From d3c01fced9dd0429700369918b24a13820c01bb0 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Thu, 13 Aug 2026 10:50:10 +0200
Subject: [PATCH] rsyslog: fix CVE-2026-19654

Guard imptcp regex framing against submitting a negative message length
after oversize-frame recovery.

https://redirect.github.com/rsyslog/rsyslog/security/advisories/GHSA-cj5r-wh2m-7w29
https://redirect.github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit d5f0e6289907d5e632998c84963452ff6f04f5c0)
---
 pkgs/by-name/rs/rsyslog/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/rs/rsyslog/package.nix b/pkgs/by-name/rs/rsyslog/package.nix
index dccac3ae60ff..1c4611076eda 100644
--- a/pkgs/by-name/rs/rsyslog/package.nix
+++ b/pkgs/by-name/rs/rsyslog/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   pkg-config,
   autoreconfHook,
   autoconf-archive,
@@ -72,6 +73,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-JXSz8waOaVXrlO9WQ+K2pbhYXMjqp3IJ/1y8Hi5fceU=";
   };
 
+  patches = [
+    # Remove with rsyslog 8.2608.0 or newer.
+    (fetchpatch {
+      name = "CVE-2026-19654.patch";
+      url = "https://github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08.patch";
+      hash = "sha256-ww8Ade2eKrQygJduLMPFjxd/fmBnpQ4ePLEzHffPy90=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook