libjpeg(-turbo): patch CVE-2018-19664

Fixes #52972.
This commit is contained in:
Vladimír Čunát 2019-01-02 09:50:54 +01:00
parent f48e430f1e
commit f603c1c52c
No known key found for this signature in database
GPG Key ID: E747DF1F9575A3AA

View File

@ -1,4 +1,4 @@
{ stdenv, fetchurl, cmake, nasm }:
{ stdenv, fetchurl, fetchpatch, cmake, nasm }:
stdenv.mkDerivation rec {
name = "libjpeg-turbo-${version}";
@ -11,7 +11,14 @@ stdenv.mkDerivation rec {
patches =
stdenv.lib.optional (stdenv.hostPlatform.libc or null == "msvcrt")
./mingw-boolean.patch;
./mingw-boolean.patch
++ [
(fetchpatch {
name = "cve-2018-19664.diff";
url = "https://github.com/libjpeg-turbo/libjpeg-turbo/commit/f8cca819a4fb.diff";
sha256 = "1kgfag62qmphlrq0mz15g17zw7zrg9nzaz7d2vg50m6m7m5aw4y5";
})
];
outputs = [ "bin" "dev" "out" "man" "doc" ];