From ae7bd2bacf6703c73a81db3dc14a48c94dc51302 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 2 Oct 2019 07:24:50 -0500
Subject: [PATCH 1/7] libpcap: 1.9.0 -> 1.9.1 (security!)

http://www.tcpdump.org/libpcap-changes.txt

> Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164, CVE-2019-15165
> Fixes for CVE-2018-16301,

Drop the included patch as well.

(cherry picked from commit 4db088d36ac05da15348ffd56b3e90c3169d4bba)
---
 pkgs/development/libraries/libpcap/default.nix | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/libraries/libpcap/default.nix b/pkgs/development/libraries/libpcap/default.nix
index f7cbfeab4709..b704878b1644 100644
--- a/pkgs/development/libraries/libpcap/default.nix
+++ b/pkgs/development/libraries/libpcap/default.nix
@@ -1,11 +1,12 @@
-{ stdenv, fetchurl, fetchpatch, flex, bison }:
+{ stdenv, fetchurl, flex, bison }:
 
 stdenv.mkDerivation rec {
-  name = "libpcap-1.9.0";
+  pname = "libpcap";
+  version = "1.9.1";
 
   src = fetchurl {
-    url = "https://www.tcpdump.org/release/${name}.tar.gz";
-    sha256 = "06bhydl4vr4z9c3vahl76f2j96z1fbrcl7wwismgs4sris08inrf";
+    url = "https://www.tcpdump.org/release/${pname}-${version}.tar.gz";
+    sha256 = "153h1378diqyc27jjgz6gg5nxmb4ddk006d9xg69nqavgiikflk3";
   };
 
   nativeBuildInputs = [ flex bison ];
@@ -27,15 +28,6 @@ stdenv.mkDerivation rec {
     substituteInPlace configure --replace " -arch i386" ""
   '';
 
-  patches = [
-    # https://github.com/the-tcpdump-group/libpcap/pull/735
-    (fetchpatch {
-      name = "add-missing-limits-h-include-pr735.patch";
-      url = https://github.com/the-tcpdump-group/libpcap/commit/aafa3512b7b742f5e66a5543e41974cc5e7eebfa.patch;
-      sha256 = "05zb4hx9g24gx07bi02rprk2rn7fdc1ss3249dv5x36qkasnfhvf";
-    })
-  ];
-
   meta = with stdenv.lib; {
     homepage = https://www.tcpdump.org;
     description = "Packet Capture Library";

From 6e02204bac7fdd0a090d70b9733c7171b850eec4 Mon Sep 17 00:00:00 2001
From: Will Dietz <w@wdtz.org>
Date: Wed, 2 Oct 2019 07:26:57 -0500
Subject: [PATCH 2/7] tcpdump: 4.9.2 -> 4.9.3 (security!)

So many CVE's, see:

http://www.tcpdump.org/tcpdump-changes.txt
(cherry picked from commit dd42253a4066642b74eaf7a0b500827068f11929)
---
 pkgs/tools/networking/tcpdump/default.nix | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/tools/networking/tcpdump/default.nix b/pkgs/tools/networking/tcpdump/default.nix
index 9cebc267260b..a74dc7ca1d72 100644
--- a/pkgs/tools/networking/tcpdump/default.nix
+++ b/pkgs/tools/networking/tcpdump/default.nix
@@ -1,20 +1,13 @@
 { stdenv, fetchurl, libpcap, perl }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "tcpdump";
-  version = "4.9.2";
+  version = "4.9.3";
 
-  # leaked embargoed security update
   src = fetchurl {
-    url = "https://src.fedoraproject.org/lookaside/pkgs/tcpdump/tcpdump-4.9.2.tar.gz/sha512/e1bc19a5867d6e3628f3941bdf3ec831bf13784f1233ca1bccc46aac1702f47ee9357d7ff0ca62cddf211b3c8884488c21144cabddd92c861e32398cd8f7c44b/tcpdump-4.9.2.tar.gz";
-    sha256 = "0ygy0layzqaj838r5xd613iraz09wlfgpyh7pc6cwclql8v3b2vr";
+    url = "http://www.tcpdump.org/release/${pname}-${version}.tar.gz";
+    sha256 = "0434vdcnbqaia672rggjzdn4bb8p8dchz559yiszzdk0sjrprm1c";
   };
-  # src = fetchFromGitHub rec {
-  #   owner = "the-tcpdump-group";
-  #   repo = "tcpdump";
-  #   rev = "${repo}-${version}";
-  #   sha256 = "1vzrvn1q7x28h18yskqc390y357pzpg5xd3pzzj4xz3llnvsr64p";
-  # };
 
   postPatch = ''
     patchShebangs tests

From 87acfb32f17d609bf7d549150134860359412871 Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 11 Nov 2019 19:50:48 +0000
Subject: [PATCH 3/7] libxslt: add patch for CVE-2019-18197

