From 92f5f12a72d44c26cde46c033e5ae50419084d62 Mon Sep 17 00:00:00 2001
From: Raphael Robatsch <raphael-git@tapesoftware.net>
Date: Mon, 1 Apr 2024 09:01:15 +0200
Subject: [PATCH 1/2] mbedtls_2: 2.28.7 -> 2.28.8

Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.8
Fixes CVE-2024-28960
---
 pkgs/development/libraries/mbedtls/2.nix       | 4 ++--
 pkgs/development/libraries/mbedtls/generic.nix | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mbedtls/2.nix b/pkgs/development/libraries/mbedtls/2.nix
index 97d62fad3ced..42fb6edae78f 100644
--- a/pkgs/development/libraries/mbedtls/2.nix
+++ b/pkgs/development/libraries/mbedtls/2.nix
@@ -1,6 +1,6 @@
 { callPackage }:
 
 callPackage ./generic.nix {
-  version = "2.28.7";
-  hash = "sha256-JI0Frbz4HkPqrLQNrSIj1ikN8201h4kd1wTwyPotERw=";
+  version = "2.28.8";
+  hash = "sha256-A1DYZrvJ8SRujroVwqPfcTOSgLnT5xRat/RVdq2fL/o=";
 }
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix
index 2e79a593b7c3..052a5720cb81 100644
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     repo = "mbedtls";
     rev = "${pname}-${version}";
     inherit hash;
+    # mbedtls >= 3.6.0 uses git submodules
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [ cmake ninja perl python3 ];

From bdfdf2c602dba71ca96b720a5383f68509fa253d Mon Sep 17 00:00:00 2001
From: Raphael Robatsch <raphael-git@tapesoftware.net>
Date: Mon, 1 Apr 2024 09:01:15 +0200
Subject: [PATCH 2/2] mbedtls: 3.5.2 -> 3.6.0

Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
Fixes CVE-2024-28960
---
 pkgs/development/libraries/mbedtls/3.nix       | 18 +++++++++++++++---
 pkgs/development/libraries/mbedtls/generic.nix |  3 +++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index 267349ac5d7b..d672e218f577 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,6 +1,18 @@
-{ callPackage }:
+{ callPackage
+, fetchpatch
+}:
 
 callPackage ./generic.nix {
-  version = "3.5.2";
-  hash = "sha256-lVGmnSYccNmRS6vfF/fDiny5cYRPc/wJBpgciFLPUvM=";
+  version = "3.6.0";
+  hash = "sha256-tCwAKoTvY8VCjcTPNwS3DeitflhpKHLr6ygHZDbR6wQ=";
+
+  patches = [
+    # https://github.com/Mbed-TLS/mbedtls/pull/9000
+    # Remove at next version update
+    (fetchpatch {
+      name = "fix-darwin-memcpy-error.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/b32d7ae0fee2f906be59780b42a0cd4468a39bd1.patch";
+      hash = "sha256-BTkJs9NEkCl+/Q8EwB/LW9uwF95jQOKWmoCK4B/7/sU=";
+    })
+  ];
 }
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/development/libraries/mbedtls/generic.nix
index 052a5720cb81..e87a133eb2a1 100644
--- a/pkgs/development/libraries/mbedtls/generic.nix
+++ b/pkgs/development/libraries/mbedtls/generic.nix
@@ -2,6 +2,7 @@
 , stdenv
 , version
 , hash
+, patches ? []
 , fetchFromGitHub
 
 , cmake
@@ -25,6 +26,8 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  inherit patches;
+
   nativeBuildInputs = [ cmake ninja perl python3 ];
 
   strictDeps = true;