mirror of
https://github.com/NixOS/nixpkgs.git
synced 2026-08-25 17:55:21 +00:00
staging-next-26.05 iteration 3 - 2026-07-20 (#543944)
This commit is contained in:
Vladimír Čunát
@@ -20,7 +20,7 @@ let
|
||||
lib.concatStringsSep "\n\n" extraCertificateStrings
|
||||
);
|
||||
|
||||
version = "3.125";
|
||||
version = "3.126";
|
||||
meta = {
|
||||
homepage = "https://firefox-source-docs.mozilla.org/security/nss/runbooks/rootstore.html#root-store-consumers";
|
||||
description = "Bundle of X.509 certificates of public Certificate Authorities (CA)";
|
||||
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
|
||||
"https://hg-edge.mozilla.org/projects/nss/raw-file/${tag}/${file}"
|
||||
"https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/${file}"
|
||||
];
|
||||
hash = "sha256-5XkSgI2u97Kw+k3yzPF+R66vJsg5o4+Fx2AD66/YZr0=";
|
||||
hash = "sha256-gbfyV2MzouNg5nP5Etewt6dl2DbHMQA+NIpGysXTcZg=";
|
||||
};
|
||||
|
||||
unpackPhase = ''
|
||||
|
||||
@@ -152,11 +152,12 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
);
|
||||
LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isDarwin "DY" + "LD_LIBRARY_PATH";
|
||||
in
|
||||
# FIXME: do something about the excessive logging on x86_64-linux (> 250 MiB).
|
||||
''
|
||||
runHook preInstallCheck
|
||||
(($(ulimit -n) < 1024)) && ulimit -n 1024
|
||||
|
||||
HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}
|
||||
HOME="$(mktemp -d)" ${LD_LIBRARY_PATH}="$lib/lib" ./test/unittest ${toString excludes}${lib.optionalString stdenv.hostPlatform.isx86_64 " >/dev/null"}
|
||||
|
||||
runHook postInstallCheck
|
||||
'';
|
||||
|
||||
@@ -116,6 +116,24 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
url = "https://github.com/OSGeo/gdal/commit/7b8b8de28bbd200b0fd3b09147fdc68b5bf5ce20.patch";
|
||||
hash = "sha256-BxWMpiUwM3h7Vo9vxJ4H4A8aQfE3jcSRfRYwaLw/60w=";
|
||||
})
|
||||
|
||||
# Fix stack buffer overflow in netCDF driver
|
||||
# https://github.com/OSGeo/gdal/issues/14594
|
||||
(fetchpatch {
|
||||
name = "0005-netcdf-avoid-reading-attributes-without-checking-length.patch";
|
||||
url = "https://github.com/OSGeo/gdal/commit/50eea7456d83c9586f112ef96b43249372839dea.patch";
|
||||
hash = "sha256-m1FsBC37h2uuaEeYezPZJFsDR6Ix/FDIZnuZZiSAYcw=";
|
||||
})
|
||||
|
||||
# Fix tests with libtiff 4.7.2
|
||||
# FAILED gcore/tiff_read.py::test_tiff_read_stripbytecounts_count_not_same_as_stripoffsets_count -
|
||||
# AssertionError: assert '170' is None
|
||||
(fetchpatch {
|
||||
name = "0006-Internal-libtiff-resync-with-4.7.2rc3-and-adjust-tes.patch";
|
||||
url = "https://github.com/OSGeo/gdal/commit/06ffb0333fe557cde262aa1e81466dda42684c53.patch";
|
||||
hash = "sha256-teZ9cv8JQ2ua4tEWl3I8D9DYo8srGIBYIc2NfkgNMe4=";
|
||||
includes = [ "autotest/gcore/tiff_read.py" ];
|
||||
})
|
||||
];
|
||||
|
||||
nativeBuildInputs = [
|
||||
|
||||
@@ -13,13 +13,13 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "libffi";
|
||||
