From c4e5eee372a9d4c8f2b8d478e9a9c6cf304243d7 Mon Sep 17 00:00:00 2001 From: squalus Date: Thu, 30 Jun 2022 09:24:58 -0700 Subject: [PATCH 01/13] python310Packages.setuptools-scm: fix cross compile of dependents Packages depending on setuptools-scm need the setuptools module at build time. Add setuptools to the propagatedBuildInputs so this is guaranteed. This fixes cross compile of the dependent packages. (cherry picked from commit 77e6eda9b237561d8e3da020e20c84d17d4aaf27) --- pkgs/development/python-modules/setuptools-scm/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/development/python-modules/setuptools-scm/default.nix b/pkgs/development/python-modules/setuptools-scm/default.nix index c175cfb4c609..5fa082d82210 100644 --- a/pkgs/development/python-modules/setuptools-scm/default.nix +++ b/pkgs/development/python-modules/setuptools-scm/default.nix @@ -3,6 +3,7 @@ , fetchPypi , packaging , tomli +, setuptools , lib }: @@ -19,6 +20,7 @@ buildPythonPackage rec { propagatedBuildInputs = [ packaging tomli + setuptools ]; pythonImportsCheck = [ From 2697a8cd480deb7ec5f4365e2da575ffd27c9d8a Mon Sep 17 00:00:00 2001 From: ajs124 Date: Wed, 29 Jun 2022 15:28:53 +0200 Subject: [PATCH 02/13] libwebp: 1.2.1 -> 1.2.2 also clean up and take up maintainership (cherry picked from commit 51619a501fc9736283932fe020388ff876946a05) --- .../development/libraries/libwebp/default.nix | 49 ++++++++----------- 1 file changed, 21 insertions(+), 28 deletions(-) diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix index da75d3a91504..f90de7fc6eff 100644 --- a/pkgs/development/libraries/libwebp/default.nix +++ b/pkgs/development/libraries/libwebp/default.nix @@ -5,7 +5,6 @@ , jpegSupport ? true, libjpeg # JPEG image format , tiffSupport ? true, libtiff # TIFF image format , gifSupport ? true, giflib # GIF image format -#, wicSupport ? true # Windows Imaging Component , alignedSupport ? false # Force aligned memory operations , swap16bitcspSupport ? false # Byte swap for 16bit color spaces , experimentalSupport ? false # Experimental code @@ -14,55 +13,49 @@ , libwebpdecoderSupport ? true # Build libwebpdecoder }: -let - mkFlag = optSet: flag: if optSet then "--enable-${flag}" else "--disable-${flag}"; -in - -with lib; stdenv.mkDerivation rec { pname = "libwebp"; - version = "1.2.1"; + version = "1.2.2"; src = fetchFromGitHub { owner = "webmproject"; repo = pname; rev = "v${version}"; - hash = "sha256-KrvB5d3KNmujbfekWaevz2JZrWtK3PjEG9NEzRBYIDw="; + hash = "sha256-WF2HZPS7mbotk+d1oLM/JC5l/FWfkrk+T3Z6EW9oYEI="; }; prePatch = "patchShebangs ."; configureFlags = [ - (mkFlag threadingSupport "threading") - (mkFlag openglSupport "gl") - (mkFlag pngSupport "png") - (mkFlag jpegSupport "jpeg") - (mkFlag tiffSupport "tiff") - (mkFlag gifSupport "gif") - #(mkFlag (wicSupport && stdenv.isCygwin) "wic") - (mkFlag alignedSupport "aligned") - (mkFlag swap16bitcspSupport "swap-16bit-csp") - (mkFlag experimentalSupport "experimental") - (mkFlag libwebpmuxSupport "libwebpmux") - (mkFlag libwebpdemuxSupport "libwebpdemux") - (mkFlag libwebpdecoderSupport "libwebpdecoder") + (lib.enableFeature threadingSupport "threading") + (lib.enableFeature openglSupport "gl") + (lib.enableFeature pngSupport "png") + (lib.enableFeature jpegSupport "jpeg") + (lib.enableFeature tiffSupport "tiff") + (lib.enableFeature gifSupport "gif") + (lib.enableFeature alignedSupport "aligned") + (lib.enableFeature swap16bitcspSupport "swap-16bit-csp") + (lib.enableFeature experimentalSupport "experimental") + (lib.enableFeature libwebpmuxSupport "libwebpmux") + (lib.enableFeature libwebpdemuxSupport "libwebpdemux") + (lib.enableFeature libwebpdecoderSupport "libwebpdecoder") ]; nativeBuildInputs = [ autoreconfHook libtool ]; buildInputs = [ ] - ++ optionals openglSupport [ freeglut libGL libGLU ] - ++ optional pngSupport libpng - ++ optional jpegSupport libjpeg - ++ optional tiffSupport libtiff - ++ optional gifSupport giflib; + ++ lib.optionals openglSupport [ freeglut libGL libGLU ] + ++ lib.optionals pngSupport [ libpng ] + ++ lib.optionals jpegSupport [ libjpeg ] + ++ lib.optionals tiffSupport [ libtiff ] + ++ lib.optionals gifSupport [ giflib ]; enableParallelBuilding = true; - meta = { + meta = with lib; { description = "Tools and library for the WebP image format"; homepage = "https://developers.google.com/speed/webp/"; license = licenses.bsd3; platforms = platforms.all; - maintainers = with maintainers; [ codyopel ]; + maintainers = with maintainers; [ ajs124 ]; }; } From d213bd21d88abdda65f67f08ee4942a6a50e4a1f Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sun, 31 Jul 2022 21:25:37 +0000 Subject: [PATCH 03/13] libwebp: 1.2.2 -> 1.2.3 (cherry picked from commit 964ee6f55f23058eead4bbfd3c3c037213a251f0) --- pkgs/development/libraries/libwebp/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/libwebp/default.nix b/pkgs/development/libraries/libwebp/default.nix index f90de7fc6eff..48b91ffa159c 100644 --- a/pkgs/development/libraries/libwebp/default.nix +++ b/pkgs/development/libraries/libwebp/default.nix @@ -15,13 +15,13 @@ stdenv.mkDerivation rec { pname = "libwebp"; - version = "1.2.2"; + version = "1.2.3"; src = fetchFromGitHub { owner = "webmproject"; repo = pname; rev = "v${version}"; - hash = "sha256-WF2HZPS7mbotk+d1oLM/JC5l/FWfkrk+T3Z6EW9oYEI="; + hash = "sha256-t27d+eJR4iTHSLlI3J7RqHgsWACThjsI9O6R2Zb9F1g="; }; prePatch = "patchShebangs ."; From 41e104e61b8592e75407f22625e869361ec6fccc Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Wed, 3 Aug 2022 13:25:12 +0200 Subject: [PATCH 04/13] python3Packages.django_3: 3.2.14 -> 3.2.15 https://www.djangoproject.com/weblog/2022/aug/03/security-releases/ Fixes: CVE-2022-36359 (cherry picked from commit ae26091d3732dc009c9e14e4cf763c049e5907dd) --- pkgs/development/python-modules/django/3.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/django/3.nix b/pkgs/development/python-modules/django/3.nix index 48111330741b..c5b9adcca3e9 100644 --- a/pkgs/development/python-modules/django/3.nix +++ b/pkgs/development/python-modules/django/3.nix @@ -13,14 +13,14 @@ buildPythonPackage rec { pname = "django"; - version = "3.2.14"; + version = "3.2.15"; disabled = pythonOlder "3.7"; src = fetchPypi { pname = "Django"; inherit version; - sha256 = "sha256-Z3GCuotbKFpOBy86wXzu5q/xtc53/Rc8xbai09wCL88="; + hash = "sha256-9xk0sagi8UqGyayWNAU2iSec0ErmnLat5KWUcbiGWCs="; }; patches = lib.optional withGdal From 43ce4ac1224312a7ae56d96b063178ae72668458 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Fri, 5 Aug 2022 11:21:16 +0200 Subject: [PATCH 05/13] nspr: 4.34 -> 4.34.1 (cherry picked from commit 83daa6a316157ac3fde35410d82d7f7e06a6fd38) --- pkgs/development/libraries/nspr/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/libraries/nspr/default.nix b/pkgs/development/libraries/nspr/default.nix index 9fec80aa56ea..20cdb8d29c05 100644 --- a/pkgs/development/libraries/nspr/default.nix +++ b/pkgs/development/libraries/nspr/default.nix @@ -7,11 +7,11 @@ stdenv.mkDerivation rec { pname = "nspr"; - version = "4.34"; + version = "4.34.1"; src = fetchurl { url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz"; - sha256 = "177rxcf3lglabs7sgwcvf72ww4v56qa71lc495wl13sxs4f03vxy"; + hash = "sha256-xbg1TEi2Mrj0wZcGKBRsDgwMqPMscxXX1XNsAC4Dd08="; }; patches = [ From b966358263e7823b6e9ec10fe0374e9585a6d6b0 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 31 Jul 2022 16:45:07 +0100 Subject: [PATCH 06/13] SDL: add patch for CVE-2022-34568 (cherry picked from commit eda5ea847ddf7f8cf70a1e45d15ae1805da232a3) --- pkgs/development/libraries/SDL/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/libraries/SDL/default.nix b/pkgs/development/libraries/SDL/default.nix index 059ba65b25c4..3a2a048a860e 100644 --- a/pkgs/development/libraries/SDL/default.nix +++ b/pkgs/development/libraries/SDL/default.nix @@ -104,6 +104,11 @@ stdenv.mkDerivation rec { url = "https://github.com/libsdl-org/SDL-1.2/commit/7933032ad4d57c24f2230db29f67eb7d21bb5654.patch"; sha256 = "1by16firaxyr0hjvn35whsgcmq6bl0nwhnpjf75grjzsw9qvwyia"; }) + (fetchpatch { + name = "CVE-2022-34568.patch"; + url = "https://github.com/libsdl-org/SDL-1.2/commit/d7e00208738a0bc6af302723fe64908ac35b777b.patch"; + sha256 = "sha256-fuxXsqZW94/C8CKu9LakppCU4zHupj66O2MngQ4BO9o="; + }) ]; postInstall = '' From eda117687797c974fa21f57508f17a0501ed7f61 Mon Sep 17 00:00:00 2001 From: Robert Scott Date: Sun, 31 Jul 2022 17:29:52 +0100 Subject: [PATCH 07/13] libtiff: add patch for CVE-2022-34526 (cherry picked from commit 19c5c57e72da4f3289cd216fd7b190035eea3187) --- pkgs/development/libraries/libtiff/default.