From b06212255ad4d5aa90958cb57d086708e34ffc45 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 28 Jan 2026 14:25:00 -0800
Subject: [PATCH 1/2] quickjs-ng: fix CVE-2026-1144, CVE-2026-1145

These vulnerabilities affect quickjs-ng 0.11.0 and earlier:

- CVE-2026-1145: heap-based buffer overflow in js_typed_array_constructor_ta
  https://github.com/quickjs-ng/quickjs/issues/1305

- CVE-2026-1144: use-after-free in Atomics Ops Handler
  https://github.com/quickjs-ng/quickjs/issues/1301
  https://github.com/quickjs-ng/quickjs/issues/1302

Apply upstream patches as no new release is available yet.
---
 pkgs/by-name/qu/quickjs-ng/package.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkgs/by-name/qu/quickjs-ng/package.nix b/pkgs/by-name/qu/quickjs-ng/package.nix
index 889c7d2b052b..26e9f5fc2ce4 100644
--- a/pkgs/by-name/qu/quickjs-ng/package.nix
+++ b/pkgs/by-name/qu/quickjs-ng/package.nix
@@ -2,6 +2,7 @@
   lib,
   cmake,
   fetchFromGitHub,
+  fetchpatch,
   stdenv,
   testers,
   texinfo,
@@ -18,6 +19,24 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Mb0YyxTWU6a8HFTVBmlJ5yGEDmjKXHqTSszAvb8Y01U=";
   };
 
+  patches = [
+    # CVE-2026-1145: Fix heap buffer overflow in js_typed_array_constructor_ta
+    # https://github.com/quickjs-ng/quickjs/issues/1305
+    (fetchpatch {
+      name = "CVE-2026-1145.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/53aebe66170d545bb6265906fe4324e4477de8b4.patch";
+      hash = "sha256-PObMEqIush07mQ7YcoFUJ3rXitOlEU0tCsgVi6P2zW0=";
+    })
+    # CVE-2026-1144: Fix OOB access in atomic ops
+    # https://github.com/quickjs-ng/quickjs/issues/1301
+    # https://github.com/quickjs-ng/quickjs/issues/1302
+    (fetchpatch {
+      name = "CVE-2026-1144.patch";
+      url = "https://github.com/quickjs-ng/quickjs/commit/ea3e9d77454e8fc9cb3ef3c504e9c16af5a80141.patch";
+      hash = "sha256-ph6U+Mz7gxR4RWEtc+XU5fO6qjApQTqqW5dzwnOqTdc=";
+    })
+  ];
+
   outputs = [
     "out"
     "bin"

From 4da05a7076ff657457ada5c5e8fdee6a978e4b0e Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 28 Jan 2026 14:29:22 -0800
Subject: [PATCH 2/2] quickjs: mark vulnerable for CVE-2026-1144, CVE-2026-1145

These vulnerabilities affect quickjs 2025-09-13-2 and earlier:

- CVE-2026-1144: use-after-free in Atomics Ops Handler
- CVE-2026-1145: heap-based buffer overflow in js_typed_array_constructor_ta

Upstream fix is pending: https://github.com/bellard/quickjs/pull/483

Once the PR is merged and a new release is available, this package
should be updated and the knownVulnerabilities removed.
---
 pkgs/by-name/qu/quickjs/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/qu/quickjs/package.nix b/pkgs/by-name/qu/quickjs/package.nix
index 753362a301d6..e471f16b0d15 100644
--- a/pkgs/by-name/qu/quickjs/package.nix
+++ b/pkgs/by-name/qu/quickjs/package.nix
@@ -121,5 +121,10 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ ];
     mainProgram = "qjs";
     platforms = lib.platforms.all;
+    # Pending upstream fix: https://github.com/bellard/quickjs/pull/483
+    knownVulnerabilities = [
+      "CVE-2026-1144"
+      "CVE-2026-1145"
+    ];
   };
 })