---
 pkgs/development/libraries/libxslt/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/libraries/libxslt/default.nix b/pkgs/development/libraries/libxslt/default.nix
index 1a3efee176a0..fcf94d8fb6c7 100644
--- a/pkgs/development/libraries/libxslt/default.nix
+++ b/pkgs/development/libraries/libxslt/default.nix
@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
       name = "CVE-2019-13118.patch";
       sha256 = "0bglz9m9sh2vi50qxcm06iqrazw3h45ycgxnp15iankq95z283iq";
     })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/libxslt/commit/2232473733b7313d67de8836ea3b29eec6e8e285.patch";
+      name = "CVE-2019-18197.patch";
+      sha256 = "05izqkn6yxspxskfbw08927j65ar58q0y2dfhqvzkvvv5qzpy1ks";
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "man" "doc" ] ++ stdenv.lib.optional pythonSupport "py";

From 725a454e7deb127d5bc445e47e7af25578cc234f Mon Sep 17 00:00:00 2001
From: Christian Kauhaus <kc@flyingcircus.io>
Date: Sun, 27 Oct 2019 18:07:00 +0100
Subject: [PATCH 4/7] ilmbase-2.3.0: CVE-2018-18443, openexr: CVE-2018-18444

(cherry picked from commit 448d8e04c0bb0d0ced6c8f3ff2603f27e9d827db)
(cherry picked from commit f58ba3c14a042c608f40cd48c76c74b40e4088ac)
---
 pkgs/development/libraries/ilmbase/default.nix | 15 +++++++++++++--
 pkgs/development/libraries/openexr/default.nix |  9 ++++++++-
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/ilmbase/default.nix b/pkgs/development/libraries/ilmbase/default.nix
index 5cc0f7c1f46d..82d5583c55fc 100644
--- a/pkgs/development/libraries/ilmbase/default.nix
+++ b/pkgs/development/libraries/ilmbase/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which }:
+{ stdenv, fetchurl, buildPackages, automake, autoconf, libtool, which,
+  fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "ilmbase";
@@ -21,7 +22,17 @@ stdenv.mkDerivation rec {
 
   NIX_CFLAGS_LINK = [ "-pthread" ];
 
-  patches = [ ./bootstrap.patch ./cross.patch ];
+  patches = [
+    ./bootstrap.patch
+    ./cross.patch
+    (fetchpatch {
+      name = "CVE-2018-18443.patch";
+      url = "https://github.com/kdt3rd/openexr/commit/5fa930b82cff2db386c64ca512af19e60c14d32a.patch";
+      sha256 = "1j6xd0qkx99acc1szycxaj0wwp01yac67jz48hwc4fwwpz8blx4s";
+      stripLen = 1;
+      excludes = [ "CHANGES.md" ];
+    })
+  ];
 
   # fails 1 out of 1 tests with
   # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
diff --git a/pkgs/development/libraries/openexr/default.nix b/pkgs/development/libraries/openexr/default.nix
index 9eef138c532e..7bd3985c12b2 100644
--- a/pkgs/development/libraries/openexr/default.nix
+++ b/pkgs/development/libraries/openexr/default.nix
@@ -1,4 +1,5 @@
-{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, libtool, pkgconfig, zlib, ilmbase, }:
+{ lib, stdenv, buildPackages, fetchurl, autoconf, automake, libtool, pkgconfig,
+  zlib, ilmbase, fetchpatch }:
 
 let
   # Doesn't really do anything when not crosscompiling
@@ -16,6 +17,12 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./bootstrap.patch
+    (fetchpatch {
+      name = "CVE-2018-18444.patch";
+      url = "https://github.com/openexr/openexr/commit/1b0f1e5d7dcf2e9d6cbb4e005e803808b010b1e0.patch";
+      sha256 = "0f5m4wdwqqg8wfg7azzsz5yfpdrvws314rd4sqfc74j1g6wrcnqj";
+      stripLen = 1;
+    })
   ];
 
   outputs = [ "bin" "dev" "out" "doc" ];

From 67832195b4db95b57665da92d3649081dd29572d Mon Sep 17 00:00:00 2001
From: Daiderd Jordan <daiderd@gmail.com>
Date: Sun, 17 Nov 2019 14:55:00 +0100
Subject: [PATCH 5/7] darwin.CF: workaround intermittent CFRuntime.c failures

Based on testing this issue seems to only occur with clang_7, so
we should be able to revert this when the default llvm versions are
updated.

