From 5911c1f45ac3c877c05192b951de5bfdf048b611 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 4 Apr 2013 13:42:26 +0200
Subject: [PATCH 01/11] perl: Update to 5.16.3, 5.14.4

CVE-2013-1667

Cherry-picked from stdenv-updates.
---
 pkgs/development/interpreters/perl/5.14/default.nix | 4 ++--
 pkgs/development/interpreters/perl/5.16/default.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/interpreters/perl/5.14/default.nix b/pkgs/development/interpreters/perl/5.14/default.nix
index ac19900bcfc3..08690e9507fa 100644
--- a/pkgs/development/interpreters/perl/5.14/default.nix
+++ b/pkgs/development/interpreters/perl/5.14/default.nix
@@ -7,11 +7,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "perl-5.14.2";
+  name = "perl-5.14.4";
 
   src = fetchurl {
     url = "mirror://cpan/src/${name}.tar.gz";
-    sha256 = "1ls8cpbgnlaxfydyyqgr7pxj1hkxh9pzcdgr3dv42zdxffakb234";
+    sha256 = "1js47zzna3v38fjnirf2vq6y0rjp8m86ysj5vagzgkig956d8gw0";
   };
 
   patches = 
diff --git a/pkgs/development/interpreters/perl/5.16/default.nix b/pkgs/development/interpreters/perl/5.16/default.nix
index 288de63b4ae8..2113faee1640 100644
--- a/pkgs/development/interpreters/perl/5.16/default.nix
+++ b/pkgs/development/interpreters/perl/5.16/default.nix
@@ -7,11 +7,11 @@ let
 in
 
 stdenv.mkDerivation rec {
-  name = "perl-5.16.2";
+  name = "perl-5.16.3";
 
   src = fetchurl {
     url = "mirror://cpan/src/${name}.tar.gz";
-    sha256 = "03nh8bqnjsdd5izjv3n2yfcxw4ck0llwww36jpbjbjgixwpqpy4f";
+    sha256 = "1dpd9lhc4723wmsn4dsn4m320qlqgyw28bvcbhnfqp2nl3f0ikv9";
   };
 
   patches =

From cc17e7037476e45fc5f86b0897b39b54553f2699 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 9 May 2013 13:50:51 +0200
Subject: [PATCH 02/11] glibc: Remove 2.13

It's not used and has security bugs.
---
 .../libraries/glibc/2.13/builder.sh           |  54 ----
 .../glibc/2.13/catalan-firstdays.patch        |  13 -
 .../libraries/glibc/2.13/common.nix           | 244 ------------------
 .../libraries/glibc/2.13/default.nix          |  99 -------
 .../2.13/dont_use_system_ld_so_cache.patch    |  43 ---
 .../glibc/2.13/glibc-elf-localscope.patch     |  82 ------
 .../development/libraries/glibc/2.13/info.nix |  26 --
 .../libraries/glibc/2.13/locales-builder.sh   |  17 --
 .../libraries/glibc/2.13/locales.nix          |  47 ----
 .../glibc/2.13/nix-locale-archive.patch       | 116 ---------
 .../glibc/2.13/nss-skip-unavail.patch         |  21 --
 .../libraries/glibc/2.13/rpcgen-path.patch    |  72 ------
 pkgs/top-level/all-packages.nix               |   8 -
 13 files changed, 842 deletions(-)
 delete mode 100644 pkgs/development/libraries/glibc/2.13/builder.sh
 delete mode 100644 pkgs/development/libraries/glibc/2.13/catalan-firstdays.patch
 delete mode 100644 pkgs/development/libraries/glibc/2.13/common.nix
 delete mode 100644 pkgs/development/libraries/glibc/2.13/default.nix
 delete mode 100644 pkgs/development/libraries/glibc/2.13/dont_use_system_ld_so_cache.patch
 delete mode 100644 pkgs/development/libraries/glibc/2.13/glibc-elf-localscope.patch
 delete mode 100644 pkgs/development/libraries/glibc/2.13/info.nix
 delete mode 100644 pkgs/development/libraries/glibc/2.13/locales-builder.sh
 delete mode 100644 pkgs/development/libraries/glibc/2.13/locales.nix
 delete mode 100644 pkgs/development/libraries/glibc/2.13/nix-locale-archive.patch
 delete mode 100644 pkgs/development/libraries/glibc/2.13/nss-skip-unavail.patch
 delete mode 100644 pkgs/development/libraries/glibc/2.13/rpcgen-path.patch