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/development/libraries/libtiff/default.nix b/pkgs/development/libraries/libtiff/default.nix index 410447a78321..f08e815d6d73 100644 --- a/pkgs/development/libraries/libtiff/default.nix +++ b/pkgs/development/libraries/libtiff/default.nix @@ -93,6 +93,11 @@ stdenv.mkDerivation rec { url = "https://gitlab.com/libtiff/libtiff/-/commit/c1ae29f9ebacd29b7c3e0c7db671af7db3584bc2.patch"; sha256 = "1y75c72s41pl39d5zr5pmkiyfrancllv8fbl10zvc67pg3qjq4v8"; }) + (fetchpatch { + name = "CVE-2022-34526.patch"; + url = "https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990.patch"; + sha256 = "sha256-faKsdJjvQwNdkAKjYm4vubvZvnULt9zz4l53zBFr67s="; + }) ]; postPatch = '' From fe877f069cf38ded594597f23d6b375e29611dae Mon Sep 17 00:00:00 2001 From: Winter Date: Mon, 8 Aug 2022 14:26:43 -0400 Subject: [PATCH 08/13] zlib: remove superfluous patch files (cherry picked from commit 5323fa886e74e3d2195b3c962a6b14029d3c1e6f) --- .../libraries/zlib/CVE-2018-25032-1.patch | 346 ------------------ .../libraries/zlib/CVE-2018-25032-2.patch | 27 -- 2 files changed, 373 deletions(-) delete mode 100644 pkgs/development/libraries/zlib/CVE-2018-25032-1.patch delete mode 100644 pkgs/development/libraries/zlib/CVE-2018-25032-2.patch diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch deleted file mode 100644 index 1ade02654e58..000000000000 --- a/pkgs/development/libraries/zlib/CVE-2018-25032-1.patch +++ /dev/null @@ -1,346 +0,0 @@ -From 5c44459c3b28a9bd3283aaceab7c615f8020c531 Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Tue, 17 Apr 2018 22:09:22 -0700 -Subject: [PATCH 1/2] Fix a bug that can crash deflate on some input when using - Z_FIXED. - -This bug was reported by Danilo Ramos of Eideticom, Inc. It has -lain in wait 13 years before being found! The bug was introduced -in zlib 1.2.2.2, with the addition of the Z_FIXED option. That -option forces the use of fixed Huffman codes. For rare inputs with -a large number of distant matches, the pending buffer into which -the compressed data is written can overwrite the distance symbol -table which it overlays. That results in corrupted output due to -invalid distances, and can result in out-of-bound accesses, -crashing the application. - -The fix here combines the distance buffer and literal/length -buffers into a single symbol buffer. Now three bytes of pending -buffer space are opened up for each literal or length/distance -pair consumed, instead of the previous two bytes. This assures -that the pending buffer cannot overwrite the symbol table, since -the maximum fixed code compressed length/distance is 31 bits, and -since there are four bytes of pending space for every three bytes -of symbol space. ---- - deflate.c | 74 ++++++++++++++++++++++++++++++++++++++++--------------- - deflate.h | 25 +++++++++---------- - trees.c | 50 +++++++++++-------------------------- - 3 files changed, 79 insertions(+), 70 deletions(-) - -diff --git a/deflate.c b/deflate.c -index 425babc..19cba87 100644 ---- a/deflate.c -+++ b/deflate.c -@@ -255,11 +255,6 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - int wrap = 1; - static const char my_version[] = ZLIB_VERSION; - -- ushf *overlay; -- /* We overlay pending_buf and d_buf+l_buf. This works since the average -- * output size for (length,distance) codes is <= 24 bits. -- */ -- - if (version == Z_NULL || version[0] != my_version[0] || - stream_size != sizeof(z_stream)) { - return Z_VERSION_ERROR; -@@ -329,9 +324,47 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - - s->lit_bufsize = 1 << (memLevel + 6); /* 16K elements by default */ - -- overlay = (ushf *) ZALLOC(strm, s->lit_bufsize, sizeof(ush)+2); -- s->pending_buf = (uchf *) overlay; -- s->pending_buf_size = (ulg)s->lit_bufsize * (sizeof(ush)+2L); -+ /* We overlay pending_buf and sym_buf. This works since the average size -+ * for length/distance pairs over any compressed block is assured to be 31 -+ * bits or less. -+ * -+ * Analysis: The longest fixed codes are a length code of 8 bits plus 5 -+ * extra bits, for lengths 131 to 257. The longest fixed distance codes are -+ * 5 bits plus 13 extra bits, for distances 16385 to 32768. The longest -+ * possible fixed-codes length/distance pair is then 31 bits total. -+ * -+ * sym_buf starts one-fourth of the way into pending_buf. So there are -+ * three bytes in sym_buf for every four bytes in pending_buf. Each symbol -+ * in sym_buf is three bytes -- two for the distance and one for the -+ * literal/length. As each symbol is consumed, the pointer to the next -+ * sym_buf value to read moves forward three bytes. From that symbol, up to -+ * 31 bits are written to pending_buf. The closest the written pending_buf -+ * bits gets to the next sym_buf symbol to read is just before the last -+ * code is written. At that time, 31*(n-2) bits have been written, just -+ * after 24*(n-2) bits have been consumed from sym_buf. sym_buf starts at -+ * 8*n bits into pending_buf. (Note that the symbol buffer fills when n-1 -+ * symbols are written.) The closest the writing gets to what is unread is -+ * then n+14 bits. Here n is lit_bufsize, which is 16384 by default, and -+ * can range from 128 to 32768. -+ * -+ * Therefore, at a minimum, there are 142 bits of space between what is -+ * written and what is read in the overlain buffers, so the symbols cannot -+ * be overwritten by the compressed data. That space is actually 139 bits, -+ * due to the three-bit fixed-code block header. -+ * -+ * That covers the case where either Z_FIXED is specified, forcing fixed -+ * codes, or when the use of fixed codes is chosen, because that choice -+ * results in a smaller compressed block than dynamic codes. That latter -+ * condition then assures that the above analysis also covers all dynamic -+ * blocks. A dynamic-code block will only be chosen to be emitted if it has -+ * fewer bits than a fixed-code block would for the same set of symbols. -+ * Therefore its average symbol length is assured to be less than 31. So -+ * the compressed data for a dynamic block also cannot overwrite the -+ * symbols from which it is being constructed. -+ */ -+ -+ s->pending_buf = (uchf *) ZALLOC(strm, s->lit_bufsize, 4); -+ s->pending_buf_size = (ulg)s->lit_bufsize * 4; - - if (s->window == Z_NULL || s->prev == Z_NULL || s->head == Z_NULL || - s->pending_buf == Z_NULL) { -@@ -340,8 +373,12 @@ int ZEXPORT deflateInit2_(strm, level, method, windowBits, memLevel, strategy, - deflateEnd (strm); - return Z_MEM_ERROR; - } -- s->d_buf = overlay + s->lit_bufsize/sizeof(ush); -- s->l_buf = s->pending_buf + (1+sizeof(ush))*s->lit_bufsize; -+ s->sym_buf = s->pending_buf + s->lit_bufsize; -+ s->sym_end = (s->lit_bufsize - 1) * 3; -+ /* We avoid equality with lit_bufsize*3 because of wraparound at 64K -+ * on 16 bit machines and because stored blocks are restricted to -+ * 64K-1 bytes. -+ */ - - s->level = level; - s->strategy = strategy; -@@ -552,7 +589,7 @@ int ZEXPORT deflatePrime (strm, bits, value) - - if (deflateStateCheck(strm)) return Z_STREAM_ERROR; - s = strm->state; -- if ((Bytef *)(s->d_buf) < s->pending_out + ((Buf_size + 7) >> 3)) -+ if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) - return Z_BUF_ERROR; - do { - put = Buf_size - s->bi_valid; -@@ -1113,7 +1150,6 @@ int ZEXPORT deflateCopy (dest, source) - #else - deflate_state *ds; - deflate_state *ss; -- ushf *overlay; - - - if (deflateStateCheck(source) || dest == Z_NULL) { -@@ -1133,8 +1169,7 @@ int ZEXPORT deflateCopy (dest, source) - ds->window = (Bytef *) ZALLOC(dest, ds->w_size, 2*sizeof(Byte)); - ds->prev = (Posf *) ZALLOC(dest, ds->w_size, sizeof(Pos)); - ds->head = (Posf *) ZALLOC(dest, ds->hash_size, sizeof(Pos)); -- overlay = (ushf *) ZALLOC(dest, ds->lit_bufsize, sizeof(ush)+2); -- ds->pending_buf = (uchf *) overlay; -+ ds->pending_buf = (uchf *) ZALLOC(dest, ds->lit_bufsize, 4); - - if (ds->window == Z_NULL || ds->prev == Z_NULL || ds->head == Z_NULL || - ds->pending_buf == Z_NULL) { -@@ -1148,8 +1183,7 @@ int ZEXPORT deflateCopy (dest, source) - zmemcpy(ds->pending_buf, ss->pending_buf, (uInt)ds->pending_buf_size); - - ds->pending_out = ds->pending_buf + (ss->pending_out - ss->pending_buf); -- ds->d_buf = overlay + ds->lit_bufsize/sizeof(ush); -- ds->l_buf = ds->pending_buf + (1+sizeof(ush))*ds->lit_bufsize; -+ ds->sym_buf = ds->pending_buf + ds->lit_bufsize; - - ds->l_desc.dyn_tree = ds->dyn_ltree; - ds->d_desc.dyn_tree = ds->dyn_dtree; -@@ -1925,7 +1959,7 @@ local block_state deflate_fast(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2056,7 +2090,7 @@ local block_state deflate_slow(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2131,7 +2165,7 @@ local block_state deflate_rle(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -@@ -2170,7 +2204,7 @@ local block_state deflate_huff(s, flush) - FLUSH_BLOCK(s, 1); - return finish_done; - } -- if (s->last_lit) -+ if (s->sym_next) - FLUSH_BLOCK(s, 0); - return block_done; - } -diff --git a/deflate.h b/deflate.h -index 23ecdd3..d4cf1a9 100644 ---- a/deflate.h -+++ b/deflate.h -@@ -217,7 +217,7 @@ typedef struct internal_state { - /* Depth of each subtree used as tie breaker for trees of equal frequency - */ - -- uchf *l_buf; /* buffer for literals or lengths */ -+ uchf *sym_buf; /* buffer for distances and literals/lengths */ - - uInt lit_bufsize; - /* Size of match buffer for literals/lengths. There are 4 reasons for -@@ -239,13 +239,8 @@ typedef struct internal_state { - * - I can't count above 4 - */ - -- uInt last_lit; /* running index in l_buf */ -- -- ushf *d_buf; -- /* Buffer for distances. To simplify the code, d_buf and l_buf have -- * the same number of elements. To use different lengths, an extra flag -- * array would be necessary. -- */ -+ uInt sym_next; /* running index in sym_buf */ -+ uInt sym_end; /* symbol table full when sym_next reaches this */ - - ulg opt_len; /* bit length of current block with optimal trees */ - ulg static_len; /* bit length of current block with static trees */ -@@ -325,20 +320,22 @@ void ZLIB_INTERNAL _tr_stored_block OF((deflate_state *s, charf *buf, - - # define _tr_tally_lit(s, c, flush) \ - { uch cc = (c); \ -- s->d_buf[s->last_lit] = 0; \ -- s->l_buf[s->last_lit++] = cc; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = 0; \ -+ s->sym_buf[s->sym_next++] = cc; \ - s->dyn_ltree[cc].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - # define _tr_tally_dist(s, distance, length, flush) \ - { uch len = (uch)(length); \ - ush dist = (ush)(distance); \ -- s->d_buf[s->last_lit] = dist; \ -- s->l_buf[s->last_lit++] = len; \ -+ s->sym_buf[s->sym_next++] = dist; \ -+ s->sym_buf[s->sym_next++] = dist >> 8; \ -+ s->sym_buf[s->sym_next++] = len; \ - dist--; \ - s->dyn_ltree[_length_code[len]+LITERALS+1].Freq++; \ - s->dyn_dtree[d_code(dist)].Freq++; \ -- flush = (s->last_lit == s->lit_bufsize-1); \ -+ flush = (s->sym_next == s->sym_end); \ - } - #else - # define _tr_tally_lit(s, c, flush) flush = _tr_tally(s, 0, c) -diff --git a/trees.c b/trees.c -index 4f4a650..decaeb7 100644 ---- a/trees.c -+++ b/trees.c -@@ -416,7 +416,7 @@ local void init_block(s) - - s->dyn_ltree[END_BLOCK].Freq = 1; - s->opt_len = s->static_len = 0L; -- s->last_lit = s->matches = 0; -+ s->sym_next = s->matches = 0; - } - - #define SMALLEST 1 -@@ -948,7 +948,7 @@ void ZLIB_INTERNAL _tr_flush_block(s, buf, stored_len, last) - - Tracev((stderr, "\nopt %lu(%lu) stat %lu(%lu) stored %lu lit %u ", - opt_lenb, s->opt_len, static_lenb, s->static_len, stored_len, -- s->last_lit)); -+ s->sym_next / 3)); - - if (static_lenb <= opt_lenb) opt_lenb = static_lenb; - -@@ -1017,8 +1017,9 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - unsigned dist; /* distance of matched string */ - unsigned lc; /* match length-MIN_MATCH or unmatched char (if dist==0) */ - { -- s->d_buf[s->last_lit] = (ush)dist; -- s->l_buf[s->last_lit++] = (uch)lc; -+ s->sym_buf[s->sym_next++] = dist; -+ s->sym_buf[s->sym_next++] = dist >> 8; -+ s->sym_buf[s->sym_next++] = lc; - if (dist == 0) { - /* lc is the unmatched char */ - s->dyn_ltree[lc].Freq++; -@@ -1033,30 +1034,7 @@ int ZLIB_INTERNAL _tr_tally (s, dist, lc) - s->dyn_ltree[_length_code[lc]+LITERALS+1].Freq++; - s->dyn_dtree[d_code(dist)].Freq++; - } -- --#ifdef TRUNCATE_BLOCK -- /* Try to guess if it is profitable to stop the current block here */ -- if ((s->last_lit & 0x1fff) == 0 && s->level > 2) { -- /* Compute an upper bound for the compressed length */ -- ulg out_length = (ulg)s->last_lit*8L; -- ulg in_length = (ulg)((long)s->strstart - s->block_start); -- int dcode; -- for (dcode = 0; dcode < D_CODES; dcode++) { -- out_length += (ulg)s->dyn_dtree[dcode].Freq * -- (5L+extra_dbits[dcode]); -- } -- out_length >>= 3; -- Tracev((stderr,"\nlast_lit %u, in %ld, out ~%ld(%ld%%) ", -- s->last_lit, in_length, out_length, -- 100L - out_length*100L/in_length)); -- if (s->matches < s->last_lit/2 && out_length < in_length/2) return 1; -- } --#endif -- return (s->last_lit == s->lit_bufsize-1); -- /* We avoid equality with lit_bufsize because of wraparound at 64K -- * on 16 bit machines and because stored blocks are restricted to -- * 64K-1 bytes. -- */ -+ return (s->sym_next == s->sym_end); - } - - /* =========================================================================== -@@ -1069,13 +1047,14 @@ local void compress_block(s, ltree, dtree) - { - unsigned dist; /* distance of matched string */ - int lc; /* match length or unmatched char (if dist == 0) */ -- unsigned lx = 0; /* running index in l_buf */ -+ unsigned sx = 0; /* running index in sym_buf */ - unsigned code; /* the code to send */ - int extra; /* number of extra bits to send */ - -- if (s->last_lit != 0) do { -- dist = s->d_buf[lx]; -- lc = s->l_buf[lx++]; -+ if (s->sym_next != 0) do { -+ dist = s->sym_buf[sx++] & 0xff; -+ dist += (unsigned)(s->sym_buf[sx++] & 0xff) << 8; -+ lc = s->sym_buf[sx++]; - if (dist == 0) { - send_code(s, lc, ltree); /* send a literal byte */ - Tracecv(isgraph(lc), (stderr," '%c' ", lc)); -@@ -1100,11 +1079,10 @@ local void compress_block(s, ltree, dtree) - } - } /* literal or match pair ? */ - -- /* Check that the overlay between pending_buf and d_buf+l_buf is ok: */ -- Assert((uInt)(s->pending) < s->lit_bufsize + 2*lx, -- "pendingBuf overflow"); -+ /* Check that the overlay between pending_buf and sym_buf is ok: */ -+ Assert(s->pending < s->lit_bufsize + sx, "pendingBuf overflow"); - -- } while (lx < s->last_lit); -+ } while (sx < s->sym_next); - - send_code(s, END_BLOCK, ltree); - } --- -2.33.1 - diff --git a/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch b/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch deleted file mode 100644 index dadc904a07fb..000000000000 --- a/pkgs/development/libraries/zlib/CVE-2018-25032-2.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 4346a16853e19b45787ce933666026903fb8f3f8 Mon Sep 17 00:00:00 2001 -From: Mark Adler -Date: Tue, 17 Apr 2018 22:44:41 -0700 -Subject: [PATCH 2/2] Assure that the number of bits for deflatePrime() is - valid. - ---- - deflate.