From 531fe80e120cfd2cc25cce983a3846f4e37f61ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Sun, 15 Sep 2019 12:57:36 +0200
Subject: [PATCH] expat: patch CVE-2019-15903 (from Debian, issue #68818)

I hope this URL will last for a few months, feel free to find better.
---
 pkgs/development/libraries/expat/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/development/libraries/expat/default.nix b/pkgs/development/libraries/expat/default.nix
index 915fbf8d5498..0d52da9c0923 100644
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@@ -15,6 +15,13 @@ stdenv.mkDerivation rec {
       sha256 = "1i7bq9sp2k5348dvbfv26bprzv6ka1abf0j5ixjaff9alndm4f19";
       stripLen = 1;
     })
+    (fetchpatch {
+      name = "CVE-2019-15903.patch";
+      url = "https://sources.debian.org/data/main/e/expat/2.2.7-2/debian/patches/CVE-2019-15903_Deny_internal_entities_closing_the_doctype.patch";
+      sha256 = "0lv4392ihpk71fgaf1fz03gandqkaqisal8xrzvcqnvnq4mnmwxp";
+      stripLen = 1;
+      excludes = [ "tests/runtests.c" "Changes" ];
+    })
   ];
 
   outputs = [ "out" "dev" ]; # TODO: fix referrers