Fixes #66811

(cherry picked from commit 41ca86129fa18278758e177d1821351dc608d24c)
---
 .../darwin/swift-corelibs/corefoundation.nix  | 25 +++++++++++++++++--
 1 file changed, 23 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
index 6f7caa8ec02c..1df7070e7a3f 100644
--- a/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
+++ b/pkgs/os-specific/darwin/swift-corelibs/corefoundation.nix
@@ -63,10 +63,31 @@ stdenv.mkDerivation {
   # I'm guessing at the version here. https://github.com/apple/swift-corelibs-foundation/commit/df3ec55fe6c162d590a7653d89ad669c2b9716b1 imported "high sierra"
   # and this version is a version from there. No idea how accurate it is.
   LDFLAGS = "-current_version 1454.90.0 -compatibility_version 150.0.0 -init ___CFInitialize";
-  configurePhase = "../configure release --sysroot UNUSED";
+
+  configurePhase = ''
+    ../configure release --sysroot UNUSED
+  '';
 
   enableParallelBuilding = true;
-  buildPhase = "ninja -j $NIX_BUILD_CORES";
+
+  # FIXME: Workaround for intermittent build failures of CFRuntime.c.
+  # Based on testing this issue seems to only occur with clang_7, so
+  # please remove this when updating the default llvm versions to 8 or
+  # later.
+  buildPhase = stdenv.lib.optionalString true ''
+    for i in {1..512}; do
+        if ninjaBuildPhase; then
+          break
+        fi
+
+        echo >&2
+        echo "[$i/512] retrying build, workaround for #66811" >&2
+        echo "  With clang_7 the build of CFRuntime.c fails intermittently." >&2
+        echo "  See https://github.com/NixOS/nixpkgs/issues/66811 for more details." >&2
+        echo >&2
+        continue
+    done
+  '';
 
   # TODO: their build system sorta kinda can do this, but it doesn't seem to work right now
   # Also, this includes a bunch of private headers in the framework, which is not what we want

From b51f069fb58f878d606d7110579005820018fd14 Mon Sep 17 00:00:00 2001
From: c0bw3b <c0bw3b@users.noreply.github.com>
Date: Mon, 11 Nov 2019 17:45:28 +0100
Subject: [PATCH 6/7] libmad: fix three CVE from 2017

* add patch for CVE-2017-8372 and CVE-2017-8373
* add patch for CVE-2017-8374
* add patch for x86_64 platforms
* fetch existing patches from remote sources

Backport of #73234
(cherry picked from commit 92edb0610923fab5a9dcc59b94652f1e8a5ea1ed)
---
 .../001-mips_removal_h_constraint.patch       |  73 -----------
 pkgs/development/libraries/libmad/default.nix |  56 +++++++--
 .../libraries/libmad/optimize.diff            |  77 ------------
 .../libraries/libmad/pkgconfig.patch          | 117 ------------------
 4 files changed, 43 insertions(+), 280 deletions(-)
 delete mode 100644 pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
 delete mode 100644 pkgs/development/libraries/libmad/optimize.diff
 delete mode 100644 pkgs/development/libraries/libmad/pkgconfig.patch

