Merge release-22.11 into staging-next-22.11

pkgs/development/libraries/webkitgtk/CVE-2023-28204.patch

@@ -0,0 +1,111 @@
+diff --git a/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js b/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
+new file mode 100644
+index 000000000000..25b1a70b81d2
+--- /dev/null
++++ b/JSTests/stress/string-replace-regexp-matchBOL-correct-advancing.js
+@@ -0,0 +1,35 @@
++// Check that we don't advance for BOL assertions when matching a non-BMP character in the YARR interpreter
++// and that we do advance in String.replace() when processing an empty match.
++
++let expected = "|";
++
++for (let i = 0; i < 11; ++i)
++    expected += String.fromCodePoint(128512) + '|';
++
++let str = String.fromCodePoint(128512).repeat(11);
++
++let result1 = str.replace(/(?!(?=^a|()+()+x)(abc))/gmu, r => {
++    return '|';
++});
++
++
++if (result1 !== expected)
++    print("FAILED: \"" + result1 + " !== " + expected + '"');
++
++let result2= str.replace(/(?!(?=^a|x)(abc))/gmu, r => {
++    return '|';
++});
++
++if (result2 !== expected)
++    print("FAILED: \"" + result2 + " !== " + expected + '"');
++
++expected = "|" + String.fromCodePoint(128512);
++
++str = String.fromCodePoint(128512).repeat(1);
++
++let result3= str.replace(/(?!(?=^a|x)(abc))/mu, r => {
++    return '|';
++});
++
++if (result3 !== expected)
++    print("FAILED: \"" + result3 + " !== " + expected + '"');
+diff --git a/Source/JavaScriptCore/runtime/StringPrototype.cpp b/Source/JavaScriptCore/runtime/StringPrototype.cpp
+index 62451e15266f..e559a4e31c76 100644
+--- a/Source/JavaScriptCore/runtime/StringPrototype.cpp
++++ b/Source/JavaScriptCore/runtime/StringPrototype.cpp
+@@ -504,6 +504,11 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
+                 startPosition++;
+                 if (startPosition > sourceLen)
+                     break;
++                if (U16_IS_LEAD(source[startPosition - 1]) && U16_IS_TRAIL(source[startPosition])) {
++                    startPosition++;
++                    if (startPosition > sourceLen)
++                        break;
++                }
+             }
+         }
+     } else {
+@@ -600,6 +605,11 @@ static ALWAYS_INLINE JSString* replaceUsingRegExpSearch(
+                 startPosition++;
+                 if (startPosition > sourceLen)
+                     break;
++                if (U16_IS_LEAD(source[startPosition - 1]) && U16_IS_TRAIL(source[startPosition])) {
++                    startPosition++;
++                    if (startPosition > sourceLen)
++                        break;
++                }
+             }
+         } while (global);
+     }
+diff --git a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+index 95a848a1a66d..4e631bb607e5 100644
+--- a/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
++++ b/Source/JavaScriptCore/yarr/YarrInterpreter.cpp
+@@ -210,6 +210,21 @@ class Interpreter {
+             return result;
+         }
+         
++        int readCheckedDontAdvance(unsigned negativePositionOffest)
++        {
++            RELEASE_ASSERT(pos >= negativePositionOffest);
++            unsigned p = pos - negativePositionOffest;
++            ASSERT(p < length);
++            int result = input[p];
++            if (U16_IS_LEAD(result) && decodeSurrogatePairs && p + 1 < length && U16_IS_TRAIL(input[p + 1])) {
++                if (atEnd())
++                    return -1;
++
++                result = U16_GET_SUPPLEMENTARY(result, input[p + 1]);
++            }
++            return result;
++        }
++
+         int readSurrogatePairChecked(unsigned negativePositionOffset)
+         {
+             RELEASE_ASSERT(pos >= negativePositionOffset);
+@@ -482,13 +497,13 @@ class Interpreter {
+ 
+     bool matchAssertionBOL(ByteTerm& term)
+     {
+-        return (input.atStart(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition + 1)));
++        return (input.atStart(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readCheckedDontAdvance(term.inputPosition + 1)));
+     }
+ 
+     bool matchAssertionEOL(ByteTerm& term)
+     {
+         if (term.inputPosition)
+-            return (input.atEnd(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
++            return (input.atEnd(term.inputPosition)) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.readCheckedDontAdvance(term.inputPosition)));
+ 
+         return (input.atEnd()) || (pattern->multiline() && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+     }

pkgs/development/libraries/webkitgtk/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , runCommand
 , fetchurl
+, fetchpatch
 , perl
 , python3
 , ruby
@@ -97,6 +98,13 @@ stdenv.mkDerivation (finalAttrs: {
       src = ./fdo-backend-path.patch;
       wpebackend_fdo = libwpe-fdo;
     })
+    (fetchpatch {
+      name = "CVE-2023-32373.patch";
+      url = "https://github.com/WebKit/WebKit/commit/85fd2302d16a09a82d9a6e81eb286babb23c4b3c.patch";
+      hash = "sha256-8TMPCExfBjZhAS4l3anKgsFNkrKR6ig7nLqu4hT3A90=";
+    })
+    # Based on https://github.com/WebKit/WebKit/commit/698c6e293734c3c46f223b77d5b4ee48b320e32c
+    ./CVE-2023-28204.patch
   ];
 
   preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -3,14 +3,14 @@
 let
   # These names are how they are designated in https://xanmod.org.
   ltsVariant = {
-    version = "6.1.30";
-    hash = "sha256-F5N0PkjVBSpidP08SdBtOx5n+97RUqN32bwyQ6y+CYY=";
+    version = "6.1.31";
+    hash = "sha256-quYsp6h7IV6gUT0e55FeBlS8rH9OGrqdbM1XSIYNRV4=";
     variant = "lts";
   };
 
   mainVariant = {
-    version = "6.3.3";
-    hash = "sha256-3vkY79dmRUITXUIStYVlrR/JVLtLH2hfH1YKCF03Wmo=";
+    version = "6.3.5";
+    hash = "sha256-2+8WDj1VdmIdC0DjmKyY/fMi5zoiXDAWy7EAmkImvXk=";
     variant = "main";
   };