From d81ba7d1f23ae8383875e7c77dde8dc671677cc9 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 26 Oct 2025 18:38:43 +0100
Subject: [PATCH] lz4: apply fix for CVE-2025-62813

Security issue is disputed by upstream but taking it up to MITRE
to change the status is not fast so we might as well apply the patch
to avoid false positive.

https://github.com/lz4/lz4/issues/1667
---
 pkgs/by-name/lz/lz4/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/lz/lz4/package.nix b/pkgs/by-name/lz/lz4/package.nix
index 23c13065ae40..bab192f7c424 100644
--- a/pkgs/by-name/lz/lz4/package.nix
+++ b/pkgs/by-name/lz/lz4/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   valgrind,
   testers,
@@ -18,6 +19,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/dG1n59SKBaEBg72pAWltAtVmJ2cXxlFFhP+klrkTos=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2025-62813.patch";
+      url = "https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82.patch";
+      hash = "sha256-qOvK0A3MGX14WdhThV7m4G6s+ZMP6eA/07A2BY5nesY=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];