From 5277b187cc6bfa4c30ca4d7ea261002a88675ab9 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 01:55:47 +0100
Subject: [PATCH 1/2] less: Apply patch for CVE-2022-46663

https://www.openwall.com/lists/oss-security/2023/02/07/7
---
 pkgs/tools/misc/less/default.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index a7212ccf7648..ebb15a3fd98b 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses, lessSecure ? false }:
+{ lib, stdenv, fetchurl, fetchpatch, ncurses, lessSecure ? false }:
 
 stdenv.mkDerivation rec {
   pname = "less";
@@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "02f2d9d6hyf03va28ip620gjc6rf4aikmdyk47h7frqj18pbx6m6";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/advisories/GHSA-5xw7-xf7p-gm82
+      name = "CVE-2022-46663.patch";
+      url = "https://github.com/gwsw/less/commit/a78e1351113cef564d790a730d657a321624d79c.patch";
+      hash = "sha256-gWgCzoMt1WyVJVKYzkMq8HfaTlU1XUtC8fvNFUQT0sI=";
+    })
+  ];
+
   configureFlags = [ "--sysconfdir=/etc" ] # Look for ‘sysless’ in /etc.
     ++ lib.optionals lessSecure [ "--with-secure" ];
 

From 3b3e38b4d1a76fc80ca64f878d2ed31101b0fa46 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 8 Feb 2023 01:56:11 +0100
Subject: [PATCH 2/2] less: Build with pcre2 regex engine and reformat

Add a notice about their versioning/release policy.
---
 pkgs/tools/misc/less/default.nix | 24 +++++++++++++++++++-----
 1 file changed, 19 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/misc/less/default.nix b/pkgs/tools/misc/less/default.nix
index ebb15a3fd98b..19f4c455965f 100644
--- a/pkgs/tools/misc/less/default.nix
+++ b/pkgs/tools/misc/less/default.nix
@@ -1,12 +1,20 @@
-{ lib, stdenv, fetchurl, fetchpatch, ncurses, lessSecure ? false }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, ncurses
+, pcre2
+}:
 
 stdenv.mkDerivation rec {
   pname = "less";
   version = "608";
 
+  # Only tarballs on the website are valid releases,
+  # other versions, e.g. git tags are considered snapshots.
   src = fetchurl {
     url = "https://www.greenwoodsoftware.com/less/less-${version}.tar.gz";
-    sha256 = "02f2d9d6hyf03va28ip620gjc6rf4aikmdyk47h7frqj18pbx6m6";
+    hash = "sha256-ppq+LgoSZ3fgIdO3OqMiLhsmHxDmRiTUHsB5aFpqwgk=";
   };
 
   patches = [
@@ -18,10 +26,16 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = [ "--sysconfdir=/etc" ] # Look for ‘sysless’ in /etc.
-    ++ lib.optionals lessSecure [ "--with-secure" ];
+  configureFlags = [
+    # Look for ‘sysless’ in /etc.
+    "--sysconfdir=/etc"
+    "--with-regex=pcre2"
+  ];
 
-  buildInputs = [ ncurses ];
+  buildInputs = [
+    ncurses
+    pcre2
+  ];
 
   meta = with lib; {
     homepage = "https://www.greenwoodsoftware.com/less/";