version = "3.5.2";
|
||||
version = "3.7.0";
|
||||
|
||||
src = fetchurl {
|
||||
url =
|
||||
with finalAttrs;
|
||||
"https://github.com/libffi/libffi/releases/download/v${version}/${pname}-${version}.tar.gz";
|
||||
hash = "sha256-86MIKiOzfCk6T80QUxR7Nx8v+R+n6hsqUuM1Z2usgtw=";
|
||||
hash = "sha256-IlXFpjjftRv2fCChKnu3DRf+senqurrAX1VzFG9YZDY=";
|
||||
};
|
||||
|
||||
# Note: this package is used for bootstrapping fetchurl, and thus
|
||||
@@ -32,6 +32,9 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
./freebsd-tsan-pthread.patch
|
||||
];
|
||||
|
||||
# To workaround https://github.com/libffi/libffi/issues/993, we empty the test file:
|
||||
postPatch = lib.optionalString stdenv.hostPlatform.isDarwin "echo 'int main (void) { return 0; }' > testsuite/libffi.call/i128-1.c";
|
||||
|
||||
strictDeps = true;
|
||||
outputs = [
|
||||
"out"
|
||||
|
||||
@@ -8,13 +8,13 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "libmysofa";
|
||||
version = "1.3.3";
|
||||
version = "1.3.4";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "hoene";
|
||||
repo = "libmysofa";
|
||||
rev = "v${finalAttrs.version}";
|
||||
hash = "sha256-jvib1hGPJEY2w/KjlD7iTtRy1s8LFG+Qhb2d6xdpUyc=";
|
||||
hash = "sha256-gP/RjKzMx8JIYcyiivBGvy3kIdwHMEKY6abssyVUKNQ=";
|
||||
};
|
||||
|
||||
outputs = [
|
||||
|
||||
@@ -2,7 +2,6 @@
|
||||
lib,
|
||||
stdenv,
|
||||
fetchurl,
|
||||
fetchpatch,
|
||||
getopt,
|
||||
util-linuxMinimal,
|
||||
which,
|
||||
@@ -13,31 +12,13 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "libseccomp";
|
||||
version = "2.6.0";
|
||||
version = "2.6.1";
|
||||
|
||||
src = fetchurl {
|
||||
url = "https://github.com/seccomp/libseccomp/releases/download/v${finalAttrs.version}/libseccomp-${finalAttrs.version}.tar.gz";
|
||||
hash = "sha256-g7YIUjLRWIw3ncm5yuR7s3QHzyYubnSZPGG6ctKnhNw=";
|
||||
hash = "sha256-UB9mxmciXVN5G5fh18+Fq3ZMKX0EiB9g849FHEsO4b4=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
# Remove when version > 2.6.0
|
||||
# Fixes test failures on big-endian archs
|
||||
(fetchpatch {
|
||||
name = "0001-libseccomp-remove-fuzzer-from-test-62-sim-arch_transactions.patch";
|
||||
url = "https://github.com/seccomp/libseccomp/commit/2f0f3b0e9121720108431c5d054164016f476230.patch";
|
||||
hash = "sha256-AKAQyALJlLgxnS23OEoqfyDswp0kU2vmja5ohgvFojw=";
|
||||
})
|
||||
|
||||
# Remove when version > 2.6.0
|
||||
# Fixes OOB reads & tests on musl
|
||||
(fetchpatch {
|
||||
name = "0002-libseccomp-fix-seccomp_export_bpf_mem-out-of-bounds-read.patch";
|
||||
url = "https://github.com/seccomp/libseccomp/commit/dd759e8c4f5685b526638fba9ec4fc24c37c9aec.patch";
|
||||
hash = "sha256-TdfQ5T8FrGE6+P24MIi9rKSC3fQu/Jlr4bsFiJd4yVY=";
|
||||
})
|
||||
];
|
||||
|
||||
outputs = [
|
||||
"out"
|
||||
"lib"
|
||||
|
||||
@@ -37,13 +37,13 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "libtiff";
|
||||
version = "4.7.1";
|
||||
version = "4.7.2";
|
||||
|
||||
src = fetchFromGitLab {