diff --git a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch b/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
deleted file mode 100644
index 1d8b385e0c57..000000000000
--- a/pkgs/development/libraries/libmad/001-mips_removal_h_constraint.patch
+++ /dev/null
@@ -1,73 +0,0 @@
-Taken from openwrt:
-https://dev.openwrt.org/browser/packages/libs/libmad/patches/001-mips_removal_h_constraint.patch?rev=18548
-
-diff -ur libmad-0.15.1b-orig/fixed.h libmad-0.15.1b/fixed.h
---- libmad-0.15.1b-orig/fixed.h	2004-02-17 12:32:03.000000000 +1030
-+++ libmad-0.15.1b/fixed.h	2009-08-05 10:46:30.000000000 +0930
-@@ -299,6 +299,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -328,6 +345,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
-diff -ur libmad-0.15.1b-orig/mad.h libmad-0.15.1b/mad.h
---- libmad-0.15.1b-orig/mad.h	2004-02-17 13:25:44.000000000 +1030
-+++ libmad-0.15.1b/mad.h	2009-08-05 10:42:40.000000000 +0930
-@@ -344,6 +344,23 @@
- 
- # elif defined(FPM_MIPS)
- 
-+/* Test for gcc >= maj.min, as per __GNUC_PREREQ in glibc */
-+#if defined (__GNUC__) && defined (__GNUC_MINOR__)
-+#define __GNUC_PREREQ(maj, min) \
-+	((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
-+#else
-+#define __GNUC_PREREQ(maj, min)  0
-+#endif
-+
-+#if __GNUC_PREREQ(4,4)
-+  typedef unsigned int u64_di_t __attribute__ ((mode (DI)));
-+# define MAD_F_MLX(hi, lo, x, y) \
-+   do { \
-+      u64_di_t __ll = (u64_di_t) (x) * (y); \
-+      hi = __ll >> 32; \
-+      lo = __ll; \
-+   } while (0) 
-+#else
- /*
-  * This MIPS version is fast and accurate; the disposition of the least
-  * significant bit depends on OPT_ACCURACY via mad_f_scale64().
-@@ -373,6 +390,7 @@
- 	 : "%r" ((x) >> 12), "r" ((y) >> 16))
- #  define MAD_F_MLZ(hi, lo)  ((mad_fixed_t) (lo))
- # endif
-+#endif /* __GNU_PREREQ(4,4) */
- 
- # if defined(OPT_SPEED)
- #  define mad_f_scale64(hi, lo)  \
diff --git a/pkgs/development/libraries/libmad/default.nix b/pkgs/development/libraries/libmad/default.nix
index f6df090e8b5d..40d90f46288a 100644
--- a/pkgs/development/libraries/libmad/default.nix
+++ b/pkgs/development/libraries/libmad/default.nix
@@ -1,27 +1,57 @@
-{stdenv, fetchurl, autoconf}:
+{ stdenv, fetchurl, fetchpatch, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "libmad-0.15.1b";
-  
+  pname = "libmad";
+  version = "0.15.1b";
+
   src = fetchurl {
-    url = "mirror://sourceforge/mad/${name}.tar.gz";
-    sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
+    url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
+    sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
-  patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
+      sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
+      sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
+      sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8372-CVE-2017-8373.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
+      sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8374.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
+      sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
+    })
+  ]
   # optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
   # It is included here in order to fix a build failure in Clang
   # But it may be useful to fix other, currently unknown problems as well
-  ++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
+  ++ stdenv.lib.optionals stdenv.cc.isClang [
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
+      sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
+    })
+  ];
+
+  # The -fforce-mem flag has been removed in GCC 4.3.
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-fforce-mem" ""
+    substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
+  '';
 
   nativeBuildInputs = [ autoconf ];
 
-  # The -fforce-mem flag has been removed in GCC 4.3.
-  preConfigure = ''
-    autoconf
-    substituteInPlace configure --replace "-fforce-mem" ""
-    substituteInPlace configure --replace "arch=\"-march=i486\"" ""
-  '';
+  preConfigure = "autoconf";
 
