nixpkgs/pkgs/development/libraries/gstreamer/base/default.nix

47 lines
1.2 KiB
Nix
Raw Normal View History

2013-12-23 07:36:37 -08:00
{ stdenv, fetchurl, pkgconfig, python, gstreamer, gobjectIntrospection
, orc, alsaLib, libXv, pango, libtheora
2015-04-08 18:47:56 -07:00
, cdparanoia, libvisual, libintlOrEmpty
2013-12-23 07:36:37 -08:00
}:
stdenv.mkDerivation rec {
gstreamer-*: 1.10.2 -> 1.10.3 for multiple CVEs gst-plugins-bad: From the Arch Linux advisory: - CVE-2017-5843 (arbitrary code execution): A double-free issue has been found in gstreamer before 1.10.3, in gst_mxf_demux_update_essence_tracks. - CVE-2017-5848 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_ps_demux_parse_psm. More: https://lwn.net/Vulnerabilities/713772/ gst-plugins-base: From the Arch Linux advisory: - CVE-2017-5837 (denial of service): A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5839 (denial of service): An endless recursion issue leading to stack overflow has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5842 (arbitrary code execution): An off-by-one write has been found in gstreamer before 1.10.3, in html_context_handle_element. - CVE-2017-5844 (denial of service): A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. More: https://lwn.net/Vulnerabilities/713773/ gst-plugins-good: From the Arch Linux advisory: - CVE-2016-10198 (denial of service): An invalid memory read flaw has been found in gstreamer before 1.10.3, in gst_aac_parse_sink_setcaps. - CVE-2016-10199 (denial of service): An out of bounds read has been found in gstreamer before 1.10.3, in qtdemux_tag_add_str_full. - CVE-2017-5840 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in qtdemux_parse_samples. - CVE-2017-5841 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. - CVE-2017-5845 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. More: https://lwn.net/Vulnerabilities/713774/ gst-plugins-ugly: From the Arch Linux advisory: - CVE-2017-5846 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_stream_props. - CVE-2017-5847 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_content_desc. More: https://lwn.net/Vulnerabilities/713775/ gstreamer: From the Arch Linux advisory: An out of bounds read has been found in gstreamer before 1.10.3, in gst_date_time_new_from_iso8601_string. More: https://lwn.net/Vulnerabilities/713776/
2017-02-08 05:27:59 -08:00
name = "gst-plugins-base-1.10.3";
2013-12-23 07:36:37 -08:00
meta = {
description = "Base plugins and helper libraries";
homepage = "http://gstreamer.freedesktop.org";
license = stdenv.lib.licenses.lgpl2Plus;
2015-04-08 18:47:56 -07:00
platforms = stdenv.lib.platforms.unix;
2013-12-23 07:36:37 -08:00
};
src = fetchurl {
url = "${meta.homepage}/src/gst-plugins-base/${name}.tar.xz";
gstreamer-*: 1.10.2 -> 1.10.3 for multiple CVEs gst-plugins-bad: From the Arch Linux advisory: - CVE-2017-5843 (arbitrary code execution): A double-free issue has been found in gstreamer before 1.10.3, in gst_mxf_demux_update_essence_tracks. - CVE-2017-5848 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_ps_demux_parse_psm. More: https://lwn.net/Vulnerabilities/713772/ gst-plugins-base: From the Arch Linux advisory: - CVE-2017-5837 (denial of service): A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5839 (denial of service): An endless recursion issue leading to stack overflow has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. - CVE-2017-5842 (arbitrary code execution): An off-by-one write has been found in gstreamer before 1.10.3, in html_context_handle_element. - CVE-2017-5844 (denial of service): A floating point exception issue has been found in gstreamer before 1.10.3, in gst_riff_create_audio_caps. More: https://lwn.net/Vulnerabilities/713773/ gst-plugins-good: From the Arch Linux advisory: - CVE-2016-10198 (denial of service): An invalid memory read flaw has been found in gstreamer before 1.10.3, in gst_aac_parse_sink_setcaps. - CVE-2016-10199 (denial of service): An out of bounds read has been found in gstreamer before 1.10.3, in qtdemux_tag_add_str_full. - CVE-2017-5840 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in qtdemux_parse_samples. - CVE-2017-5841 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. - CVE-2017-5845 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_avi_demux_parse_ncdt. More: https://lwn.net/Vulnerabilities/713774/ gst-plugins-ugly: From the Arch Linux advisory: - CVE-2017-5846 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_stream_props. - CVE-2017-5847 (denial of service): An out-of-bounds read has been found in gstreamer before 1.10.3, in gst_asf_demux_process_ext_content_desc. More: https://lwn.net/Vulnerabilities/713775/ gstreamer: From the Arch Linux advisory: An out of bounds read has been found in gstreamer before 1.10.3, in gst_date_time_new_from_iso8601_string. More: https://lwn.net/Vulnerabilities/713776/
2017-02-08 05:27:59 -08:00
sha256 = "040pifl4cgsqqz2si4s1y5khj3zwm39w21siagxwp805swbrcag6";
2013-12-23 07:36:37 -08:00
};
outputs = [ "out" "dev" ];
2016-04-24 05:39:30 -07:00
2013-12-23 07:36:37 -08:00
nativeBuildInputs = [
pkgconfig python gobjectIntrospection
];
buildInputs = [
2015-04-08 18:47:56 -07:00
orc libXv pango libtheora cdparanoia
]
++ libintlOrEmpty
++ stdenv.lib.optional stdenv.isLinux alsaLib
++ stdenv.lib.optional (!stdenv.isDarwin) libvisual;
2013-12-23 07:36:37 -08:00
propagatedBuildInputs = [ gstreamer ];
2016-04-24 05:39:30 -07:00
configureFlags = if stdenv.isDarwin then [
2015-04-08 18:47:56 -07:00
# Does not currently build on Darwin
"--disable-libvisual"
# Undefined symbols _cdda_identify and _cdda_identify_scsi in cdparanoia
"--disable-cdparanoia"
] else null;
NIX_LDFLAGS = if stdenv.isDarwin then "-lintl" else null;
enableParallelBuilding = true;
2013-12-23 07:36:37 -08:00
}