|
||||
owner = "libtiff";
|
||||
repo = "libtiff";
|
||||
rev = "v${finalAttrs.version}";
|
||||
hash = "sha256-UiC6s86i7UavW86EKm74oPVlEacvoKmwW7KETjpnNaI=";
|
||||
hash = "sha256-60Lpg5WRfWMzlOoOUA+C6KLlYIZ+3BjXidOVqv4M2GA=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
|
||||
@@ -8,16 +8,16 @@
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "tzdata";
|
||||
version = "2026b";
|
||||
version = "2026c";
|
||||
|
||||
srcs = [
|
||||
(fetchurl {
|
||||
url = "https://data.iana.org/time-zones/releases/tzdata${finalAttrs.version}.tar.gz";
|
||||
hash = "sha256-EUVD2fGaa/61vKQ2hq6hc9OHVaPbHy7sESZHrpLG9UQ=";
|
||||
hash = "sha256-5KF4pEd/PQ6nfMMYKP9yqjj+/41hqhPn6Z4ULp2QK+Q=";
|
||||
})
|
||||
(fetchurl {
|
||||
url = "https://data.iana.org/time-zones/releases/tzcode${finalAttrs.version}.tar.gz";
|
||||
hash = "sha256-N+nthCf101IcIvxY4pPL+wQ9cO7fEAOHCzPzY/Yco0Q=";
|
||||
hash = "sha256-sc/8Os5MTHzQ77ovet2G7D0LedpIvPA1gmcf08j+rOg=";
|
||||
})
|
||||
];
|
||||
|
||||
|
||||
@@ -8,6 +8,7 @@
|
||||
stdenv,
|
||||
testers,
|
||||
validatePkgConfig,
|
||||
static ? stdenv.hostPlatform.isStatic, # generates static libraries *only*
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
@@ -21,6 +22,20 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
hash = "sha256-+vz/qTMRRDHV1VE4nny9vYYtarZHk1xoM4EZiah3jnY=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
# FIXME: remove when included in a release
|
||||
(fetchpatch2 {
|
||||
url = "https://github.com/nodejs/uvwasi/commit/0820128569533c855d60c0f6382acbb14aa62ad2.patch?full_index=1";
|
||||
hash = "sha256-psjivoarqisOuCdVJAWuFH0aITzwb/obmal3ewVXvG4=";
|
||||
})
|
||||
];
|
||||
postPatch = lib.optionalString static ''
|
||||
substituteInPlace CMakeLists.txt --replace-fail 'TARGETS uvwasi_a uvwasi' 'TARGETS uvwasi_a'
|
||||
'';
|
||||
cmakeFlags = [
|
||||
(lib.cmakeBool "UVWASI_BUILD_SHARED" (!static))
|
||||
];
|
||||
|
||||
outputs = [
|
||||
"out"
|
||||
];
|
||||
|
||||
@@ -38,14 +38,7 @@
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
pname = "xvfb";
|
||||
|
||||
# TODO: commented out for rebuild avoidance after xorg-server update. revert
|
||||
# on staging.
|
||||
# inherit (xorg-server) src version;
|
||||
version = "21.1.23";
|
||||
src = fetchurl {
|
||||
url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
|
||||
hash = "sha256-45gy5WF9ra8HL9+fDhnl0uHCoTYHrCgLrBq6n4/hRjQ=";
|
||||
};
|
||||
inherit (xorg-server) src version;
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
|
||||
@@ -0,0 +1,69 @@
|
||||
From 4d9c6b19fcb34fab03fb7dab8f6d36a2cc4ef982 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Weimer <fweimer@redhat.com>
|
||||
Date: Fri, 19 Jun 2026 18:22:20 +0200
|
||||
Subject: [PATCH 1/3] resolv: Check for inet_ntop failure in ns_sprintrrf
|
||||
|
||||
This makes the output more consistent (either failure or complete
|
||||
output) and helps with systematic testing with varying buffer
|
||||
sizes.