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mad/;
diff --git a/pkgs/development/libraries/libmad/optimize.diff b/pkgs/development/libraries/libmad/optimize.diff
deleted file mode 100644
index 1418dc927073..000000000000
--- a/pkgs/development/libraries/libmad/optimize.diff
+++ /dev/null
@@ -1,77 +0,0 @@
-Index: libmad-0.15.1b/configure.ac
-===================================================================
---- libmad-0.15.1b.orig/configure.ac	2008-03-07 20:31:23.000000000 +0000
-+++ libmad-0.15.1b/configure.ac	2008-03-07 20:34:26.000000000 +0000
-@@ -124,71 +124,7 @@
- 
- if test "$GCC" = yes
- then
--    if test -z "$arch"
--    then
--	case "$host" in
--	    i386-*)           ;;
--	    i?86-*)           arch="-march=i486" ;;
--	    arm*-empeg-*)     arch="-march=armv4 -mtune=strongarm1100" ;;
--	    armv4*-*)         arch="-march=armv4 -mtune=strongarm" ;;
--	    powerpc-*)        ;;
--	    mips*-agenda-*)   arch="-mcpu=vr4100" ;;
--	    mips*-luxsonor-*) arch="-mips1 -mcpu=r3000 -Wa,-m4010" ;;
--	esac
--    fi
--
--    case "$optimize" in
--	-O|"-O "*)
--	    optimize="-O"
--	    optimize="$optimize -fforce-mem"
--	    optimize="$optimize -fforce-addr"
--	    : #x optimize="$optimize -finline-functions"
--	    : #- optimize="$optimize -fstrength-reduce"
--	    optimize="$optimize -fthread-jumps"
--	    optimize="$optimize -fcse-follow-jumps"
--	    optimize="$optimize -fcse-skip-blocks"
--	    : #x optimize="$optimize -frerun-cse-after-loop"
--	    : #x optimize="$optimize -frerun-loop-opt"
--	    : #x optimize="$optimize -fgcse"
--	    optimize="$optimize -fexpensive-optimizations"
--	    optimize="$optimize -fregmove"
--	    : #* optimize="$optimize -fdelayed-branch"
--	    : #x optimize="$optimize -fschedule-insns"
--	    optimize="$optimize -fschedule-insns2"
--	    : #? optimize="$optimize -ffunction-sections"
--	    : #? optimize="$optimize -fcaller-saves"
--	    : #> optimize="$optimize -funroll-loops"
--	    : #> optimize="$optimize -funroll-all-loops"
--	    : #x optimize="$optimize -fmove-all-movables"
--	    : #x optimize="$optimize -freduce-all-givs"
--	    : #? optimize="$optimize -fstrict-aliasing"
--	    : #* optimize="$optimize -fstructure-noalias"
--
--	    case "$host" in
--		arm*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		mips*-*)
--		    optimize="$optimize -fstrength-reduce"
--		    optimize="$optimize -finline-functions"
--		    ;;
--		i?86-*)
--		    optimize="$optimize -fstrength-reduce"
--		    ;;
--		powerpc-apple-*)
--		    # this triggers an internal compiler error with gcc2
--		    : #optimize="$optimize -fstrength-reduce"
--
--		    # this is really only beneficial with gcc3
--		    : #optimize="$optimize -finline-functions"
--		    ;;
--		*)
--		    # this sometimes provokes bugs in gcc 2.95.2
--		    : #optimize="$optimize -fstrength-reduce"
--		    ;;
--	    esac
--	    ;;
--    esac
-+    optimize="-O2"
- fi
- 
- case "$host" in
diff --git a/pkgs/development/libraries/libmad/pkgconfig.patch b/pkgs/development/libraries/libmad/pkgconfig.patch
deleted file mode 100644
index 0ac88acb8415..000000000000
--- a/pkgs/development/libraries/libmad/pkgconfig.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-diff -ruN libmad-0.15.1b.orig/Makefile.am libmad-0.15.1b/Makefile.am
---- libmad-0.15.1b.orig/Makefile.am	2004-02-17 02:02:03.000000000 +0000
-+++ libmad-0.15.1b/Makefile.am	2005-08-25 12:08:04.000000000 +0000
-@@ -33,9 +33,12 @@
- minimad_INCLUDES =	
- minimad_LDADD =		libmad.la
- 
--EXTRA_DIST =		mad.h.sed  \
-+EXTRA_DIST =		mad.h.sed mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA= mad.pc
-+
- exported_headers =	version.h fixed.h bit.h timer.h stream.h frame.h  \
- 			synth.h decoder.h
- 
-diff -ruN libmad-0.15.1b.orig/Makefile.in libmad-0.15.1b/Makefile.in
---- libmad-0.15.1b.orig/Makefile.in	2004-02-17 02:33:23.000000000 +0000
-+++ libmad-0.15.1b/Makefile.in	2005-08-25 12:09:34.000000000 +0000
-@@ -14,6 +14,8 @@
- 
- @SET_MAKE@
- 
-+pkgconfigdir = $(libdir)/pkgconfig
-+pkgconfig_DATA = mad.pc
- 
- SOURCES = $(libmad_la_SOURCES) $(EXTRA_libmad_la_SOURCES) $(minimad_SOURCES)
