From 980d1262a0e1c92f94efe923d3c5a5b99e898346 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Tue, 17 May 2022 14:55:20 +0200
Subject: [PATCH 1/2] lua5_2: add patch for CVE-2022-28805

Derived from https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa

(cherry picked from commit 04d41ba8cc770aecc76a72b50f09c281d88a5022)
---
 .../interpreters/lua-5/CVE-2022-28805.patch            | 10 ++++++++++
 pkgs/development/interpreters/lua-5/default.nix        |  4 +++-
 2 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/development/interpreters/lua-5/CVE-2022-28805.patch

diff --git a/pkgs/development/interpreters/lua-5/CVE-2022-28805.patch b/pkgs/development/interpreters/lua-5/CVE-2022-28805.patch
new file mode 100644
index 000000000000..bcf16acbea42
--- /dev/null
+++ b/pkgs/development/interpreters/lua-5/CVE-2022-28805.patch
@@ -0,0 +1,10 @@
+--- a/src/lparser.c
++++ b/src/lparser.c
+@@ -301,6 +301,7 @@
+     expdesc key;
+     singlevaraux(fs, ls->envn, var, 1);  /* get environment variable */
+     lua_assert(var->k == VLOCAL || var->k == VUPVAL);
++    luaK_exp2anyregup(fs, var);  /* but could be a constant */
+     codestring(ls, &key, varname);  /* key is variable name */
+     luaK_indexed(fs, var, &key);  /* env[varname] */
+   }
diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 5230a46afef3..40aa429d8e27 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -32,7 +32,9 @@ rec {
     sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
     hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
     makeWrapper = makeBinaryWrapper;
-    patches = lib.optional stdenv.isDarwin ./5.2.darwin.patch;
+    patches = [
+      ./CVE-2022-28805.patch
+    ] ++ lib.optional stdenv.isDarwin ./5.2.darwin.patch;
   };
 
   lua5_2_compat = lua5_2.override({

From b34c389a486839a9149492ddbc6f5a3398a6c691 Mon Sep 17 00:00:00 2001
From: Robin Gloster <mail@glob.in>
Date: Thu, 12 May 2022 16:00:09 +0200
Subject: [PATCH 2/2] lua5_4: fix CVE-2022-28805

(cherry picked from commit 5a7d0b6b34e1414c7fe1e9ddd4c8407e03510bff)
---
 pkgs/development/interpreters/lua-5/default.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 40aa429d8e27..a160ee039f3a 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -7,7 +7,17 @@ rec {
     hash = "1yxvjvnbg4nyrdv10bq42gz6dr66pyan28lgzfygqfwy2rv24qgq";
     makeWrapper = makeBinaryWrapper;
 
-    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch;
+    patches = lib.optional stdenv.isDarwin ./5.4.darwin.patch
+      ++ [
+        (fetchpatch {
+          name = "CVE-2022-28805.patch";
+          url = "https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa.patch";
+          sha256 = "sha256-YTwoolSnRNJIHFPVijSO6ZDw35BG5oWYralZ8qOb9y8=";
+          stripLen = 1;
+          extraPrefix = "src/";
+          excludes = [ "src/testes/*" ];
+        })
+      ];
   };
 
   lua5_4_compat = lua5_4.override({