|
||||
|
||||
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
||||
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
||||
(cherry picked from commit cd0db208d56a2cecd528b8ae96df752ba5344d9a)
|
||||
---
|
||||
resolv/ns_print.c | 18 +++++++++++-------
|
||||
1 file changed, 11 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
|
||||
index cef2212fd2..cb680fb74e 100644
|
||||
--- a/resolv/ns_print.c
|
||||
+++ b/resolv/ns_print.c
|
||||
@@ -140,8 +140,9 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
switch (type) {
|
||||
case ns_t_a:
|
||||
if (rdlen != (size_t)NS_INADDRSZ)
|
||||
- goto formerr;
|
||||
- (void) inet_ntop(AF_INET, rdata, buf, buflen);
|
||||
+ goto formerr;
|
||||
+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
|
||||
+ return -1;
|
||||
addlen(strlen(buf), &buf, &buflen);
|
||||
break;
|
||||
|
||||
@@ -307,9 +308,10 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
}
|
||||
|
||||
case ns_t_aaaa:
|
||||
- if (rdlen != (size_t)NS_IN6ADDRSZ)
|
||||
- goto formerr;
|
||||
- (void) inet_ntop(AF_INET6, rdata, buf, buflen);
|
||||
+ if (rdlen != (size_t)NS_IN6ADDRSZ)
|
||||
+ goto formerr;
|
||||
+ if (inet_ntop (AF_INET6, rdata, buf, buflen) == NULL)
|
||||
+ return -1;
|
||||
addlen(strlen(buf), &buf, &buflen);
|
||||
break;
|
||||
|
||||
@@ -400,7 +402,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
goto formerr;
|
||||
|
||||
/* Address. */
|
||||
- (void) inet_ntop(AF_INET, rdata, buf, buflen);
|
||||
+ if (inet_ntop (AF_INET, rdata, buf, buflen) == NULL)
|
||||
+ return -1;
|
||||
addlen(strlen(buf), &buf, &buflen);
|
||||
rdata += NS_INADDRSZ;
|
||||
|
||||
@@ -542,7 +545,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
if (rdata + pbyte >= edata) goto formerr;
|
||||
memset(&a, 0, sizeof(a));
|
||||
memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
|
||||
- (void) inet_ntop(AF_INET6, &a, buf, buflen);
|
||||
+ if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
|
||||
+ return -1;
|
||||
addlen(strlen(buf), &buf, &buflen);
|
||||
rdata += sizeof(a) - pbyte;
|
||||
}
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@@ -0,0 +1,134 @@
|
||||
From 103658e72f5aaeb36a5e405f9abaa1b687488fc1 Mon Sep 17 00:00:00 2001
|
||||
From: Florian Weimer <fweimer@redhat.com>
|
||||
Date: Fri, 19 Jun 2026 18:22:20 +0200
|
||||
Subject: [PATCH 2/3] resolv: More types as unknown in ns_sprintrrf
|
||||
(CVE-2026-5435)
|
||||
|
||||
Specifically, CERT, TKEY, TSIG, OPT. This removes the buggy
|
||||
implementations of TSIG, fixing bug 34033, and partially
|
||||
fixing bug 34069.
|
||||
|
||||
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
||||
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
||||
(cherry picked from commit ca44a6609c29a683b03575fa035c6d17aa591e72)
|
||||
---
|
||||
resolv/ns_print.c | 96 -----------------------------------------------
|
||||
1 file changed, 96 deletions(-)
|
||||
|
||||
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
|
||||
index cb680fb74e..8c876b147e 100644
|
||||
--- a/resolv/ns_print.c
|
||||
+++ b/resolv/ns_print.c
|
||||
@@ -437,96 +437,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
break;
|
||||
}
|
||||
|
||||
- case ns_t_cert: {
|
||||
- u_int c_type, key_tag, alg;
|
||||
- int n;
|
||||
- unsigned int siz;
|
||||
- char base64_cert[8192], tmp[40];
|
||||
- const char *leader;
|
||||
-
|
||||
- c_type = ns_get16(rdata); rdata += NS_INT16SZ;
|
||||
- key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
|
||||
- alg = (u_int) *rdata++;
|
||||
-
|
||||
- len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
|
||||
- T(addstr(tmp, len, &buf, &buflen));
|
||||
- siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
|
||||
- if (siz > sizeof(base64_cert) * 3/4) {
|
||||
- const char *str = "record too long to print";
|
||||
- T(addstr(str, strlen(str), &buf, &buflen));
