gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

busybox: add in-tree comments for all patches

Browse Source 
Adds in-tree comments for all patches, to conform with style guide.

This is also useful while reviewing the package, e.g. to see if patches
are no longer relevant.
This commit is contained in:
Alexander Bantyev
2025-12-03 22:21:31 +01:00
parent f9c3688afd
commit bbe2304eae
1 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkgs/os-specific/linux/busybox/default.nix
+20 -5
View File
@@ -73,38 +73,53 @@ stdenv.mkDerivation rec {
++ lib.optionals enableStatic [ "fortify" ];
patches = [
# Allow BusyBox to be invoked as "<something>-busybox". This is
# necessary when it's run from the Nix store as <hash>-busybox during
# stdenv bootstrap.
./busybox-in-store.patch
# libbb: sockaddr2str: ensure only printable characters are returned for the hostname part
(fetchurl {
name = "CVE-2022-28391.patch";
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-libbb-sockaddr2str-ensure-only-printable-characters-.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
sha256 = "sha256-yviw1GV+t9tbHbY7YNxEqPi7xEreiXVqbeRyf8c6Awo=";
})
# nslookup: sanitize all printed strings with printable_string
(fetchurl {
name = "CVE-2022-28391.patch";
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0002-nslookup-sanitize-all-printed-strings-with-printable.patch?id=ed92963eb55bbc8d938097b9ccb3e221a94653f4";
sha256 = "sha256-vl1wPbsHtXY9naajjnTicQ7Uj3N+EQ8pRNnrdsiow+w=";
})
# shell: avoid segfault on ${0::0/0~09J}
# See also: https://bugs.busybox.net/show_bug.cgi?id=15216
(fetchpatch {
name = "CVE-2022-48174.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15216
name = "CVE-2022-48174.patch";
url = "https://git.busybox.net/busybox/patch/?id=d417193cf37ca1005830d7e16f5fa7e1d8a44209";
hash = "sha256-mpDEwYncpU6X6tmtj9xM2KCrB/v2ys5bYxmPPrhm6es=";
})
# Make sure we don't read past the end of the string in next_token()
# when backslash is the last character in an (invalid) regexp.
# See also: https://bugs.busybox.net/show_bug.cgi?id=15874
# This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
(fetchpatch {
name = "CVE-2023-42366.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15874
# This patch is also used by Alpine, see https://git.alpinelinux.org/aports/tree/main/busybox/0037-awk.c-fix-CVE-2023-42366-bug-15874.patch
name = "CVE-2023-42366.patch";
url = "https://bugs.busybox.net/attachment.cgi?id=9697";
hash = "sha256-2eYfLZLjStea9apKXogff6sCAdG9yHx0ZsgUBaGfQIA=";
})
# awk: fix use after free (CVE-2023-42363)
# See also: https://bugs.busybox.net/show_bug.cgi?id=15865
(fetchpatch {
name = "CVE-2023-42363.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15865
name = "CVE-2023-42363.patch";
url = "https://git.launchpad.net/ubuntu/+source/busybox/plain/debian/patches/CVE-2023-42363.patch?id=c9d8a323b337d58e302717d41796aa0242963d5a";
hash = "sha256-1W9Q8+yFkYQKzNTrvndie8QuaEbyAFL1ZASG2fPF+Z4=";
})
# awk: fix ternary operator and precedence of =
# See also: https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
(fetchpatch {
name = "CVE-2023-42364_CVE-2023-42365.patch"; # https://bugs.busybox.net/show_bug.cgi?id=15871 https://bugs.busybox.net/show_bug.cgi?id=15868
name = "CVE-2023-42364_CVE-2023-42365.patch";
url = "https://git.alpinelinux.org/aports/plain/main/busybox/CVE-2023-42364-CVE-2023-42365.patch?id=8a4bf5971168bf48201c05afda7bee0fbb188e13";
hash = "sha256-nQPgT9eA1asCo38Z9X7LR9My0+Vz5YBPba3ARV3fWcc=";
})
# tar: fix TOCTOU symlink race condition
(fetchurl {
url = "https://git.alpinelinux.org/aports/plain/main/busybox/0001-tar-fix-TOCTOU-symlink-race-condition.patch?id=9e42dea5fba84a8afad1f1910b7d3884128a567e";
hash = "sha256-GmXQhwB1/IPVjXXpGi5RjRvuGJgIMIb7lQKB63m306g=";