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/deflate.c b/deflate.c -index 19cba87..23aef18 100644 ---- a/deflate.c -+++ b/deflate.c -@@ -589,7 +589,8 @@ int ZEXPORT deflatePrime (strm, bits, value) - - if (deflateStateCheck(strm)) return Z_STREAM_ERROR; - s = strm->state; -- if (s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) -+ if (bits < 0 || bits > 16 || -+ s->sym_buf < s->pending_out + ((Buf_size + 7) >> 3)) - return Z_BUF_ERROR; - do { - put = Buf_size - s->bi_valid; --- -2.33.1 - From 34ec472210ac9a62b12b4a61057f20c7ab8ade87 Mon Sep 17 00:00:00 2001 From: Winter Date: Mon, 8 Aug 2022 14:33:13 -0400 Subject: [PATCH 09/13] zlib: add fixed patch for CVE-2022-37434 (cherry picked from commit d56d587e855d762dab920a5a537ee317c066952b) --- .../libraries/zlib/CVE-2022-37434.patch | 62 +++++++++++++++++++ pkgs/development/libraries/zlib/default.nix | 1 + 2 files changed, 63 insertions(+) create mode 100644 pkgs/development/libraries/zlib/CVE-2022-37434.patch diff --git a/pkgs/development/libraries/zlib/CVE-2022-37434.patch b/pkgs/development/libraries/zlib/CVE-2022-37434.patch new file mode 100644 index 000000000000..ad2a849d3b89 --- /dev/null +++ b/pkgs/development/libraries/zlib/CVE-2022-37434.patch @@ -0,0 +1,62 @@ +From eff308af425b67093bab25f80f1ae950166bece1 Mon Sep 17 00:00:00 2001 +From: Mark Adler +Date: Sat, 30 Jul 2022 15:51:11 -0700 +Subject: [PATCH] Fix a bug when getting a gzip header extra field with + inflate(). + +If the extra field was larger than the space the user provided with +inflateGetHeader(), and if multiple calls of inflate() delivered +the extra header data, then there could be a buffer overflow of the +provided space. This commit assures that provided space is not +exceeded. +--- + inflate.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/inflate.c b/inflate.c +index 7be8c6366..7a7289749 100644 +--- a/inflate.c ++++ b/inflate.c +@@ -763,9 +763,10 @@ int flush; + copy = state->length; + if (copy > have) copy = have; + if (copy) { ++ len = state->head->extra_len - state->length; + if (state->head != Z_NULL && +- state->head->extra != Z_NULL) { +- len = state->head->extra_len - state->length; ++ state->head->extra != Z_NULL && ++ len < state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); + +From 1eb7682f845ac9e9bf9ae35bbfb3bad5dacbd91d Mon Sep 17 00:00:00 2001 +From: Mark Adler +Date: Mon, 8 Aug 2022 10:50:09 -0700 +Subject: [PATCH] Fix extra field processing bug that dereferences NULL + state->head. + +The recent commit to fix a gzip header extra field processing bug +introduced the new bug fixed here. +--- + inflate.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/inflate.c b/inflate.c +index 7a7289749..2a3c4fe98 100644 +--- a/inflate.c ++++ b/inflate.c +@@ -763,10 +763,10 @@ int flush; + copy = state->length; + if (copy > have) copy = have; + if (copy) { +- len = state->head->extra_len - state->length; + if (state->head != Z_NULL && + state->head->extra != Z_NULL && +- len < state->head->extra_max) { ++ (len = state->head->extra_len - state->length) < ++ state->head->extra_max) { + zmemcpy(state->head->extra + len, next, + len + copy > state->head->extra_max ? + state->head->extra_max - len : copy); diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix index 64fe2117166d..9ae4c8dfeb52 100644 --- a/pkgs/development/libraries/zlib/default.nix +++ b/pkgs/development/libraries/zlib/default.nix @@ -48,6 +48,7 @@ stdenv.mkDerivation (rec { # TODO: remove the patch if upstream releases https://github.com/madler/zlib/commit/ec3df00224d4b396e2ac6586ab5d25f673caa4c2 # see https://github.com/NixOS/nixpkgs/issues/170539 for history. ./comprehensive-crc-validation-for-wrong-implementations.patch + ./CVE-2022-37434.patch ]; outputs = [ "out" "dev" ] From 80ed09fe79ccb8753fc6e7c55e6f5c7614ee8146 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= Date: Tue, 9 Aug 2022 09:22:33 +0200 Subject: [PATCH 10/13] gnutls: patch CVE-2022-2509 --- pkgs/development/libraries/gnutls/default.nix | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix index 627e5f46f728..ce4016dded1a 100644 --- a/pkgs/development/libraries/gnutls/default.nix +++ b/pkgs/development/libraries/gnutls/default.nix @@ -1,4 +1,5 @@ { config, lib, stdenv, fetchurl, zlib, lzo, libtasn1, nettle, pkg-config, lzip +, fetchpatch , perl, gmp, autoconf, automake, libidn2, libiconv , unbound, dns-root-data, gettext, util-linux , cxxBindings ? !stdenv.hostPlatform.isStatic # tries to link libstdc++.so @@ -33,7 +34,15 @@ stdenv.mkDerivation rec { outputInfo = "devdoc"; outputDoc = "devdoc"; - patches = [ ./nix-ssl-cert-file.patch ] + patches = [ + ./nix-ssl-cert-file.patch + (fetchpatch { + name = "CVE-2022-2509.patch"; + url = "https://gitlab.com/gnutls/gnutls/-/commit/ce37f9eb265dbe9b6d597f5767449e8ee95848e2.diff"; + includes = [ "lib/x509/pkcs7.c" ]; # avoid conflicts in NEWS and tests/Makefile.am + sha256 = "sha256-4OKZMPwkANeOwVQewTwB6uRPPM28skcVYaqdppFiPKo="; + }) + ] # Disable native add_system_trust. ++ lib.optional (isDarwin && !withSecurity) ./no-security-framework.patch; From 7a1f8992075eab052ef6ba652ce3b5780d288529 Mon Sep 17 00:00:00 2001 From: Sergei Trofimovich Date: Sat, 6 Aug 2022 11:35:12 +0100 Subject: [PATCH 11/13] Merge #185394: cairo: pull upstream fix for grayscale aliasing bug (cherry picked from commit 6206494db6ca6bace6fe8968cc35783fee5ad450) --- pkgs/development/libraries/cairo/default.nix | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/pkgs/development/libraries/cairo/default.nix b/pkgs/development/libraries/cairo/default.nix index 8f65bd6c5cd7..e4a9daf8f986 100644 --- a/pkgs/development/libraries/cairo/default.nix +++ b/pkgs/development/libraries/cairo/default.nix @@ -52,6 +52,15 @@ in stdenv.mkDerivation rec { url = "https://github.com/freedesktop/cairo/commit/78266cc8c0f7a595cfe8f3b694bfb9bcc3700b38.patch"; sha256 = "048nzfz7rkgqb9xs0dfs56qdw7ckkxr87nbj3p0qziqdq4nb6wki"; }) + + # Fix unexpected color addition on grayscale images (usually text). + # Upstream fix: https://gitlab.freedesktop.org/cairo/cairo/-/merge_requests/114 + # Can be removed after 1.18 release + (fetchpatch { + name = "fix-grayscale-anialias.patch"; + url = "https://gitlab.freedesktop.org/cairo/cairo/-/commit/4f4d89506f58a64b4829b1bb239bab9e46d63727.diff"; + sha256 = "sha256-mbTg67e7APfdELsuMAgXdY3xokWbGtHF7VDD5UyYqKM="; + }) ] ++ optionals stdenv.hostPlatform.isDarwin [ # Workaround https://gitlab.freedesktop.org/cairo/cairo/-/issues/121 ./skip-configure-stderr-check.patch From bea37451509c201cc0fb18639040fe5627fbdab1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Sun, 7 Aug 2022 14:47:22 -0500 Subject: [PATCH 12/13] python3Packages.eventlet: disable failing test (cherry picked from commit ea345cd9bc31843585a9dd3b63dbf878bb66fc5c) https://hydra.nixos.org/build/186881917 --- pkgs/development/python-modules/eventlet/default.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/development/python-modules/eventlet/default.nix b/pkgs/development/python-modules/eventlet/default.nix index d24874ac5911..7540170c6043 100644 --- a/pkgs/development/python-modules/eventlet/default.nix +++ b/pkgs/development/python-modules/eventlet/default.nix @@ -53,6 +53,7 @@ buildPythonPackage rec { disabledTests = [ # Tests requires network access "test_017_ssl_zeroreturnerror" + "test_018b_http_10_keepalive_framing" "test_getaddrinfo" "test_hosts_no_network" "test_leakage_from_tracebacks" From 95625a75e12e2c629afd958d11bed80561feba9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fabi=C3=A1n=20Heredia=20Montiel?= Date: Sun, 7 Aug 2022 14:47:40 -0500 Subject: [PATCH 13/13] python3Packages.uvloop: disable hanging test (cherry picked from commit c49c7a94954dc7c361e88075a919cc2d2371264c) https://hydra.nixos.org/build/186919437 --- pkgs/development/python-modules/uvloop/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/python-modules/uvloop/default.nix b/pkgs/development/python-modules/uvloop/default.nix index b4b75dbb1941..dc88d4fee951 100644 --- a/pkgs/development/python-modules/uvloop/default.nix +++ b/pkgs/development/python-modules/uvloop/default.nix @@ -46,7 +46,6 @@ buildPythonPackage rec { "--assert=plain" "--strict" "--tb=native" - ] ++ lib.optionals (stdenv.isAarch64) [ # test gets stuck in epoll_pwait on hydras aarch64 builders # https://github.com/MagicStack/uvloop/issues/412 "--deselect" "tests/test_tcp.py::Test_AIO_TCPSSL::test_remote_shutdown_receives_trailing_data"