|
||||
- }
|
||||
- else {
|
||||
- len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
|
||||
-
|
||||
- if (len < 0)
|
||||
- goto formerr;
|
||||
- else if (len > 15) {
|
||||
- T(addstr(" (", 2, &buf, &buflen));
|
||||
- leader = "\n\t\t";
|
||||
- spaced = 0;
|
||||
- }
|
||||
- else
|
||||
- leader = " ";
|
||||
-
|
||||
- for (n = 0; n < len; n += 48) {
|
||||
- T(addstr(leader, strlen(leader),
|
||||
- &buf, &buflen));
|
||||
- T(addstr(base64_cert + n, MIN(len - n, 48),
|
||||
- &buf, &buflen));
|
||||
- }
|
||||
- if (len > 15)
|
||||
- T(addstr(" )", 2, &buf, &buflen));
|
||||
- }
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- case ns_t_tkey: {
|
||||
- /* KJD - need to complete this */
|
||||
- u_long t;
|
||||
- int mode, err, keysize;
|
||||
-
|
||||
- /* Algorithm name. */
|
||||
- T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
|
||||
- T(addstr(" ", 1, &buf, &buflen));
|
||||
-
|
||||
- /* Inception. */
|
||||
- t = ns_get32(rdata); rdata += NS_INT32SZ;
|
||||
- len = SPRINTF((tmp, "%lu ", t));
|
||||
- T(addstr(tmp, len, &buf, &buflen));
|
||||
-
|
||||
- /* Expiration. */
|
||||
- t = ns_get32(rdata); rdata += NS_INT32SZ;
|
||||
- len = SPRINTF((tmp, "%lu ", t));
|
||||
- T(addstr(tmp, len, &buf, &buflen));
|
||||
-
|
||||
- /* Mode , Error, Key Size. */
|
||||
- /* Priority, Weight, Port. */
|
||||
- mode = ns_get16(rdata); rdata += NS_INT16SZ;
|
||||
- err = ns_get16(rdata); rdata += NS_INT16SZ;
|
||||
- keysize = ns_get16(rdata); rdata += NS_INT16SZ;
|
||||
- len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
|
||||
- T(addstr(tmp, len, &buf, &buflen));
|
||||
-
|
||||
- /* XXX need to dump key, print otherdata length & other data */
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
- case ns_t_tsig: {
|
||||
- /* BEW - need to complete this */
|
||||
- int n;
|
||||
-
|
||||
- T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
|
||||
- T(addstr(" ", 1, &buf, &buflen));
|
||||
- rdata += 8; /*%< time */
|
||||
- n = ns_get16(rdata); rdata += INT16SZ;
|
||||
- rdata += n; /*%< sig */
|
||||
- n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
|
||||
- sprintf(buf, "%d", ns_get16(rdata));
|
||||
- rdata += INT16SZ;
|
||||
- addlen(strlen(buf), &buf, &buflen);
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
case ns_t_a6: {
|
||||
struct in6_addr a;
|
||||
int pbyte, pbit;
|
||||
@@ -561,12 +471,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
break;
|
||||
}
|
||||
|
||||
- case ns_t_opt: {
|
||||
- len = SPRINTF((tmp, "%u bytes", class));
|
||||
- T(addstr(tmp, len, &buf, &buflen));
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
default:
|
||||
snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
|
||||
comment = errbuf;
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@@ -0,0 +1,66 @@
|
||||
From 2290143edc27486196815874dca5a528c118a73f Mon Sep 17 00:00:00 2001
|
||||
From: Florian Weimer <fweimer@redhat.com>
|
||||
Date: Fri, 19 Jun 2026 18:22:20 +0200
|
||||
Subject: [PATCH 3/3] resolv: Fix buffer overreads in ns_sprintrrf
|
||||
(CVE-2026-6238)
|
||||
|
||||
Check that the RDATA payload does not require more than RDATALEN
|
||||
bytes while processing it. The fixes cover A6, LOC records.
|
||||
(CERT, TKEY, TSIG were fixed before, by switching to the generic
|
||||
formatter.)
|
||||
|
||||
The vulnerable LOC record handling was first introduced before
|
||||
glibc 2.0, in commit ee188d555b8c32ad9704a7440cab400af967292f.
|
||||
|
||||
CERT, TSIG, TKEY handling came with commit
|
||||
b43b13ac2544b11f35be301d1589b51a8473e32b, released with glibc 2.2.
|
||||
|
||||
A6 record handling was introduced in commit
|
||||
91633816430e7ec5a19fe3ff510a7c4822a9557e ("* resolv/ns_print.c
|
||||
(ns_sprintrrf): Handle ns_t_a6 and ns_t_opt."), which went into glibc
|
||||
2.7.
|
||||
|
||||
This fixes bug 34069.