- 
-@@ -43,7 +45,7 @@
- 	$(srcdir)/Makefile.am $(srcdir)/Makefile.in \
- 	$(srcdir)/config.h.in $(srcdir)/libmad.list.in \
- 	$(top_srcdir)/configure COPYING INSTALL TODO config.guess \
--	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs
-+	config.sub depcomp install-sh ltmain.sh missing mkinstalldirs mad.pc.in
- subdir = .
- ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
- am__aclocal_m4_deps = $(top_srcdir)/configure.ac
-@@ -53,7 +55,7 @@
-  configure.lineno configure.status.lineno
- mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs
- CONFIG_HEADER = config.h
--CONFIG_CLEAN_FILES = libmad.list
-+CONFIG_CLEAN_FILES = libmad.list mad.pc
- am__installdirs = $(DESTDIR)$(libdir) $(DESTDIR)$(includedir)
- libLTLIBRARIES_INSTALL = $(INSTALL)
- LTLIBRARIES = $(lib_LTLIBRARIES)
-@@ -218,7 +220,7 @@
- minimad_SOURCES = minimad.c
- minimad_INCLUDES = 
- minimad_LDADD = libmad.la
--EXTRA_DIST = mad.h.sed  \
-+EXTRA_DIST = mad.h.sed  mad.pc.in \
- 			CHANGES COPYRIGHT CREDITS README TODO VERSION
- 
- exported_headers = version.h fixed.h bit.h timer.h stream.h frame.h  \
-@@ -298,6 +300,28 @@
- 	rm -f stamp-h1
- 	touch $@
- 
-+mad.pc: $(top_builddir)/config.status mad.pc.in
-+	cd $(top_builddir) && CONFIG_FILES=$@ CONFIG_HEADERS= $(SHELL) ./config.status
-+
-+install-pkgconfigDATA: $(pkgconfig_DATA)
-+	@$(NORMAL_INSTALL)
-+	$(mkinstalldirs) $(DESTDIR)$(pkgconfigdir)
-+	@list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  if test -f $(srcdir)/$$p; then \
-+	    echo " $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $(srcdir)/$$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  else if test -f $$p; then \
-+	    echo " $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p"; \
-+	    $(INSTALL_DATA) $$p $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	  fi; fi; \
-+	done
-+
-+uninstall-pkgconfigDATA:
-+	@$(NORMAL_UNINSTALL)
-+	list='$(pkgconfig_DATA)'; for p in $$list; do \
-+	  rm -f $(DESTDIR)$(pkgconfigdir)/$$p; \
-+	done
-+
- distclean-hdr:
- 	-rm -f config.h stamp-h1
- libmad.list: $(top_builddir)/config.status $(srcdir)/libmad.list.in
-@@ -726,7 +750,7 @@
- 
- info-am:
- 
--install-data-am: install-includeHEADERS
-+install-data-am: install-includeHEADERS install-pkgconfigDATA
- 
- install-exec-am: install-libLTLIBRARIES
- 
-@@ -757,7 +781,7 @@
- ps-am:
- 
- uninstall-am: uninstall-includeHEADERS uninstall-info-am \
--	uninstall-libLTLIBRARIES
-+	uninstall-libLTLIBRARIES install-pkgconfigDATA
- 
- uninstall-info: uninstall-info-recursive
- 
-diff -ruN libmad-0.15.1b.orig/mad.pc.in libmad-0.15.1b/mad.pc.in
---- libmad-0.15.1b.orig/mad.pc.in	1970-01-01 00:00:00.000000000 +0000
-+++ libmad-0.15.1b/mad.pc.in	2005-08-25 12:08:04.000000000 +0000
-@@ -0,0 +1,10 @@
-+prefix=@prefix@
-+exec_prefix=@exec_prefix@
-+libdir=@libdir@
-+includedir=@includedir@
-+
-+Name: MAD
-+Description: libmad - MPEG audio decoder library
-+Version: @VERSION@
-+Libs: -L${libdir} -lmad
-+Cflags:

From c5c326eaa29c9077e07b88911f2d3371438a659d Mon Sep 17 00:00:00 2001
From: c0bw3b <c0bw3b@users.noreply.github.com>
Date: Mon, 11 Nov 2019 17:50:37 +0100
Subject: [PATCH 7/7] mpg321: fix CVE-2018-7263

Close #57154
Close #70105

Backport of #73234
(cherry picked from commit 1289606e0236ff9b3bd35a08e3560f2d1fb8bc53)
---
 pkgs/applications/audio/mpg321/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/audio/mpg321/default.nix b/pkgs/applications/audio/mpg321/default.nix
index 65dfe3484b66..fdefcf7e77d6 100644
--- a/pkgs/applications/audio/mpg321/default.nix
+++ b/pkgs/applications/audio/mpg321/default.nix
@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libao, libmad, libid3tag, zlib, alsaLib
+{stdenv, fetchurl, fetchpatch, libao, libmad, libid3tag, zlib, alsaLib
 # Specify default libao output plugin to use (e.g. "alsa", "pulse" …).
 # If null, it will use the libao system default.
 , defaultAudio ? null
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-7263.patch";
+      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
+      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   configureFlags =