Merge pull request #13513 from grahamc/omnibus-cves

Several CVEs

pkgs/development/libraries/jasper/default.nix

@@ -9,6 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    ./jasper-CVE-2016-1867.diff
     ./jasper-CVE-2014-8137-variant2.diff
     ./jasper-CVE-2014-8137-noabort.diff
     ./jasper-CVE-2014-8138.diff
@@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libjpeg ];
 
   configureFlags = "--enable-shared";
-  
+
   meta = {
     homepage = https://www.ece.uvic.ca/~frodo/jasper/;
     description = "JPEG2000 Library";

pkgs/development/libraries/jasper/jasper-CVE-2016-1867.diff

@@ -0,0 +1,11 @@
+--- jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c	2007-01-19 22:43:07.000000000 +0100
++++ jasper-1.900.1/src/libjasper/jpc/jpc_t2cod.c	2016-01-14 14:22:24.569056412 +0100
+@@ -429,7 +429,7 @@
+ 	}
+
+ 	for (pi->compno = pchg->compnostart, pi->picomp =
+-	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend); ++pi->compno,
++	  &pi->picomps[pi->compno]; pi->compno < JAS_CAST(int, pchg->compnoend) && pi->compno < pi->numcomps; ++pi->compno,
+ 	  ++pi->picomp) {
+ 		pirlvl = pi->picomp->pirlvls;
+ 		pi->xstep = pi->picomp->hsamp * (1 << (pirlvl->prcwidthexpn +

pkgs/development/libraries/libbsd/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl }:
 
-let name = "libbsd-0.7.0";
+let name = "libbsd-0.8.2";
 in stdenv.mkDerivation {
   inherit name;
 
   src = fetchurl {
     url = "http://libbsd.freedesktop.org/releases/${name}.tar.xz";
-    sha256 = "1fqhbi0vd6xjxazf633x388cc8qyn58l78704s0h6k63wlbhwfqg";
+    sha256 = "02i5brb2007sxq3mn862mr7yxxm0g6nj172417hjyvjax7549xmj";
   };
 
   patchPhase = ''
@@ -15,7 +15,7 @@ in stdenv.mkDerivation {
       --replace "{exec_prefix}" "{prefix}"
   '';
 
-  meta = { 
+  meta = {
     description = "Common functions found on BSD systems";
     homepage = http://libbsd.freedesktop.org/;
     license = stdenv.lib.licenses.bsd3;

pkgs/development/libraries/mbedtls/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, perl }:
 
 stdenv.mkDerivation rec {
-  name = "mbedtls-1.3.14";
+  name = "mbedtls-1.3.16";
 
   src = fetchurl {
     url = "https://polarssl.org/download/${name}-gpl.tgz";
-    sha256 = "1y3gr3kfai3d13j08r4pv42sh47nbfm4nqi9jq8c9d06qidr2xmy";
+    sha256 = "f413146c177c52d4ad8f48015e2fb21dd3a029ca30a2ea000cbc4f9bd092c933";
   };
 
   nativeBuildInputs = [ perl ];