|
||||
|
||||
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
|
||||
Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
|
||||
(cherry picked from commit a7b60d23bbb56eaef59f4962e4140062e552600a)
|
||||
---
|
||||
resolv/ns_print.c | 10 ++++++----
|
||||
1 file changed, 6 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/resolv/ns_print.c b/resolv/ns_print.c
|
||||
index 8c876b147e..6832255a25 100644
|
||||
--- a/resolv/ns_print.c
|
||||
+++ b/resolv/ns_print.c
|
||||
@@ -318,7 +318,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
case ns_t_loc: {
|
||||
char t[255];
|
||||
|
||||
- /* XXX protocol format checking? */
|
||||
+ if (rdlen != 16)
|
||||
+ goto formerr;
|
||||
(void) loc_ntoa(rdata, t);
|
||||
T(addstr(t, strlen(t), &buf, &buflen));
|
||||
break;
|
||||
@@ -452,13 +453,14 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
|
||||
|
||||
/* address suffix: provided only when prefix len != 128 */
|
||||
if (pbit < 128) {
|
||||
- if (rdata + pbyte >= edata) goto formerr;
|
||||
+ unsigned int bytelen = sizeof(a) - pbyte;
|
||||
+ if (edata - rdata < bytelen) goto formerr;
|
||||
memset(&a, 0, sizeof(a));
|
||||
- memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
|
||||
+ memcpy(&a.s6_addr[pbyte], rdata, bytelen);
|
||||
if (inet_ntop (AF_INET6, &a, buf, buflen) == NULL)
|
||||
return -1;
|
||||
addlen(strlen(buf), &buf, &buflen);
|
||||
- rdata += sizeof(a) - pbyte;
|
||||
+ rdata += bytelen;
|
||||
}
|
||||
|
||||
/* prefix name: provided only when prefix len > 0 */
|
||||
--
|
||||
2.54.0
|
||||
|
||||
@@ -116,6 +116,15 @@ stdenv.mkDerivation (
|
||||
# enable parallel & reproducible build of glibcLocales
|
||||
./0001-localedata-allow-reproducible-parallel-install-of-lo.patch
|
||||
./0002-Makeconfig-make-inst_complocaledir-overridable.patch
|
||||
|
||||
# Security fixes.
|
||||
#
|
||||
# Can be dropped on 2.44. The first patch is only to make it
|
||||
# easier to backport the fix for CVE-2026-6238 and it seems
|
||||
# useful in its own right anyhow.
|
||||
./0001-resolv-Check-for-inet_ntop-failure-in-ns_sprintrrf.patch
|
||||
./0002-resolv-More-types-as-unknown-in-ns_sprintrrf-CVE-202.patch
|
||||
./0003-resolv-Fix-buffer-overreads-in-ns_sprintrrf-CVE-2026.patch
|
||||
]
|
||||
/*
|
||||
NVCC does not support ARM intrinsics. Since <math.h> is pulled in by almost
|
||||
|
||||
@@ -95,6 +95,26 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
(replaceVars ./souploader.diff {
|
||||
nixLibSoup3Path = "${lib.getLib libsoup_3}/lib";
|
||||
})
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11262
|
||||
(fetchpatch {
|
||||
name = "GStreamer-SA-2026-0021-1.patch";
|
||||
url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/35a905a92f4cfc85941c6c820009ac9219f755b2.patch";
|
||||
sha256 = "sha256-1SgQo+wb2Adcgrz3zn6/qn248vnBdPuk2oJ1v9+Dbzo=";
|
||||
stripLen = 2;
|
||||
})
|
||||
(fetchpatch {
|
||||
name = "GStreamer-SA-2026-0021-2.patch";
|
||||
url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/0d819ceb654b06bbdd54381da5363c16751758a2.patch";
|
||||
sha256 = "sha256-a8P1YxLNMkYka01+8MhBO+uSzGbR186sumlQk5LuGfY=";
|
||||
stripLen = 2;
|
||||
})
|
||||
# https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11263
|
||||
(fetchpatch {
|
||||
name = "GStreamer-SA-2026-0022.patch";
|
||||
