From b27ee09e7d0dc21a216ccdb0a866619046e3e993 Mon Sep 17 00:00:00 2001
From: Thorsten Weber <cpt.chaos83@googlemail.com>
Date: Wed, 27 May 2026 20:35:18 +0200
Subject: [PATCH] libredwg: 0.13.4 -> 0.13.4.8200

Update to latest pre-release to fix multiple security vulnerabilities:

- CVE-2026-9500: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9501: heap-buffer-overflow in decode.c (read_2004_compressed_section)
- CVE-2026-9502: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9503: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9504: null pointer dereference in dwggrep.c (main)
- CVE-2026-9529: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9530: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9605: heap-buffer-overflow in decode.c (decompress_R2004_section)

Individual backports were not feasible as the decompressor was significantly
refactored on upstream's main branch between 0.13.4 and the fixes.
---
 pkgs/by-name/li/libredwg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libredwg/package.nix b/pkgs/by-name/li/libredwg/package.nix
index 3f79fd9f2722..bccfc12f072d 100644
--- a/pkgs/by-name/li/libredwg/package.nix
+++ b/pkgs/by-name/li/libredwg/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libredwg";
-  version = "0.13.4";
+  version = "0.13.4.8200";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = "libredwg";
     tag = finalAttrs.version;
-    hash = "sha256-FeDQCByFGKfHJDOPQA92GslXZ33nhGfB6/63t2TeugE=";
+    hash = "sha256-HaQvJyuEeaTfuUJbmlV4qcfXiLdHJ2vO4EGInwAKJYk=";
     fetchSubmodules = true;
   };