From e43e91a2a25a00141c9c35a6e498c55580304955 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 5 Nov 2022 18:35:20 +0100
Subject: [PATCH] upx: apply patch for CVE-2021-20285

Did not bump to 4.0.0 yet because the 4.0.0 release is affected by CVE-2021-30500 and CVE-2021-30501.
The patch for CVE-2021-30500 does not apply cleanly on top of 4.0.0.
---
 pkgs/tools/compression/upx/default.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/compression/upx/default.nix b/pkgs/tools/compression/upx/default.nix
index aff00402ed97..c556f31e6918 100644
--- a/pkgs/tools/compression/upx/default.nix
+++ b/pkgs/tools/compression/upx/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ucl, zlib, perl }:
+{ lib, stdenv, fetchurl, ucl, zlib, perl, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "upx";
@@ -10,6 +10,14 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ucl zlib perl ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/upx/upx/commit/13bc031163863cb3866aa6cdc018dff0697aa5d4.patch";
+      sha256 = "sha256-7uazgx1lOgHh2J7yn3yb1q9lTJsv4BbexdGlWRiAG/M=";
+      name = "CVE-2021-20285.patch";
+    })
+  ];
+
   preConfigure = ''
     export UPX_UCLDIR=${ucl}
   '';