url = "https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/6db6dd058ebc3607452311b7dc47b0359b40b293.patch";
|
||||
sha256 = "sha256-gaBUpEdZB0PrnI1IR53jtM0kecHpUIzavUdADN1NNlQ=";
|
||||
stripLen = 2;
|
||||
})
|
||||
];
|
||||
|
||||
strictDeps = true;
|
||||
|
||||
@@ -2,7 +2,7 @@
|
||||
lib,
|
||||
stdenv,
|
||||
llvmPackages,
|
||||
fetchpatch,
|
||||
python3,
|
||||
fetchurl,
|
||||
pkg-config,
|
||||
freetype,
|
||||
@@ -12,14 +12,14 @@
|
||||
}:
|
||||
|
||||
stdenv.mkDerivation (finalAttrs: {
|
||||
version = "1.3.14";
|
||||
version = "1.3.15";
|
||||
pname = "graphite2";
|
||||
|
||||
src = fetchurl {
|
||||
url =
|
||||
with finalAttrs;
|
||||
"https://github.com/silnrsi/graphite/releases/download/${version}/${pname}-${version}.tgz";
|
||||
sha256 = "1790ajyhk0ax8xxamnrk176gc9gvhadzy78qia4rd8jzm89ir7gr";
|
||||
hash = "sha256-xryLQlJyRmUpf3ytDFWJcoXGc/m45ts1IqzoM1k/4LE=";
|
||||
};
|
||||
|
||||
outputs = [
|
||||
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
|
||||
nativeBuildInputs = [
|
||||
pkg-config
|
||||
(python3.withPackages (ps: [ ps.fonttools ]))
|
||||
cmake
|
||||
];
|
||||
buildInputs = [
|
||||
@@ -40,14 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
}
|
||||
);
|
||||
|
||||
patches = [
|
||||
# Fix build with gcc15
|
||||
(fetchpatch {
|
||||
url = "https://src.fedoraproject.org/rpms/graphite2/raw/deba28323b0a3b7a3dcfd06df1efc2195b102ed7/f/graphite2-1.3.14-gcc15.patch";
|
||||
hash = "sha256-vkkGkHkcsj1mD3OHCHLWWgpcmFDv8leC4YQm+TsbIUw=";
|
||||
})
|
||||
]
|
||||
++ lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
|
||||
patches = lib.optionals stdenv.hostPlatform.isDarwin [ ./macosx.patch ];
|
||||
postPatch = ''
|
||||
# disable broken 'nametabletest' test, fails on gcc-13:
|
||||
# https://github.com/silnrsi/graphite/pull/74
|
||||
@@ -61,22 +55,6 @@ stdenv.mkDerivation (finalAttrs: {
|
||||
# headers are located in the dev output:
|
||||
substituteInPlace CMakeLists.txt \
|
||||
--replace-fail ' ''${CMAKE_INSTALL_PREFIX}/include' " ${placeholder "dev"}/include"
|
||||
|
||||
# Fix the build with CMake 4.
|
||||
#
|
||||
# See: <https://github.com/silnrsi/graphite/issues/98>
|
||||
badCmakeFiles=(
|
||||
CMakeLists.txt
|
||||
src/CMakeLists.txt
|
||||
tests/{bittwiddling,json,sparsetest,utftest}/CMakeLists.txt
|
||||
gr2fonttest/CMakeLists.txt
|
||||
)
|
||||
for file in "''${badCmakeFiles[@]}"; do
|
||||
substituteInPlace "$file" \
|
||||
--replace-fail \
|
||||
'CMAKE_MINIMUM_REQUIRED(VERSION 2.8.0 FATAL_ERROR)' \
|
||||
'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
|
||||
done
|
||||
'';
|
||||
|
||||
cmakeFlags = lib.optionals static [
|
||||
|
||||
@@ -2,6 +2,7 @@
|
||||
lib,
|
||||
stdenv,
|
||||
fetchurl,
|
||||
fetchpatch,
|
||||
removeReferencesTo,
|
||||
runtimeShellPackage,
|
||||
texinfo,
|
||||
@@ -25,13 +26,23 @@ assert (doCheck && stdenv.hostPlatform.isLinux) -> glibcLocales != null;
|
||||
|
||||
stdenv.mkDerivation rec {
|
||||
pname = "gawk" + lib.optionalString interactive "-interactive";
|
||||
version = "5.4.0";
|
||||
version = "5.4.1";
|
||||
|
||||
src = fetchurl {
|
||||
url = "mirror://gnu/gawk/gawk-${version}.tar.xz";
|
||||
hash = "sha256-PdQw8M07RCjGw/avwCG5zTwfjJP3pojcJoykKKkLSsE=";
|
||||
hash = "sha256-B/b3NCt/6+QxP8LCVCrZPWT+IK2HFyABCfEFqCb1/Tc=";
|
||||
};
