From d81c0d0ae3c0518b1ffd4e0589e55146ce4ba873 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 1 Nov 2025 22:02:08 +0100
Subject: [PATCH] glib: apply patch for CVE-2025-7039

Not-cherry-picked-because: unstable will be bumped to 2.86.0 as part of
the GNOME 49 upgrade.
---
 pkgs/by-name/gl/glib/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index 763bb75f6956..a24f89f13418 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -3,6 +3,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   gettext,
   meson,
   ninja,
@@ -99,6 +100,12 @@ stdenv.mkDerivation (finalAttrs: {
       ./gobject_init_on_demand.patch
     ]
     ++ [
+      (fetchpatch {
+        name = "CVE-2025-7039.patch";
+        url = "https://gitlab.gnome.org/GNOME/glib/-/commit/61e963284889ddb4544e6f1d5261c16120f6fcc3.patch";
+        hash = "sha256-g0TIvKk5XEb4+iiDsDBkDH62ldlQ/jjGsMhHORD806k=";
+      })
+
       # This patch lets GLib's GDesktopAppInfo API watch and notice changes
       # to the Nix user and system profiles.  That way, the list of available
       # applications shown by the desktop environment is immediately updated