libmad, mpg321: fix four CVE

pkgs/applications/audio/mpg321/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, libao, libmad, libid3tag, zlib, alsaLib
+{stdenv, fetchurl, fetchpatch, libao, libmad, libid3tag, zlib, alsaLib
 # Specify default libao output plugin to use (e.g. "alsa", "pulse" …).
 # If null, it will use the libao system default.
 , defaultAudio ? null
@@ -13,6 +13,14 @@ stdenv.mkDerivation rec {
     sha256 = "0ki8mh76bbmdh77qsiw682dvi8y468yhbdabqwg05igmwc1wqvq5";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2018-7263.patch";
+      url = "https://sources.debian.org/data/main/m/mpg321/0.3.2-3/debian/patches/handle_illegal_bitrate_value.patch";
+      sha256 = "15simp5fjvm9b024ryfh441rkh2d5bcrizqkzlrh07n9sm7fkw6x";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   configureFlags =

pkgs/development/libraries/libmad/default.nix

@@ -1,28 +1,58 @@
-{stdenv, fetchurl, autoconf}:
+{ stdenv, fetchurl, fetchpatch, autoconf }:
 
 stdenv.mkDerivation rec {
-  name = "libmad-0.15.1b";
-
+  pname = "libmad";
+  version = "0.15.1b";
+
   src = fetchurl {
-    url = "mirror://sourceforge/mad/${name}.tar.gz";
-    sha256 = "bbfac3ed6bfbc2823d3775ebb931087371e142bb0e9bb1bee51a76a6e0078690";
+    url = "mirror://sourceforge/mad/${pname}-${version}.tar.gz";
+    sha256 = "14460zhacxhswnzb36qfpd1f2wbk10qvksvm6wyq5hpvdgnw7ymv";
   };
 
-  patches = [ ./001-mips_removal_h_constraint.patch ./pkgconfig.patch ]
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/001-mips_removal_h_constraint.patch";
+      sha256 = "0layswr6qg6axf4vyz6xrv73jwga34mkma3ifk9w9vrk41454hr5";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/libmad.patch";
+      sha256 = "0rysq0sn3dfdz6pa6bfqkmk4ymc4rzk5ym7p16dyk37sldg1pbzs";
+    })
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/amd64-64bit.diff";
+      sha256 = "0mx56dmkbvw3zxnqd2hjng48q0d7q7473pns4n0ksdam29b0c5ar";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8372-CVE-2017-8373.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/102-CVE-2017-8373-CVE-2017-8372-md-size.patch";
+      sha256 = "0p6mkpn66h1ds8jvww28q4vlr58jwm58m9vb7pkvvyvy764agqnk";
+    })
+    (fetchpatch {
+      name = "CVE-2017-8374.patch";
+      url = "https://github.com/openwrt/packages/raw/openwrt-19.07/libs/libmad/patches/101-CVE-2017-8374-length-check.patch";
+      sha256 = "1j1ssxwmx9nfahzl62frbzck93xrjc2v3w30c12vmk29iflf1890";
+    })
+  ]
   # optimize.diff is taken from https://projects.archlinux.org/svntogit/packages.git/tree/trunk/optimize.diff?h=packages/libmad
   # It is included here in order to fix a build failure in Clang
   # But it may be useful to fix other, currently unknown problems as well
-  ++ stdenv.lib.optional stdenv.cc.isClang [ ./optimize.diff ];
-
-  nativeBuildInputs = [ autoconf ];
+  ++ stdenv.lib.optionals stdenv.cc.isClang [
+    (fetchpatch {
+      url = "https://github.com/KaOSx/main/raw/1270b8080f37fb6cca562829a521991800b0a497/libmad/optimize.diff";
+      sha256 = "0ciyaj1acg08g8hpzqx6whayq206fvf4whksz2pjgxlv207lqgjh";
+    })
+  ];
 
   # The -fforce-mem flag has been removed in GCC 4.3.
-  preConfigure = ''
-    autoconf
-    substituteInPlace configure --replace "-fforce-mem" ""
-    substituteInPlace configure --replace "arch=\"-march=i486\"" ""
+  postPatch = ''
+    substituteInPlace configure.ac --replace "-fforce-mem" ""
+    substituteInPlace configure.ac --replace "arch=\"-march=i486\"" ""
   '';
 
+  nativeBuildInputs = [ autoconf ];
+
+  preConfigure = "autoconf";
+
   meta = with stdenv.lib; {
     homepage    = https://sourceforge.net/projects/mad/;
     description = "A high-quality, fixed-point MPEG audio decoder supporting MPEG-1 and MPEG-2";