|
||||
|
||||
patches = [
|
||||
# When building gawk without gmp and mpfr, gawk 5.4.1 causes build failures
|
||||
# in downstream packages such as GCC and libpng.
|
||||
# Discussion on bug-gawk:
|
||||
# https://lists.gnu.org/archive/html/bug-gawk/2026-07/msg00013.html
|
||||
# Vendored since we can't use fetchpatch:
|
||||
# https://gitweb.git.savannah.gnu.org/gitweb/?p=gawk.git;a=commit;h=bf85f8a3175af703597082d4c7e0abc2066a44d3
|
||||
./node-struct-without-gmp-mpfr.patch
|
||||
];
|
||||
|
||||
# When we do build separate interactive version, it makes sense to always include man.
|
||||
outputs = [
|
||||
"out"
|
||||
|
||||
79
pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch
Normal file
79
pkgs/tools/text/gawk/node-struct-without-gmp-mpfr.patch
Normal file
@@ -0,0 +1,79 @@
|
||||
From bf85f8a3175af703597082d4c7e0abc2066a44d3 Mon Sep 17 00:00:00 2001
|
||||
From: "Arnold D. Robbins" <arnold@skeeve.com>
|
||||
Date: Tue, 14 Jul 2026 10:14:50 +0300
|
||||
Subject: [PATCH] Workaround fix for systems without MPFR and GMP.
|
||||
|
||||
---
|
||||
ChangeLog | 8 ++++++++
|
||||
awk.h | 23 ++++++++++++++---------
|
||||
2 files changed, 22 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/ChangeLog b/ChangeLog
|
||||
index 6a955eed..42bd2c48 100644
|
||||
--- a/ChangeLog
|
||||
+++ b/ChangeLog
|
||||
@@ -3,6 +3,14 @@
|
||||
* builtin.c (do_dump_node): Add the size of each object to
|
||||
the printout.
|
||||
|
||||
+ Unrelated: Make things works when built on systems without
|
||||
+ the GMP and MPFR libraries. Thanks to Thomas Trepl <ttrepl@yahoo.de>
|
||||
+ and Bruce Dubbs <bdubbs@linuxfromscratch.org> for the reports.
|
||||
+
|
||||
+ * awk.h (struct exp_node): Add alignment padding when we don't
|
||||
+ have MPFR. This is a hack, pending a total refactoring of
|
||||
+ the NODE structure.
|
||||
+
|
||||
2026-07-08 Arnold D. Robbins <arnold@skeeve.com>
|
||||
|
||||
* 5.4.1: Release tar ball made.
|
||||
diff --git a/awk.h b/awk.h
|
||||
index dbad0d81..f4a84300 100644
|
||||
--- a/awk.h
|
||||
+++ b/awk.h
|
||||
@@ -406,17 +406,24 @@ typedef struct exp_node {
|
||||
} nodep;
|
||||
|
||||
struct {
|
||||
-#ifdef HAVE_MPFR
|
||||
union {
|
||||
AWKNUM fltnum;
|
||||
+#ifdef HAVE_MPFR
|
||||
mpfr_t mpnum;
|
||||
mpz_t mpi;
|
||||
- } nm;
|
||||
- int rndmode;
|
||||
#else
|
||||
- AWKNUM fltnum;
|
||||
- int for_alignment_only; // especially on 32-bit
|
||||
-#endif
|
||||
+ // 7/2026:
|
||||
+ // This is a workaround for systems that build
|
||||
+ // gawk without MPFR and GMP. The NODE struct
|
||||
+ // desperately needs to be refactored.
|
||||
+#if SIZEOF_VOID_P == 4
|
||||
+ char alignment[28];
|
||||
+#else // SIZEOF_VOID_P != 4
|
||||
+ char alignment[48];
|
||||
+#endif // SIZEOF_VOID_P != 4
|
||||
+#endif // HAVE_MPFR
|
||||
+ } nm;
|
||||
+ int rndmode; // only used for MPFR.
|
||||
char *sp;
|
||||
size_t slen;
|
||||
int idx;
|
||||
@@ -561,10 +568,8 @@ typedef struct exp_node {
|
||||
#ifdef HAVE_MPFR
|
||||
#define mpg_numbr sub.val.nm.mpnum
|
||||
#define mpg_i sub.val.nm.mpi
|
||||
-#define numbr sub.val.nm.fltnum
|
||||
-#else
|
||||
-#define numbr sub.val.fltnum
|
||||
#endif
|
||||
+#define numbr sub.val.nm.fltnum
|
||||
#define typed_re sub.val.typre
|
||||
|
||||
/*
|
||||
--
|
||||
2.54.0
|
||||
|
||||
Reference in New Issue
Block a user