From 5c416f75dd21e7982fa5e4bf82f279f491952292 Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Fri, 8 May 2020 10:37:28 +0200 Subject: [PATCH 01/14] clipman: 1.5.0 -> 1.5.1 https://github.com/yory8/clipman/releases/tag/v1.5.1 (cherry picked from commit b2d7c0dbf79af8c7e807890c4ecef88202c86d42) --- pkgs/tools/misc/clipman/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/clipman/default.nix b/pkgs/tools/misc/clipman/default.nix index 0f01744c7061..2d83b5933118 100644 --- a/pkgs/tools/misc/clipman/default.nix +++ b/pkgs/tools/misc/clipman/default.nix @@ -2,13 +2,13 @@ buildGoModule rec { pname = "clipman"; - version = "1.5.0"; + version = "1.5.1"; src = fetchFromGitHub { owner = "yory8"; repo = pname; rev = "v${version}"; - sha256 = "15s7np57pvh7mqmq016mvhz34f189wd1vrfiamzmps37mdz2nq9i"; + sha256 = "09qvd7p63y7kh2i22pc89kr5wdnsbkraj5az9ds3bp3yj4q2mfyn"; }; modSha256 = "1sim3x794kj3wdw0g432zbgh1cimdmmg1hjgynh9jgm3y8w9q7ij"; From 7d3621ca98d736f81dc855d81916fffa72a16589 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 11 Feb 2020 13:51:31 +0000 Subject: [PATCH 02/14] nixos/zfs: populate PATH with needed programs for zed (cherry picked from commit 92bede31027fdc511c0f89784585131726e408f3) --- nixos/modules/tasks/filesystems/zfs.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix index 09c7e074e121..0d65f8bc2eb4 100644 --- a/nixos/modules/tasks/filesystems/zfs.nix +++ b/nixos/modules/tasks/filesystems/zfs.nix @@ -433,6 +433,7 @@ in services.zfs.zed.settings = { ZED_EMAIL_PROG = mkDefault "${pkgs.mailutils}/bin/mail"; + PATH = lib.makeBinPath [ packages.zfsUser pkgs.utillinux pkgs.gawk pkgs.gnused pkgs.gnugrep pkgs.coreutils pkgs.curl ]; }; environment.etc = genAttrs From 6b2dc0e32e01342b19b9d726e85985961e7061dc Mon Sep 17 00:00:00 2001 From: Peter Simons Date: Fri, 8 May 2020 14:10:38 +0200 Subject: [PATCH 03/14] cabal2nix: update from version 2.15.0 to 2.15.3 The new version supports older versions of Cabal again and therefore doesn't need any overrides or a newer compiler to build. The default ghc-8.6.x in the release-20.03 release branch can compile it just fine. Fixes https://github.com/NixOS/nixpkgs/issues/87184. --- pkgs/development/haskell-modules/hackage-packages.nix | 4 ++-- pkgs/top-level/all-packages.nix | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix index ca40de633ae7..8f049e049b77 100644 --- a/pkgs/development/haskell-modules/hackage-packages.nix +++ b/pkgs/development/haskell-modules/hackage-packages.nix @@ -46991,8 +46991,8 @@ self: { }: mkDerivation { pname = "cabal2nix"; - version = "2.15.0"; - sha256 = "1xfskgmwr75f1lk8a6mllp2h62jdl7hkwb01r74gpi0n6h17p3nm"; + version = "2.15.3"; + sha256 = "1l4jhl842g5jmwhmi1gqljkxa8ia80xbk2vmlhg6hlw1nkl9wfrz"; isLibrary = true; isExecutable = true; libraryHaskellDepends = [ diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 2724d07cae06..037c37e8755c 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1328,7 +1328,7 @@ in cue2pops = callPackage ../tools/cd-dvd/cue2pops { }; - cabal2nix = haskell.lib.overrideCabal (haskell.lib.generateOptparseApplicativeCompletion "cabal2nix" haskell.packages.ghc881.cabal2nix) (drv: { + cabal2nix = haskell.lib.overrideCabal (haskell.lib.generateOptparseApplicativeCompletion "cabal2nix" haskellPackages.cabal2nix) (drv: { isLibrary = false; enableSharedExecutables = false; executableToolDepends = (drv.executableToolDepends or []) ++ [ makeWrapper ]; From 7aa47b492b566c4763e02dc76254c276bd9d9dc9 Mon Sep 17 00:00:00 2001 From: Luflosi Date: Fri, 8 May 2020 13:21:19 +0200 Subject: [PATCH 04/14] youtube-dl: 2020.05.03 -> 2020.05.08 https://github.com/ytdl-org/youtube-dl/releases/tag/2020.05.08 (cherry picked from commit 906497a23fb7d141cd6736c60734b9eb08df8d08) --- pkgs/tools/misc/youtube-dl/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/misc/youtube-dl/default.nix b/pkgs/tools/misc/youtube-dl/default.nix index 0a45c27a7a8d..4b399abb61e0 100644 --- a/pkgs/tools/misc/youtube-dl/default.nix +++ b/pkgs/tools/misc/youtube-dl/default.nix @@ -18,11 +18,11 @@ buildPythonPackage rec { # The websites youtube-dl deals with are a very moving target. That means that # downloads break constantly. Because of that, updates should always be backported # to the latest stable release. - version = "2020.05.03"; + version = "2020.05.08"; src = fetchurl { url = "https://yt-dl.org/downloads/${version}/${pname}-${version}.tar.gz"; - sha256 = "0qigk1bml6vkck4rs0wnmr46j5gkz04zn30jvnw1r4czjs7vnpal"; + sha256 = "16zxa8ss2rka7cvkqyi67s8i1h9f4nxx88w9vjbxchbga6w0scc6"; }; nativeBuildInputs = [ installShellFiles makeWrapper ]; From 9daa5fba8dce2ffa9471e9e43a3e6f2e84aafd9d Mon Sep 17 00:00:00 2001 From: Gabriel Ebner Date: Fri, 8 May 2020 17:17:03 +0200 Subject: [PATCH 05/14] elan: 0.9.0 -> 0.10.0 (cherry picked from commit 115fa1c12932f38127d1227e4707b0e29a1f0a06) --- pkgs/applications/science/logic/elan/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/science/logic/elan/default.nix b/pkgs/applications/science/logic/elan/default.nix index ec5ba7c9f60f..87378c2b51a2 100644 --- a/pkgs/applications/science/logic/elan/default.nix +++ b/pkgs/applications/science/logic/elan/default.nix @@ -2,13 +2,13 @@ rustPlatform.buildRustPackage rec { pname = "elan"; - version = "0.9.0"; + version = "0.10.0"; src = fetchFromGitHub { owner = "kha"; repo = "elan"; rev = "v${version}"; - sha256 = "17i8sn53hk03fsawpwfinm1w0nb6lcmdbk8ar2mxyhkxczd45vag"; + sha256 = "0aw538shvpfbk481y0gw3z97nsazdnk8qh8fwsb6ji62p2r51v6f"; }; cargoSha256 = "0q0xlvyyf88dbz43r7kk9v8rrp6hj0nl5i2i9mg6ibk2gphgdv6v"; From 85bb2d20df38b6e3f2804e4ca86f27e9355ae455 Mon Sep 17 00:00:00 2001 From: 1000101 Date: Fri, 8 May 2020 19:20:24 +0200 Subject: [PATCH 06/14] blockbook: fix go version --- pkgs/servers/blockbook/default.nix | 8 +++++++- pkgs/top-level/all-packages.nix | 4 +++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix index b95c3d41b396..966f7f7ff4c5 100644 --- a/pkgs/servers/blockbook/default.nix +++ b/pkgs/servers/blockbook/default.nix @@ -31,6 +31,13 @@ buildGoPackage rec { nativeBuildInputs = [ pkg-config packr ]; + buildFlagsArray = '' + -ldflags= + -X blockbook/common.version=${version} + -X blockbook/common.gitcommit=${commit} + -X blockbook/common.buildDate=unknown + ''; + preBuild = lib.optionalString stdenv.isDarwin '' ulimit -n 8192 '' + '' @@ -51,4 +58,3 @@ buildGoPackage rec { platforms = platforms.all; }; } - diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 27c7895c276a..aa05b7062ff1 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -1183,7 +1183,9 @@ in blink = libsForQt5.callPackage ../applications/networking/instant-messengers/blink { }; - blockbook = callPackage ../servers/blockbook { }; + blockbook = callPackage ../servers/blockbook { + buildGoPackage = buildGo113Package; + }; blockhash = callPackage ../tools/graphics/blockhash { }; From a3a12c044dbbb19545271a0f561127379c30c58b Mon Sep 17 00:00:00 2001 From: 1000101 Date: Fri, 8 May 2020 19:20:57 +0200 Subject: [PATCH 07/14] blockbook: 0.3.1 -> 0.3.2 --- pkgs/servers/blockbook/default.nix | 5 +- pkgs/servers/blockbook/deps.nix | 75 +++++++++++++++++++++++++++--- 2 files changed, 72 insertions(+), 8 deletions(-) diff --git a/pkgs/servers/blockbook/default.nix b/pkgs/servers/blockbook/default.nix index 966f7f7ff4c5..d0a46274882a 100644 --- a/pkgs/servers/blockbook/default.nix +++ b/pkgs/servers/blockbook/default.nix @@ -14,7 +14,8 @@ buildGoPackage rec { pname = "blockbook"; - version = "0.3.1"; + version = "0.3.2"; + commit = "d1fd665"; goPackagePath = "blockbook"; @@ -22,7 +23,7 @@ buildGoPackage rec { owner = "trezor"; repo = "blockbook"; rev = "v${version}"; - sha256 = "0qgd1f3b4vavw55mvpvwvlya39dx1c3kjsc7n46nn7kpc152jv1l"; + sha256 = "0hcgz4b7k8ia4dnjg6bbii95sqg3clc40ybwwc4qz3jv21ikc54x"; }; goDeps = ./deps.nix; diff --git a/pkgs/servers/blockbook/deps.nix b/pkgs/servers/blockbook/deps.nix index 90ff098581a2..9f9ae0a4704d 100644 --- a/pkgs/servers/blockbook/deps.nix +++ b/pkgs/servers/blockbook/deps.nix @@ -9,6 +9,33 @@ sha256 = "02davg672v9sz8l7a8s0b8m87154p42hkm5r6pavf4gqziw8bmr4"; }; } + { + goPackagePath = "github.com/allegro/bigcache"; + fetch = { + type = "git"; + url = "https://github.com/allegro/bigcache"; + rev = "69ea0af04088faa57adb9ac683934277141e92a5"; + sha256 = "0ac9pgzgi9lhklkqmc5f5x3d0cbyxjfpadc6mdbd7hdr7rfrjmxf"; + }; + } + { + goPackagePath = "github.com/aristanetworks/goarista"; + fetch = { + type = "git"; + url = "https://github.com/aristanetworks/goarista"; + rev = "8e7d5b18fe7ad671e07097d5445dbc70422663b2"; + sha256 = "1jbjviz8qi8izhvdvnbc5d9nqyxfww75ffcvxyhw5yxw9r1v0sn2"; + }; + } + { + goPackagePath = "github.com/agl/ed25519"; + fetch = { + type = "git"; + url = "https://github.com/agl/ed25519"; + rev = "5312a61534124124185d41f09206b9fef1d88403"; + sha256 = "1v8mhkf1m3ga5262s75vabskxvsw5rpqvi5nwhxwiv7gfk6h823i"; + }; + } { goPackagePath = "github.com/beorn7/perks"; fetch = { @@ -45,6 +72,15 @@ sha256 = "02dl46wcnfpg9sqvg0ipipkpnd7lrf4fnvb9zy56jqa7mfcwc7wk"; }; } + { + goPackagePath = "github.com/dchest/blake256"; + fetch = { + type = "git"; + url = "https://github.com/dchest/blake256"; + rev = "dee3fe6eb0e98dc774a94fc231f85baf7c29d360"; + sha256 = "18hkfm1zlkf6fsjzljiz5cjxxcf3kl5p9617si8xjggb33adzhyg"; + }; + } { goPackagePath = "github.com/deckarep/golang-set"; fetch = { @@ -54,13 +90,40 @@ sha256 = "01kaqrc5ywbwa46b6lz3db7kkg8q6v383h4lnxds4z3kjglkqaff"; }; } + { + goPackagePath = "github.com/decred/base58"; + fetch = { + type = "git"; + url = "https://github.com/decred/base58"; + rev = "dbeddd8aab76c31eb2ea98351a63fa2c6bf46888"; + sha256 = "0fm0gsz5myin4n15gx3fhi9pk82p6v0sxza945yvny7n13q44ns5"; + }; + } + { + goPackagePath = "github.com/decred/dcrd"; + fetch = { + type = "git"; + url = "https://github.com/decred/dcrd"; + rev = "e3e8c47c68b010dbddeb783ebad32a3a4993dd71"; + sha256 = "0zifsxhrjx282kvsqj80qr3v4af8hx4g6dqvrb6xggpkcaski8b4"; + }; + } + { + goPackagePath = "github.com/decred/slog"; + fetch = { + type = "git"; + url = "https://github.com/decred/slog"; + rev = "fbd821ef791ba2b8ae945f5d44f4e49396d230c5"; + sha256 = "0n3c7saiv4j22kjc1pf3771n6khx4g99n8vn4qvvv0i5vv04585n"; + }; + } { goPackagePath = "github.com/ethereum/go-ethereum"; fetch = { type = "git"; url = "https://github.com/ethereum/go-ethereum"; - rev = "8bbe72075e4e16442c4e28d999edee12e294329e"; - sha256 = "0q0w0vz85d94wym3xni8y22vly886j6g6zn9hizcww1nanvk4nl6"; + rev = "24d727b6d6e2c0cde222fa12155c4a6db5caaf2e"; + sha256 = "0vrhwfavx3gciihf406f2qfrhvhnygvlj2icbswq0d01dx3s566m"; }; } { @@ -140,8 +203,8 @@ fetch = { type = "git"; url = "https://github.com/martinboehm/btcutil"; - rev = "225ed00dbbd5cb8d8b3949a0ee7c9ea540754585"; - sha256 = "0dn5s6h1524q38glp6fcdws97lyvmchq26dhbd3dqazrq61dhdvy"; + rev = "a3d2b8457b77d37c3813742d4030e199b6e09111"; + sha256 = "0152cyabklv9l39dm1g30jb7hzdv9rj45mp3v9x4kvaza58nz0x4"; }; } { @@ -275,8 +338,8 @@ fetch = { type = "git"; url = "https://go.googlesource.com/crypto"; - rev = "d6449816ce06963d9d136eee5a56fca5b0616e7e"; - sha256 = "17dkprbbk84q165275zwhcn0s6pcarigq37zlhsxj23pq2qz3aqy"; + rev = "a832865fa7ada6126f4c6124ac49f71be71bff2a"; + sha256 = "0bikp74pdi9fsvfdgy0k0r8ipzz96hy28zm8qpky0vdbwqci0a8p"; }; } { From 1cc15843b2030c38a25e0253ec77a3662bd28e41 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 8 May 2020 22:10:25 +0200 Subject: [PATCH 08/14] squid: apply patch for CVE-2020-11945 http://www.squid-cache.org/Advisories/SQUID-2020_4.txt Fixes: CVE-2020-11945 --- pkgs/servers/squid/default.nix | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix index 8452adcf2221..0afd238721f0 100644 --- a/pkgs/servers/squid/default.nix +++ b/pkgs/servers/squid/default.nix @@ -1,15 +1,24 @@ -{ stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap +{ stdenv, fetchurl, fetchpatch, perl, openldap, pam, db, cyrus_sasl, libcap , expat, libxml2, openssl, pkgconfig }: stdenv.mkDerivation rec { - name = "squid-4.10"; + pname = "squid"; + version = "4.10"; src = fetchurl { - url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz"; + url = "http://www.squid-cache.org/Versions/v4/${pname}-${version}.tar.xz"; sha256 = "07sz0adv8nkhy797675bpra7lvdkwjq9isw1ddgylhlazl511w4q"; }; + patches = [ + (fetchpatch { + name = "CVE-2020-11945.patch"; + url = "http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch"; + sha256 = "1mdi1camvaa6pmpiypw4zmmc4a4mgqgcvdic5wajysgwsqvbz1f3"; + }) + ]; + nativeBuildInputs = [ pkgconfig ]; buildInputs = [ perl openldap db cyrus_sasl expat libxml2 openssl From 6b17e3557b5aa88164907bb72a346966db52d875 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Sat, 9 May 2020 00:06:44 +0200 Subject: [PATCH 09/14] =?UTF-8?q?microcodeIntel:=2020191115=20=E2=86=92=20?