From e50edd162befd42b359bc3eae2dad1e63719c7ba Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 16 May 2025 01:49:19 +0200
Subject: [PATCH] connman: apply patches for CVE-2025-32366 and CVE-2025-32743

https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4
https://git.kernel.org/pub/scm/network/connman/connman.git/commit/?id=d90b911f6760959bdf1393c39fe8d1118315490f
---
 pkgs/by-name/co/connman/package.nix | 28 +++++++++++++++++++++-------
 1 file changed, 21 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/co/connman/package.nix b/pkgs/by-name/co/connman/package.nix
index e62def2dccab..1995a54fa143 100644
--- a/pkgs/by-name/co/connman/package.nix
+++ b/pkgs/by-name/co/connman/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   autoreconfHook,
   dbus,
   file,
@@ -78,13 +79,26 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ElfOvjJ+eQC34rhMD7MwqpCBXkVYmM0vlB9DCO0r47w=";
   };
 
-  patches = optionals stdenv.hostPlatform.isMusl [
-    # Fix Musl build by avoiding a Glibc-only API.
-    (fetchurl {
-      url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
-      hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
-    })
-  ];
+  patches =
+    [
+      (fetchpatch {
+        name = "CVE-2025-32366.patch";
+        url = "https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=8d3be0285f1d4667bfe85dba555c663eb3d704b4";
+        hash = "sha256-kPb4pZVWvnvTUcpc4wRc8x/pMUTXGIywj3w8IYKRTBs=";
+      })
+      (fetchpatch {
+        name = "CVE-2025-32743.patch";
+        url = "https://git.kernel.org/pub/scm/network/connman/connman.git/patch/?id=d90b911f6760959bdf1393c39fe8d1118315490f";
+        hash = "sha256-odkjYC/iM6dTIJx2WM/KKotXdTtgv8NMFNJMzx5+YU4=";
+      })
+    ]
+    ++ optionals stdenv.hostPlatform.isMusl [
+      # Fix Musl build by avoiding a Glibc-only API.
+      (fetchurl {
+        url = "https://git.alpinelinux.org/aports/plain/community/connman/libresolv.patch?id=e393ea84386878cbde3cccadd36a30396e357d1e";
+        hash = "sha256-7Q1bp8rD/gGVYUqnIXqjr9vypR8jlC926p3KYWl9kLw=";
+      })
+    ];
 
   nativeBuildInputs = [
     autoreconfHook