From e22c217c07540b6a39e80665081c91c7ebb29f3e Mon Sep 17 00:00:00 2001
From: Robert Scott <code@humanleg.org.uk>
Date: Mon, 27 Dec 2021 13:06:36 +0000
Subject: [PATCH] lapack: add patch for CVE-2021-4048

(cherry picked from commit 6d952e40483a6951d585b79070872e81909409a9)
---
 .../libraries/science/math/liblapack/default.nix         | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/libraries/science/math/liblapack/default.nix b/pkgs/development/libraries/science/math/liblapack/default.nix
index 50563f2745ab..6b9b7f96fee8 100644
--- a/pkgs/development/libraries/science/math/liblapack/default.nix
+++ b/pkgs/development/libraries/science/math/liblapack/default.nix
@@ -1,6 +1,7 @@
 {
   lib, stdenv,
   fetchFromGitHub,
+  fetchpatch,
   gfortran,
   cmake,
   shared ? true
@@ -21,6 +22,14 @@ stdenv.mkDerivation rec {
     sha256 = "0sxnc97z67i7phdmcnq8f8lmxgw10wdwvr8ami0w3pb179cgrbpb";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-4048.patch";
+      url = "https://github.com/Reference-LAPACK/lapack/commit/0631b6beaed60ba118b0b027c0f8d35397bf5df0.patch";
+      sha256 = "1bqjw3f6ak9iz97y7ckn0rrfcgrzbn9prgfasl489qpxgzp2kjh8";
+    })
+  ];
+
   nativeBuildInputs = [ gfortran cmake ];
 
   # Configure stage fails on aarch64-darwin otherwise, due to either clang 11 or gfortran 10.