= =?UTF-8?q?20200508?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit d2ad98b1c985aa572fcfc24dab574645f4d71885) --- pkgs/os-specific/linux/microcode/intel.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/microcode/intel.nix b/pkgs/os-specific/linux/microcode/intel.nix index 70b2580b6641..f771ea3a6f82 100644 --- a/pkgs/os-specific/linux/microcode/intel.nix +++ b/pkgs/os-specific/linux/microcode/intel.nix @@ -2,13 +2,13 @@ stdenv.mkDerivation rec { pname = "microcode-intel"; - version = "20191115"; + version = "20200508"; src = fetchFromGitHub { owner = "intel"; repo = "Intel-Linux-Processor-Microcode-Data-Files"; rev = "microcode-${version}"; - sha256 = "0pzi5qmrcrdf6nsds4bvyq1hnvv9d1dlrvqrbzcrpxk84rcjwq1x"; + sha256 = "1cs4b7q9j2lw2y09rfa82aijbfmy4lddahz8qlz9gwajf2ziqns8"; }; nativeBuildInputs = [ iucode-tool libarchive ]; From b04336d3d5d1c4b1b88568cf68cf594a22068d23 Mon Sep 17 00:00:00 2001 From: toonn Date: Tue, 5 May 2020 22:31:01 +0200 Subject: [PATCH 10/14] wire-desktop: linux 3.16.2923 -> 3.17.2924 (cherry picked from commit 84b510775c93a27895a1d2debc3fd7d1583005e6) --- .../networking/instant-messengers/wire-desktop/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix index d69f22f32acc..aed465d0311a 100644 --- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix +++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix @@ -21,12 +21,12 @@ let version = { x86_64-darwin = "3.16.3630"; - x86_64-linux = "3.16.2923"; + x86_64-linux = "3.17.2924"; }.${system} or throwSystem; sha256 = { x86_64-darwin = "1lnjn45bhd36n9xgx6xx9cggwivvkr2s6r4zai2dwg0aac1bywr5"; - x86_64-linux = "0c8jmlsg2gnxsvly04xj1al80nj52rg4czfdha58sg14x14lyspz"; + x86_64-linux = "16f8zawdx7dyrb8hp3fd2j821jj7jlan60knmdlrrk84phlc9ldd"; }.${system} or throwSystem; meta = with stdenv.lib; { From 655649ecff3c9831ed463826e6912df3df2d7e72 Mon Sep 17 00:00:00 2001 From: toonn Date: Wed, 6 May 2020 15:56:20 +0200 Subject: [PATCH 11/14] wire-desktop: mac 3.16.3630 -> 3.17.3666 (cherry picked from commit b408b8c8e498f132dc13a5841948f942653f0165) --- .../networking/instant-messengers/wire-desktop/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix index aed465d0311a..fc84bb7144ec 100644 --- a/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix +++ b/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix @@ -20,12 +20,12 @@ let pname = "wire-desktop"; version = { - x86_64-darwin = "3.16.3630"; + x86_64-darwin = "3.17.3666"; x86_64-linux = "3.17.2924"; }.${system} or throwSystem; sha256 = { - x86_64-darwin = "1lnjn45bhd36n9xgx6xx9cggwivvkr2s6r4zai2dwg0aac1bywr5"; + x86_64-darwin = "0r3ckfrdx0ah6wn364ii1q1laya2nmmfz9jsikc6ss28lijb6ipn"; x86_64-linux = "16f8zawdx7dyrb8hp3fd2j821jj7jlan60knmdlrrk84phlc9ldd"; }.