From e5ebcb2bd4ea2f0c62a85cf3e893f3e0deee3fc4 Mon Sep 17 00:00:00 2001 From: trace Date: Sat, 5 Sep 2026 14:22:39 +0000 Subject: [PATCH 1/2] trace-pr anchor From 556957840de3c7a24edbd0a70590a42654351c6f Mon Sep 17 00:00:00 2001 From: trace Date: Sat, 5 Sep 2026 14:22:40 +0000 Subject: [PATCH 2/2] libsixel: 1.10.3 (fix CVE-2021-45340) --- pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch | 12 ++++++++++++ pkgs/by-name/li/libsixel/package.nix | 2 ++ 2 files changed, 14 insertions(+) create mode 100644 pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch diff --git a/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch b/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch new file mode 100644 index 0000000000000..84759e7d866a9 --- /dev/null +++ b/pkgs/by-name/li/libsixel/fix-CVE-2021-45340.patch @@ -0,0 +1,12 @@ +diff --git a/src/stb_image.h b/src/stb_image.h +index f12c30b..526281c 100644 +--- a/src/stb_image.h ++++ b/src/stb_image.h +@@ -1534,6 +1534,7 @@ static unsigned char *stbi__convert_format(unsigned char *data, int img_n, int r + int i,j; + unsigned char *good; + ++ if (data == NULL) return data; + if (req_comp == img_n) return data; + STBI_ASSERT(req_comp >= 1 && req_comp <= 4); + diff --git a/pkgs/by-name/li/libsixel/package.nix b/pkgs/by-name/li/libsixel/package.nix index 3add0a77716da..e8921c5d109a8 100644 --- a/pkgs/by-name/li/libsixel/package.nix +++ b/pkgs/by-name/li/libsixel/package.nix @@ -19,6 +19,8 @@ stdenv.mkDerivation rec { sha256 = "1nny4295ipy4ajcxmmh04c796hcds0y7z7rv3qd17mj70y8j0r2d"; }; + patches = [ ./fix-CVE-2021-45340.patch ]; + buildInputs = [ gdk-pixbuf gd