From a22eb1a5f88039c04584f5cbd3ec10584a524ec0 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 25 Mar 2024 23:46:35 +0800
Subject: [PATCH 1/3] emacs: pass patches through mkArgs

---
 pkgs/applications/editors/emacs/sources.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/sources.nix b/pkgs/applications/editors/emacs/sources.nix
index 8cd257302cd6..c921a075d8fd 100644
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -4,8 +4,8 @@
 }:
 
 let
-  mkArgs = { pname, version, variant, rev, hash }: {
-    inherit pname version variant;
+  mkArgs = { pname, version, variant, patches ? _: [ ], rev, hash }: {
+    inherit pname version variant patches;
 
     src = {
       "mainline" = (fetchFromSavannah {

From 0ccce9b3e6c969f2db54e9b28c9ca2c68894af4d Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 25 Mar 2024 23:47:22 +0800
Subject: [PATCH 2/3] emacs28: patch CVE-2022-45939

https://www.cve.org/CVERecord?id=CVE-2022-45939
---
 pkgs/applications/editors/emacs/sources.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/applications/editors/emacs/sources.nix b/pkgs/applications/editors/emacs/sources.nix
index c921a075d8fd..7b0f893a4e43 100644
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -73,6 +73,13 @@ in
     variant = "mainline";
     rev = "28.2";
     hash = "sha256-4oSLcUDR0MOEt53QOiZSVU8kPJ67GwugmBxdX3F15Ag=";
+    patches = fetchpatch: [
+      # CVE-2022-45939
+      (fetchpatch {
+        url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51";
+        hash = "sha256-TiBQkexn/eb6+IqJNDqR/Rn7S7LVdHmL/21A5tGsyJs=";
+      })
+    ];
   });
 
   emacs29 = import ./make-emacs.nix (mkArgs {

From e8124a9c5db7f96c51ad8dd7587ed4e26ff44fd6 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 26 Mar 2024 00:44:53 +0800
Subject: [PATCH 3/3] emacs28: backport security fixes from Emacs 29.3

https://lists.gnu.org/archive/html/emacs-devel/2024-03/msg00611.html
---
 pkgs/applications/editors/emacs/sources.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/applications/editors/emacs/sources.nix b/pkgs/applications/editors/emacs/sources.nix
index 7b0f893a4e43..02b3aec7e9c8 100644
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -79,6 +79,20 @@ in
         url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=d48bb4874bc6cd3e69c7a15fc3c91cc141025c51";
         hash = "sha256-TiBQkexn/eb6+IqJNDqR/Rn7S7LVdHmL/21A5tGsyJs=";
       })
+
+      # https://lists.gnu.org/archive/html/emacs-devel/2024-03/msg00611.html
+      (fetchpatch {
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/10_all_org-macro-eval.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
+        hash = "sha256-OdGt4e9JGjWJPkfJhbYsmQQc6jart4BH5aIKPIbWKFs=";
+      })
+      (fetchpatch {
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/11_all_untrusted-content.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
+        hash = "sha256-wa2bsnCt5yFx0+RAFZGBPI+OoKkbrfkkMer/KBEc/wA=";
+      })
+      (fetchpatch {
+        url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/28.2/12_all_org-remote-unsafe.patch?id=af40e12cb742510e5d40a06ffc6dfca97e340dd6";
+        hash = "sha256-b6WU1o3PfDV/6BTPfPNUFny6oERJCNsDrvflxX3Yvek=";
+      })
     ];
   });