From 4e48231cee2db32a6be84d13e372771f3f13af4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Thu, 18 Jun 2020 15:16:54 +0200
Subject: [PATCH] luajit*: patch CVE-2019-19391

- upstream argues that this kind of problems can't be called
  vulnerabilities
- the upstream patch is trivial, so why not fix the bug
- nixpkgs master uses git versions already containing that commit
Fixes #90875 (roundup ticket).
---
 pkgs/development/interpreters/luajit/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 5b7761164472..2eda383ac76e 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -1,4 +1,5 @@
 { stdenv, fetchurl, buildPackages
+, fetchpatch
 , name ? "luajit-${version}"
 , isStable
 , sha256
@@ -20,6 +21,13 @@ stdenv.mkDerivation rec {
 
   luaversion = "5.1";
 
+  patches = [
+    (fetchpatch {
+      name = "cve-2019-19391.patch";
+      url = "https://github.com/LuaJIT/LuaJIT/commit/0cd643d7c.diff";
+      sha256 = "1ya5h6r3mi7mkjy6bj1hjbl43j3lwh4phmi5q792rrz8az64hnjy";
+    })
+  ];
   postPatch = ''
     substituteInPlace Makefile --replace ldconfig :
   '';