From 2492f4556590e0565bcbf3cebb38b1b99b89f1c3 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Tue, 28 Nov 2017 00:14:05 +0100
Subject: [PATCH 1/2] ffmpeg-3.4: apply fix CVE CVE-2017-16840

Details at [1].

[1] http://git.videolan.org/?p=ffmpeg.git;a=commit;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74
---
 pkgs/development/libraries/ffmpeg/3.4.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg/3.4.nix b/pkgs/development/libraries/ffmpeg/3.4.nix
index 513654e98f7..9890d030e44 100644
--- a/pkgs/development/libraries/ffmpeg/3.4.nix
+++ b/pkgs/development/libraries/ffmpeg/3.4.nix
@@ -1,4 +1,4 @@
-{ stdenv, callPackage
+{ stdenv, callPackage, fetchpatch
 # Darwin frameworks
 , Cocoa, CoreMedia
 , ...
@@ -9,4 +9,13 @@ callPackage ./generic.nix (args // rec {
   branch = "3.4";
   sha256 = "0pn8g3ab937ahslqd41crk0g4j4fh7kwimsrlfc0rl0pc3z132ax";
   darwinFrameworks = [ Cocoa CoreMedia ];
+
+  patches = [
+    (fetchpatch{
+      name = "CVE-2017-16840.patch";
+      url = "http://git.videolan.org/?p=ffmpeg.git;a=patch;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74";
+      sha256 = "1rjr9lc71cyy43wsa2zxb9ygya292h9jflvr5wk61nf0vp97gjg3";
+    })
+  ];
+
 })

From 64d8cc7fc4e1509bf63cd81838b633428c09de98 Mon Sep 17 00:00:00 2001
From: Andreas Rammhold <andreas@rammhold.de>
Date: Tue, 28 Nov 2017 00:24:02 +0100
Subject: [PATCH 2/2] ffmpeg-full-3.4: apply patch for CVE-2017-16840

---
 pkgs/development/libraries/ffmpeg-full/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/ffmpeg-full/default.nix b/pkgs/development/libraries/ffmpeg-full/default.nix
index b50025aa108..3fb131068da 100644
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@@ -238,7 +238,15 @@ stdenv.mkDerivation rec {
     sha256 = "1vzvpx8ixy8m44f8qwp833hv253hpghybgzbc4n8b3div3j0dvmf";
   };
 
-  patchPhase = ''patchShebangs .
+  patchPhase = let
+    cve_2017_16840_patch = (fetchurl{
+      name = "CVE-2017-16840.patch";
+      url = "http://git.videolan.org/?p=ffmpeg.git;a=patch;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74";
+      sha256 = "1rjr9lc71cyy43wsa2zxb9ygya292h9jflvr5wk61nf0vp97gjg3";
+    });
+  in
+  '' patch -p1 < ${cve_2017_16840_patch}
+     patchShebangs .
   '' + stdenv.lib.optionalString stdenv.isDarwin ''
     sed -i 's/#ifndef __MAC_10_11/#if 1/' ./libavcodec/audiotoolboxdec.c
   '' + stdenv.lib.optionalString (frei0r != null) ''