From 2ddb0c7400df9e204ebae61a4f3411e17f53d8cf Mon Sep 17 00:00:00 2001
From: Red Davies <red@infect.me>
Date: Tue, 24 Nov 2020 23:07:13 -0500
Subject: [PATCH] corosync: 2.4.3 -> 2.4.5

Reason0: Changed name metadata to pname and version metadata.
Reason1: Fixes CVE-2018-1084

Corosync is prone to an integer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code
in the context of the affected application. Failed exploit
attempts will likely cause a denial-of-service condition.

Fixed in 2.4.4

See issue: #90784
---
 pkgs/servers/corosync/default.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/corosync/default.nix b/pkgs/servers/corosync/default.nix
index 5a209549d35..693ab0042f3 100644
--- a/pkgs/servers/corosync/default.nix
+++ b/pkgs/servers/corosync/default.nix
@@ -9,11 +9,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "corosync-2.4.3";
+  pname = "corosync";
+  version = "2.4.5";
 
   src = fetchurl {
-    url = "http://build.clusterlabs.org/corosync/releases/${name}.tar.gz";
-    sha256 = "15y5la04qn2lh1gabyifygzpa4dx3ndk5yhmaf7azxyjx0if9rxi";
+    url = "http://build.clusterlabs.org/corosync/releases/${pname}-${version}.tar.gz";
+    sha256 = "0pxs18vci9kq3qnqsg5i1h35jrxxiccwbm0mzja3g8j3izdsyvmb";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];