NixOS · Aug 1, 2018 · Aug 1, 2018 · Aug 1, 2018 · Aug 1, 2018 · Aug 1, 2018
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
@@ -266,7 +266,7 @@ in
         # update command option in authorized_keys
         if [ -r ${cfg.stateDir}/.ssh/authorized_keys ]
         then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea.bin}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
+          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${pkgs.gitea.bin}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
         fi
       '' + optionalString (usePostgresql && cfg.database.createDatabase) ''
         if ! test -e "${cfg.stateDir}/db-created"; then

diff --git a/pkgs/games/openmw/default.nix b/pkgs/games/openmw/default.nix
@@ -18,7 +18,7 @@ in stdenv.mkDerivation rec {
     owner = "OpenMW";
     repo = "openmw";
     rev = name;
-    sha256 = "0lj8v81hk807dy0wcdhfp0iyn4l5yag53hx1a6xm44gh2dpyil43";
+    sha256 = "1nybxwp77qswjayf0g9xayp4x1xxq799681rhjlggch127r07ifi";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = stdenv.lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) file;
   buildInputs = [ zlib ];
 
+  patches = [ ./file-5.33-CVE-2018-10360.patch ];
+
   doCheck = true;
 
 

diff --git a/pkgs/tools/misc/file/file-5.33-CVE-2018-10360.patch b/pkgs/tools/misc/file/file-5.33-CVE-2018-10360.patch
@@ -0,0 +1,18 @@
+Avoid reading past the end of buffer
+
+CVE-2018-10360
+
+https://github.com/file/file/commit/a642587a9c9e2dd7feacdf513c3643ce26ad3c22
+
+--- a/src/readelf.c
++++ b/src/readelf.c
+@@ -842,7 +842,8 @@ do_core_note(struct magic_set *ms, unsigned char *nbuf, uint32_t type,
+
+ 				cname = (unsigned char *)
+ 				    &nbuf[doff + prpsoffsets(i)];
+-				for (cp = cname; *cp && isprint(*cp); cp++)
++				for (cp = cname; cp < nbuf + size && *cp
++				    && isprint(*cp); cp++)
+ 					continue;
+ 				/*
+ 				 * Linux apparently appends a space at the end
diff --git a/pkgs/tools/misc/lesspipe/default.nix b/pkgs/tools/misc/lesspipe/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, perl }:
+{ stdenv, fetchFromGitHub, substituteAll, perl, file, ncurses }:
 
 stdenv.mkDerivation rec {
   name = "lesspipe-${version}";
@@ -14,6 +14,14 @@ stdenv.mkDerivation rec {
     sha256 = "0vb7bpap8vy003ha10hc7hxl17y47sgdnrjpihgqxkn8k0bfqbbq";
   };
 
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      file = "${file}/bin/file";
+      tput = "${ncurses}/bin/tput";
+    })
+  ];
+
   meta = with stdenv.lib; {
     description = "A preprocessor for less";
     longDescription = ''

diff --git a/pkgs/tools/misc/lesspipe/fix-paths.patch b/pkgs/tools/misc/lesspipe/fix-paths.patch
@@ -0,0 +1,22 @@
+--- a/lesspipe.sh.in
++++ b/lesspipe.sh.in
+@@ -48,8 +48,8 @@ if [[ "$LESS_ADVANCED_PREPROCESSOR" = '' ]]; then
+ fi
+
+ filecmd() {
+-  file -L -s "$@"
+-  file -L -s -i "$@" 2> /dev/null | sed -n 's/.*charset=/;/p' | tr a-z A-Z
++  @file@ -L -s "$@"
++  @file@ -L -s -i "$@" 2> /dev/null | sed -n 's/.*charset=/;/p' | tr a-z A-Z
+ }
+
+ sep=:						# file name separator
+@@ -546,7 +546,7 @@ isfinal() {
+
+   # color requires -r or -R when calling less
+   typeset COLOR
+-  if [[ $(tput colors) -ge 8 && ("$LESS" = *-*r* || "$LESS" = *-*R*) ]]; then
++  if [[ $(@tput@ colors) -ge 8 && ("$LESS" = *-*r* || "$LESS" = *-*R*) ]]; then
+     COLOR="--color=always"
+   fi
+