";
-    sha256 = "0vi9q475h1rki53100zml75vxsykzyhrn70hidy41s5c2rc8r6bh";
+    sha256 = "0vbgnhkawdllgnkdn6zn1f56fczwk0518krakz2qbwhxmv2vvdga";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2015-1197-cpio-2.12.patch";
-      url = "https://gist.github.com/nckx/70b0bfa80ddfb86c2967/"
-        + "raw/e9b40d4d4b701f584f826775b75beb10751dc884/"
-        + "CVE-2015-1197-cpio-2.12.patch";
-      sha256 = "0ph43m4lavwkc4gnl5h9p3da4kb1pnhwk5l2qsky70dqri8pcr8v";
-    })
-
-    # Report: http://www.openwall.com/lists/oss-security/2016/01/19/4
-    # Patch from https://lists.gnu.org/archive/html/bug-cpio/2016-01/msg00005.html
-    ./CVE-2016-2037-out-of-bounds-write.patch
-  ];
-
   preConfigure = if stdenv.isCygwin then ''
     sed -i gnu/fpending.h -e 's,include <stdio_ext.h>,,'
   '' else null;

pkgs/tools/compression/lz4/default.nix

@@ -4,23 +4,15 @@
 
 stdenv.mkDerivation rec {
   pname = "lz4";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
-    sha256 = "1l1caxrik1hqs40vj3bpv1pikw6b74cfazv5c0v6g48zpcbmshl0";
+    sha256 = "0lpaypmk70ag2ks3kf2dl4ac3ba40n5kc1ainkp9wfjawz76mh61";
     rev = "v${version}";
     repo = pname;
     owner = pname;
   };
 
-  patches = [
-    # Fix detection of Darwin
-    (fetchpatch {
-      url = "https://github.com/lz4/lz4/commit/024216ef7394b6411eeaa5b52d0cec9953a44249.patch";
-      sha256 = "0j0j2pr6pkplxf083hlwl5q4cfp86q3wd8mc64bcfcr7ysc5pzl3";
-    })
-  ];
-
   # TODO(@Ericson2314): Separate binaries and libraries
   outputs = [ "out" "dev" ];
 
@@ -65,7 +57,7 @@ stdenv.mkDerivation rec {
       multiple GB/s per core, typically reaching RAM speed limits on
       multi-core systems.
     '';
-    homepage = https://lz4.github.io/lz4/;
+    homepage = "https://lz4.github.io/lz4/";
     license = with licenses; [ bsd2 gpl2Plus ];
     platforms = platforms.all;
   };