From 2dccca399c9a6d96c4d5344c1f0af29d8d8a2c9f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <vcunat@gmail.com>
Date: Tue, 1 Sep 2015 20:33:27 +0200
Subject: [PATCH] libunwind: security fix for CVE-2015-3239

Thanks to the monitor. Low security and high rebuild impact, but still...
---
 .../libraries/libunwind/cve-2015-3239.patch       | 15 +++++++++++++++
 pkgs/development/libraries/libunwind/default.nix  |  6 +++---
 pkgs/top-level/all-packages.nix                   |  2 +-
 3 files changed, 19 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/libraries/libunwind/cve-2015-3239.patch

diff --git a/pkgs/development/libraries/libunwind/cve-2015-3239.patch b/pkgs/development/libraries/libunwind/cve-2015-3239.patch
new file mode 100644
index 000000000000..247b2dab44f8
--- /dev/null
+++ b/pkgs/development/libraries/libunwind/cve-2015-3239.patch
@@ -0,0 +1,15 @@
+http://git.savannah.gnu.org/cgit/libunwind.git/commit/?id=396b6c7ab737e2bff244d640601c436a26260ca1
+
+diff --git a/include/dwarf_i.h b/include/dwarf_i.h
+index 0e72845..86dcdb8 100644
+--- a/include/dwarf_i.h
++++ b/include/dwarf_i.h
+@@ -20,7 +20,7 @@
+ extern const uint8_t dwarf_to_unw_regnum_map[DWARF_REGNUM_MAP_LENGTH];
+ /* REG is evaluated multiple times; it better be side-effects free!  */
+ # define dwarf_to_unw_regnum(reg)					  \
+-  (((reg) <= DWARF_REGNUM_MAP_LENGTH) ? dwarf_to_unw_regnum_map[reg] : 0)
++  (((reg) < DWARF_REGNUM_MAP_LENGTH) ? dwarf_to_unw_regnum_map[reg] : 0)
+ #endif
+ 
+ #ifdef UNW_LOCAL_ONLY
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 91895114ea0c..ecaa643b143f 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   name = "libunwind-1.1";
-  
+
   src = fetchurl {
     url = "mirror://savannah/libunwind/${name}.tar.gz";
     sha256 = "16nhx2pahh9d62mvszc88q226q5lwjankij276fxwrm8wb50zzlx";
   };
 
-  patches = [ ./libunwind-1.1-lzma.patch ];
+  patches = [ ./libunwind-1.1-lzma.patch ./cve-2015-3239.patch ];
 
   postPatch = ''
     sed -i -e '/LIBLZMA/s:-lzma:-llzma:' configure
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       sed -i 's,-llzma,${xz}/lib/liblzma.la,' $file
     done
   '';
-  
+
   meta = with stdenv.lib; {
     homepage = http://www.nongnu.org/libunwind;
     description = "A portable and efficient API to determine the call-chain of a program";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index da574c93fed4..fba483b6ed8c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7450,7 +7450,7 @@ let
   libusbmuxd = callPackage ../development/libraries/libusbmuxd { };
 
   libunwind = if stdenv.isDarwin
-    then callPackage ../development/libraries/libunwind/native.nix {}
+    then libunwindNative
     else callPackage ../development/libraries/libunwind { };
 
   libunwindNative = callPackage ../development/libraries/libunwind/native.nix {};