From 6bc479868ec76f8e69e7d59e418c23fa7f083c09 Mon Sep 17 00:00:00 2001
From: Ivan Mincik <ivan.mincik@gmail.com>
Date: Mon, 20 Jul 2026 09:45:40 +0200
Subject: [PATCH] gdal: add patch for buffer overflow in netCDF driver

Closes #525297
---
 pkgs/by-name/gd/gdal/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/gd/gdal/package.nix b/pkgs/by-name/gd/gdal/package.nix
index 0c686129dc89..05cb62c60046 100644
--- a/pkgs/by-name/gd/gdal/package.nix
+++ b/pkgs/by-name/gd/gdal/package.nix
@@ -116,6 +116,14 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/OSGeo/gdal/commit/7b8b8de28bbd200b0fd3b09147fdc68b5bf5ce20.patch";
       hash = "sha256-BxWMpiUwM3h7Vo9vxJ4H4A8aQfE3jcSRfRYwaLw/60w=";
     })
+
+    # Fix stack buffer overflow in netCDF driver
+    # https://github.com/OSGeo/gdal/issues/14594
+    (fetchpatch {
+      name = "0005-netcdf-avoid-reading-attributes-without-checking-length.patch";
+      url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch";
+      hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw=";
+    })
   ];
 
   nativeBuildInputs = [