SDL_image: add patch to fix CVE-2017-2887

This commit is contained in:
Franz Pletz 2017-10-24 13:25:16 +02:00
parent b4d1c8898e
commit a203fd2a57
No known key found for this signature in database
GPG Key ID: 846FDED7792617B4

View File

@ -1,4 +1,4 @@
{ stdenv, fetchurl, SDL, libpng, libjpeg, libtiff, libungif, libXpm }: { stdenv, fetchurl, fetchpatch, SDL, libpng, libjpeg, libtiff, libungif, libXpm }:
stdenv.mkDerivation rec { stdenv.mkDerivation rec {
name = "SDL_image-${version}"; name = "SDL_image-${version}";
@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
sha256 = "16an9slbb8ci7d89wakkmyfvp7c0cval8xw4hkg0842nhhlp540b"; sha256 = "16an9slbb8ci7d89wakkmyfvp7c0cval8xw4hkg0842nhhlp540b";
}; };
patches = [
(fetchpatch {
name = "CVE-2017-2887";
url = "https://hg.libsdl.org/SDL_image/raw-diff/318484db0705/IMG_xcf.c";
sha256 = "140dyszz9hkpgwjdiwp1b7jdd8f8l5d862xdaf3ml4cimga1h5kv";
})
];
buildInputs = [ SDL libpng libjpeg libtiff libungif libXpm ]; buildInputs = [ SDL libpng libjpeg libtiff libungif libXpm ];
meta = with stdenv.lib; { meta = with stdenv.lib; {