${system} or throwSystem; From afb0b5151850e942f59ad170eef267c40c4068b6 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 6 May 2020 00:22:57 +0200 Subject: [PATCH 12/14] graphicsmagick: apply patch for CVE-2020-10938 Adapted from http://hg.graphicsmagick.org/hg/GraphicsMagick/raw-rev/95abc2b694ce --- .../graphicsmagick/CVE-2020-10938.patch | 296 ++++++++++++++++++ .../graphics/graphicsmagick/default.nix | 1 + 2 files changed, 297 insertions(+) create mode 100644 pkgs/applications/graphics/graphicsmagick/CVE-2020-10938.patch diff --git a/pkgs/applications/graphics/graphicsmagick/CVE-2020-10938.patch b/pkgs/applications/graphics/graphicsmagick/CVE-2020-10938.patch new file mode 100644 index 000000000000..f9278e435d2b --- /dev/null +++ b/pkgs/applications/graphics/graphicsmagick/CVE-2020-10938.patch @@ -0,0 +1,296 @@ + +# HG changeset patch +# User Bob Friesenhahn +# Date 1573921897 21600 +# Node ID 95abc2b694ceb0866f8aae94849bdf4033272035 +# Parent 751e9e822b09b60713a51b218bd7722c381d3634 +HuffmanDecodeImage(): Fix signed overflow on range check which leads to heap overflow in 32-bit applications. Ascii85Tuple(): Fix thread safety issue. + +diff -r 751e9e822b09 -r 95abc2b694ce magick/compress.c +--- a/magick/compress.c Sun Nov 10 13:33:34 2019 -0600 ++++ b/magick/compress.c Sat Nov 16 10:31:37 2019 -0600 +@@ -1,5 +1,5 @@ + /* +-% Copyright (C) 2003 - 2015 GraphicsMagick Group ++% Copyright (C) 2003-2019 GraphicsMagick Group + % Copyright (C) 2002 ImageMagick Studio + % Copyright 1991-1999 E. I. du Pont de Nemours and Company + % +@@ -53,21 +53,26 @@ + */ + typedef struct HuffmanTable + { ++ unsigned int ++ id; ++ + int +- id, +- code, ++ code; ++ ++ unsigned int + length, + count; ++ + } HuffmanTable; + + /* + Huffman coding declarations. + */ +-#define TWId 23 +-#define MWId 24 +-#define TBId 25 +-#define MBId 26 +-#define EXId 27 ++#define TWId 23U ++#define MWId 24U ++#define TBId 25U ++#define MBId 26U ++#define EXId 27U + + static const HuffmanTable + MBTable[]= +@@ -202,37 +207,38 @@ + */ + #define MaxLineExtent 36 + +-static char *Ascii85Tuple(unsigned char *data) ++static char *Ascii85Tuple(char tuple[6], const unsigned char * restrict data) + { +- static char +- tuple[6]; ++ magick_uint32_t ++ code; + +- register long +- i, +- x; +- +- unsigned long +- code, +- quantum; +- +- code=((((unsigned long) data[0] << 8) | (unsigned long) data[1]) << 16) | +- ((unsigned long) data[2] << 8) | (unsigned long) data[3]; +- if (code == 0L) ++ code=((((magick_uint32_t) data[0] << 8) | (magick_uint32_t) data[1]) << 16) | ++ ((magick_uint32_t) data[2] << 8) | (magick_uint32_t) data[3]; ++ if (code == 0) + { + tuple[0]='z'; + tuple[1]='\0'; +- return(tuple); + } +- quantum=85UL*85UL*85UL*85UL; +- for (i=0; i < 4; i++) +- { +- x=(long) (code/quantum); +- code-=quantum*x; +- tuple[i]=(char) (x+(int) '!'); +- quantum/=85L; +- } +- tuple[4]=(char) ((code % 85L)+(int) '!'); +- tuple[5]='\0'; ++ else ++ { ++ register magick_int32_t ++ i, ++ x; ++ ++ magick_uint32_t ++ quantum; ++ ++ quantum=85U*85U*85U*85U; ++ for (i=0; i < 4; i++) ++ { ++ x=(magick_int32_t) (code/quantum); ++ code-=quantum*x; ++ tuple[i]=(char) (x+(int) '!'); ++ quantum/=85; ++ } ++ tuple[4]=(char) ((code % 85)+(int) '!'); ++ tuple[5]='\0'; ++ } + return(tuple); + } + +@@ -255,6 +261,9 @@ + + MagickExport void Ascii85Flush(Image *image) + { ++ char ++ tuple_buff[6]; ++ + register char + *tuple; + +@@ -266,7 +275,7 @@ + image->ascii85->buffer[image->ascii85->offset]=0; + image->ascii85->buffer[image->ascii85->offset+1]=0; + image->ascii85->buffer[image->ascii85->offset+2]=0; +- tuple=Ascii85Tuple(image->ascii85->buffer); ++ tuple=Ascii85Tuple(tuple_buff, image->ascii85->buffer); + (void) WriteBlob(image,image->ascii85->offset+1, + *tuple == 'z' ? "!!!!" : tuple); + } +@@ -286,6 +295,9 @@ + register unsigned char + *p; + ++ char ++ tuple_buff[6]; ++ + assert(image != (Image *) NULL); + assert(image->signature == MagickSignature); + assert(image->ascii85 != (Ascii85Info *) NULL); +@@ -296,7 +308,7 @@ + p=image->ascii85->buffer; + for (n=image->ascii85->offset; n >= 4; n-=4) + { +- for (q=Ascii85Tuple(p); *q; q++) ++ for (q=Ascii85Tuple(tuple_buff,p); *q; q++) + { + image->ascii85->line_break--; + if ((image->ascii85->line_break < 0) && (*q != '%')) +@@ -355,11 +367,11 @@ + % + % + */ +-#define HashSize 1021 +-#define MBHashA 293 +-#define MBHashB 2695 +-#define MWHashA 3510 +-#define MWHashB 1178 ++#define HashSize 1021U ++#define MBHashA 293U ++#define MBHashB 2695U ++#define MWHashA 3510U ++#define MWHashB 1178U + + #define InitializeHashTable(hash,table,a,b) \ + { \ +@@ -401,26 +413,30 @@ + byte, + code, + color, +- length, + null_lines, + runlength; + + unsigned int + bit, + index, ++ length, + mask; + + long +- count, ++ count; ++ ++ unsigned long + y; + + register IndexPacket + *indexes; + +- register long +- i, ++ register unsigned long + x; + ++ unsigned int ++ i; ++ + register PixelPacket + *q; + +@@ -481,13 +497,13 @@ + image->x_resolution=204.0; + image->y_resolution=196.0; + image->units=PixelsPerInchResolution; +- for (y=0; ((y < (long) image->rows) && (null_lines < 3)); ) ++ for (y=0; ((y < image->rows) && (null_lines < 3)); ) + { + /* + Initialize scanline to white. + */ + p=scanline; +- for (x=0; x < (long) image->columns; x++) ++ for (x=0; x < image->columns; x++) + *p++=0; + /* + Decode Huffman encoded scanline. +@@ -502,7 +518,7 @@ + { + if (byte == EOF) + break; +- if (x >= (long) image->columns) ++ if (x >= image->columns) + { + while (runlength < 11) + InputBit(bit); +@@ -563,7 +579,7 @@ + case TBId: + { + count+=entry->count; +- if ((x+count) > (long) image->columns) ++ if ((x+(unsigned long) count) > image->columns) + count=(long) image->columns-x; + if (count > 0) + { +@@ -603,7 +619,7 @@ + break; + } + indexes=AccessMutableIndexes(image); +- for (x=0; x < (long) image->columns; x++) ++ for (x=0; x < image->columns; x++) + { + index=(unsigned int) (*p++); + indexes[x]=index; +@@ -695,7 +711,9 @@ + runlength; + + long +- n, ++ n; ++ ++ unsigned long + y; + + Image +@@ -704,8 +722,10 @@ + register const IndexPacket + *indexes; + +- register long +- i, ++ unsigned long ++ i; ++ ++ register unsigned long + x; + + register const PixelPacket +@@ -772,10 +792,10 @@ + polarity=(PixelIntensityToQuantum(&huffman_image->colormap[0]) < + PixelIntensityToQuantum(&huffman_image->colormap[1]) ? 