Merge staging-next-21.05 into staging-21.05

pkgs/applications/video/mediathekview/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, jre }:
+{ lib, stdenv, fetchurl, makeWrapper, jre, zip }:
 
 stdenv.mkDerivation rec {
   version = "13.7.1";
@@ -8,11 +8,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-yFPyj1Mbgj2eJv4DpvfOtPyTbL9gMAXC5TzSx8AV27o=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper zip ];
 
   installPhase = ''
     mkdir -p $out/{bin,lib}
 
+    # log4j mitigation, see https://logging.apache.org/log4j/2.x/security.html
+    zip -d MediathekView.jar org/apache/logging/log4j/core/lookup/JndiLookup.class
+
     install -m644 MediathekView.jar $out/lib
 
     makeWrapper ${jre}/bin/java $out/bin/mediathek \

pkgs/development/libraries/gegl/4.0.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , pkg-config
 , vala
 , gobject-introspection
@@ -46,6 +47,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-wRJ4LPQJaWniMhfM36vkIoTjXVQ1/wxD1A5McPrsqN0=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-45463.patch";
+      url = "https://gitlab.gnome.org/GNOME/gegl/-/commit/bfce470f0f2f37968862129d5038b35429f2909b.patch";
+      sha256 = "0nvgn7hfw6pia19xqp51mkp9nh730v19ha050dz0algnrk3ngakp";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     gettext

pkgs/development/libraries/hyperscan/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, cmake, ragel, python3
-, coreutils, gnused, util-linux
+, coreutils, gnused, util-linux, fetchpatch
 , boost
 , withStatic ? false # build only shared libs by default, build static+shared if true
 }:
@@ -37,6 +37,14 @@ stdenv.mkDerivation rec {
   ++ lib.optional (withStatic) "-DBUILD_STATIC_AND_SHARED=ON"
   ++ lib.optional (!withStatic) "-DBUILD_SHARED_LIBS=ON";
 
+  patches = [
+    (fetchpatch {
+      # part of https://github.com/intel/hyperscan/pull/336
+      url = "https://github.com/intel/hyperscan/commit/e2c4010b1fc1272cab816ba543940b3586e68a0c.patch";
+      sha256 = "sha256-doVNwROL6MTcgOW8jBwGTnxe0zvxjawiob/g6AvXLak=";
+    })
+  ];
+
   postPatch = ''
     sed -i '/examples/d' CMakeLists.txt
     substituteInPlace libhs.pc.in \

pkgs/development/libraries/unicorn/1.0.2-CVE-2021-44078.patch

@@ -0,0 +1,15 @@
+Based on upstream https://github.com/unicorn-engine/unicorn/commit/c733bbada356b0373fa8aa72c044574bb855fd24.patch
+adapted by ris to apply to 1.0.2
+
+--- a/uc.c
++++ b/uc.c
+@@ -864,7 +864,8 @@ static bool split_region(struct uc_struct *uc, MemoryRegion *mr,
+         break;
+ 
+     QTAILQ_FOREACH(block, &uc->ram_list.blocks, next) {
+-        if (block->offset <= mr->addr && block->length >= (mr->end - mr->addr)) {
++        // block->offset is the offset within ram_addr_t, not GPA
++        if (block->mr->addr <= mr->addr && block->length >= (mr->end - mr->addr)) {
+             break;
+         }
+ 

pkgs/development/libraries/unicorn/default.nix

@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "0jgnyaq6ykpbg5hrwc0p3pargmr9hpzqfsj6ymp4k07pxnqal76j";
   };
 
+  patches = [ ./1.0.2-CVE-2021-44078.patch ];
+
   nativeBuildInputs = [ pkg-config cmake ];
 
   meta = with lib; {