From e178b0a9d394f1b3620ca11fd6b2b862f33d88ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 13 Sep 2026 17:01:00 -0700
Subject: [PATCH] cups: patch CVE-2026-87875 and CVE-2026-87876

(cherry picked from commit 721870b2a6b45718df1c52ae2b4fb8595d3a394a)
---
 pkgs/by-name/cu/cups/package.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index dd12a5dcef57..bc7e13d02f1f 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   removeReferencesTo,
   zlib,
@@ -42,6 +43,29 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-87875.patch";
+      url = "https://github.com/OpenPrinting/cups/commit/2b1dc178a2d2325135b855142e384f4e8c42d8e4.patch";
+      excludes = [ "CHANGES.md" ];
+      hash = "sha256-WHw/UWyUuYEBC6TRADpw+BBCaCts9Nd0jS9qsQHTBMo=";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/cups/commit/76b515154ce6264dae6d7cc44915d85e0e5fa0f4.patch";
+      hash = "sha256-KtwcB4KrFmsLbtAz6u593qxbnozW2Vb/I9yX36gZTd0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/OpenPrinting/cups/commit/526adb34fe87f7f0cf5f63ae26751c1afa36a5d6.patch";
+      hash = "sha256-Pg2xbCXalbvDvv5iI19MrjpOTW03XLKfEHN+lhImG1U=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-87876.patch";
+      url = "https://github.com/OpenPrinting/cups/commit/88e67c00c130a45f3a1edf36686f7a0b2982fef8.patch";
+      excludes = [ "CHANGES.md" ];
+      hash = "sha256-gohcRO93JE2ldF5uPbR0re9NYxb13AeVn4b/qYsQGaE=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace cups/testfile.c \
       --replace 'cupsFileFind("cat", "/bin' 'cupsFileFind("cat", "${coreutils}/bin'