libjpeg(-turbo): patch CVE-2020-13790

Fixes #90864 on 20.03 (roundup issue). (cherry picked from commit d5fd2ed)
NixOS · Jun 18, 2020 · 0ba0883 · 0ba0883
1 parent 4e48231
commit 0ba0883
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/pkgs/development/libraries/libjpeg-turbo/default.nix b/pkgs/development/libraries/libjpeg-turbo/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, cmake, nasm, enableStatic ? false }:
+{ stdenv, fetchurl, fetchpatch, cmake, nasm, enableStatic ? false }:
 
 stdenv.mkDerivation rec {
 
@@ -11,6 +11,13 @@ stdenv.mkDerivation rec {
   };
 
   patches =
+    [
+      (fetchpatch {
+        name = "cve-2020-13790.patch";
+        url = "https://github.com/libjpeg-turbo/libjpeg-turbo/commit/3de15e0c344d.diff";
+        sha256 = "0hm5i6qir5w3zxb0xvqdh4jyvbfg7xnd28arhyfsaclfz9wdb0pb";
+      })
+    ] ++
     stdenv.lib.optional (stdenv.hostPlatform.libc or null == "msvcrt")
       ./mingw-boolean.patch;