0x00 : 0x01); + q=scanline; +- for (i=(long) width; i > 0; i--) ++ for (i=0; i < width; i++) /* was: for (i=(long) width; i > 0; i--) */ + *q++=(unsigned char) polarity; + q=scanline; +- for (y=0; y < (long) huffman_image->rows; y++) ++ for (y=0; y < huffman_image->rows; y++) + { + p=AcquireImagePixels(huffman_image,0,y,huffman_image->columns,1, + &huffman_image->exception); +@@ -785,7 +805,7 @@ + break; + } + indexes=AccessImmutableIndexes(huffman_image); +- for (x=0; x < (long) huffman_image->columns; x++) ++ for (x=0; x < huffman_image->columns; x++) + { + *q=(unsigned char) (indexes[x] == polarity ? !polarity : polarity); + q++; + diff --git a/pkgs/applications/graphics/graphicsmagick/default.nix b/pkgs/applications/graphics/graphicsmagick/default.nix index 403a5285e150..67aeecc6a4d1 100644 --- a/pkgs/applications/graphics/graphicsmagick/default.nix +++ b/pkgs/applications/graphics/graphicsmagick/default.nix @@ -14,6 +14,7 @@ stdenv.mkDerivation rec { patches = [ ./disable-popen.patch ./1.3.32-darwin-png-strlcat-fix.patch + ./CVE-2020-10938.patch ]; configureFlags = [ From f354d93d691bc43cdaf25c21ab36d386a2e08cc2 Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Thu, 30 Apr 2020 21:50:14 +0200 Subject: [PATCH 13/14] cups: 2.3.1 -> 2.3.3 https://github.com/apple/cups/releases/tag/v2.3.3 Fixes: https://nvd.nist.gov/vuln/detail/CVE-2019-8842 https://nvd.nist.gov/vuln/detail/CVE-2020-3898 (cherry picked from commit fe90f585cacd4bda07e5c32706134a19b2c24027) --- pkgs/misc/cups/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/misc/cups/default.nix b/pkgs/misc/cups/default.nix index 6786623fee3e..aac394de615f 100644 --- a/pkgs/misc/cups/default.nix +++ b/pkgs/misc/cups/default.nix @@ -30,7 +30,7 @@ stdenv.mkDerivation rec { pname = "cups"; # After 2.2.6, CUPS requires headers only available in macOS 10.12+ - version = if stdenv.isDarwin then "2.2.6" else "2.3.1"; + version = if stdenv.isDarwin then "2.2.6" else "2.3.3"; passthru = { inherit version; }; @@ -38,7 +38,7 @@ stdenv.mkDerivation rec { url = "https://github.com/apple/cups/releases/download/v${version}/cups-${version}-source.tar.gz"; sha256 = if version == "2.2.6" then "16qn41b84xz6khrr2pa2wdwlqxr29rrrkjfi618gbgdkq9w5ff20" - else "1kkpmj17205j8w9hdff2bfpk6lwdmr3gx0j4r35nhgvya24rvjhv"; + else "1vpk0b2vq830f8fvf9z8qjsm5k141i7pi8djbinpnr78pi4dj7r6"; }; outputs = [ "out" "lib" "dev" "man" ]; From f860b7b6083b9381deec7390c413f3af99689176 Mon Sep 17 00:00:00 2001 From: Martin Milata Date: Thu, 23 Apr 2020 14:33:18 +0200 Subject: [PATCH 14/14] libssh: 0.8.8 -> 0.8.9 Fixes CVE-2020-1730. Release notes: https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/ (cherry picked from commit 812ede7d26765f6663e9aa34311068a0392d95b7) --- pkgs/development/libraries/libssh/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libssh/default.nix b/pkgs/development/libraries/libssh/default.nix index bf6e0a491f2f..c6accad9c3c8 100644 --- a/pkgs/development/libraries/libssh/default.nix +++ b/pkgs/development/libraries/libssh/default.nix @@ -2,11 +2,11 @@ stdenv.mkDerivation rec { pname = "libssh"; - version = "0.8.8"; + version = "0.8.9"; src = fetchurl { url = "https://www.libssh.org/files/0.8/${pname}-${version}.tar.xz"; - sha256 = "1qk5bm9r6199jbfk54f8w24vkl52051g8s3kmq4z2kdc6vbpy4jb"; + sha256 = "09b8w9m5qiap8wbvz4613nglsynpk8hn0q9b929ny2y4l2fy2nc5"; }; postPatch = ''