diff --git a/pkgs/development/libraries/glibc/2.13/builder.sh b/pkgs/development/libraries/glibc/2.13/builder.sh
deleted file mode 100644
index e68e13f9beca..000000000000
--- a/pkgs/development/libraries/glibc/2.13/builder.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-# Glibc cannot have itself in its RPATH.
-export NIX_NO_SELF_RPATH=1
-
-source $stdenv/setup
-
-postConfigure() {
-    # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
-    # This has to be done *after* `configure' because it builds some
-    # test binaries.
-    export NIX_CFLAGS_LINK=
-    export NIX_LDFLAGS_BEFORE=
-
-    export NIX_DONT_SET_RPATH=1
-    unset CFLAGS
-}
-
-
-postInstall() {
-    if test -n "$installLocales"; then
-        make -j${NIX_BUILD_CORES:-1} -l${NIX_BUILD_CORES:-1} localedata/install-locales
-    fi
-    
-    test -f $out/etc/ld.so.cache && rm $out/etc/ld.so.cache
-
-    # FIXME: Use `test -n $linuxHeaders' when `kernelHeaders' has been
-    # renamed.
-    if test -z "$hurdHeaders"; then
-        # Include the Linux kernel headers in Glibc, except the `scsi'
-        # subdirectory, which Glibc provides itself.
-	(cd $out/include && \
-	 ln -sv $(ls -d $kernelHeaders/include/* | grep -v 'scsi$') .)
-    fi
-
-    if test -f "$out/lib/libhurduser.so"; then
-	# libc.so, libhurduser.so, and libmachuser.so depend on each
-	# other, so add them to libc.so (a RUNPATH on libc.so.0.3
-	# would be ignored by the cross-linker.)
-	echo "adding \`libhurduser.so' and \`libmachuser.so' to the \`libc.so' linker script..."
-	sed -i "$out/lib/libc.so" \
-	    -e"s|\(libc\.so\.[^ ]\+\>\)|\1 $out/lib/libhurduser.so $out/lib/libmachuser.so|g"
-    fi
-	
-    # Fix for NIXOS-54 (ldd not working on x86_64).  Make a symlink
-    # "lib64" to "lib".
-    if test -n "$is64bit"; then
-        ln -s lib $out/lib64
-    fi
-
-    # This file, that should not remain in the glibc derivation,
-    # may have not been created during the preInstall
-    rm -f $out/lib/libgcc_s.so.1
-}
-
-genericBuild
diff --git a/pkgs/development/libraries/glibc/2.13/catalan-firstdays.patch b/pkgs/development/libraries/glibc/2.13/catalan-firstdays.patch
deleted file mode 100644
index 674e0aee8849..000000000000
--- a/pkgs/development/libraries/glibc/2.13/catalan-firstdays.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-https://bugzilla.redhat.com/show_bug.cgi?id=454629
-
---- glibc-20090510T1842/localedata/locales/ca_ES.orig	2009-06-26 14:05:18.422043552 +0200
-+++ glibc-20090510T1842/localedata/locales/ca_ES	2009-06-26 14:05:38.292042700 +0200
-@@ -138,6 +138,8 @@
- date_fmt	"<U0025><U0061><U0020><U0025><U0062><U0020><U0025><U0065>/
- <U0020><U0025><U0048><U003A><U0025><U004D><U003A><U0025><U0053><U0020>/
- <U0025><U005A><U0020><U0025><U0059>"
-+first_weekday   2
-+first_workday   2
- END LC_TIME
- 
- LC_PAPER
diff --git a/pkgs/development/libraries/glibc/2.13/common.nix b/pkgs/development/libraries/glibc/2.13/common.nix
deleted file mode 100644
index 8be076f335c0..000000000000
--- a/pkgs/development/libraries/glibc/2.13/common.nix
+++ /dev/null
@@ -1,244 +0,0 @@
-/* Build configuration used to build glibc, Info files, and locale
-   information.  */
-
-cross :
-
-{ name, fetchurl, stdenv, installLocales ? false
-, gccCross ? null, kernelHeaders ? null
-, machHeaders ? null, hurdHeaders ? null, libpthreadHeaders ? null
-, mig ? null, fetchgit ? null
-, profilingLibraries ? false, meta
-, preConfigure ? "", ... }@args :
-
-let
-  # For GNU/Hurd, see below.
-  version = if hurdHeaders != null then "20120223" else "2.13";
-
-  needsPortsNative = stdenv.isMips || stdenv.isArm;
-  needsPortsCross = cross.arch == "mips" || cross.arch == "arm";
-  needsPorts =
-    if (stdenv ? cross) && stdenv.cross != null && hurdHeaders == null then true
-    else if cross == null then needsPortsNative
-    else needsPortsCross;
-
-  srcPorts = fetchurl {
-    url = "mirror://gnu/glibc/glibc-ports-2.13.tar.bz2";
-    sha256 = "0npffql62m1xba15l1wkaqf2p0l2bvb33720gx28764jmq0la75i";
-  };
-
-in
-
-assert (cross != null) -> (gccCross != null);
-
-assert (mig != null) -> (machHeaders != null);
-assert (machHeaders != null) -> (hurdHeaders != null);
-assert (hurdHeaders != null) -> (libpthreadHeaders != null);
-assert (hurdHeaders != null) -> (fetchgit != null);
-
-stdenv.mkDerivation ({
-  inherit kernelHeaders installLocales;
-
-  # The host/target system.
-  crossConfig = if cross != null then cross.config else null;
-
-  inherit (stdenv) is64bit;
-
-  enableParallelBuilding = true;
-
-  patches =
-    stdenv.lib.optional (fetchgit == null)
-    /* Fix for NIXPKGS-79: when doing host name lookups, when
-       nsswitch.conf contains a line like
-
-         hosts: files mdns4_minimal [NOTFOUND=return] dns mdns4
-
-       don't return an error when mdns4_minimal can't be found.  This
-       is a bug in Glibc: when a service can't be found, NSS should
-       continue to the next service unless "UNAVAIL=return" is set.
-       ("NOTFOUND=return" refers to the service returning a NOTFOUND
-       error, not the service itself not being found.)  The reason is
-       that the "status" variable (while initialised to UNAVAIL) is
-       outside of the loop that iterates over the services, the
-       "files" service sets status to NOTFOUND.  So when the call to
-       find "mdns4_minimal" fails, "status" will still be NOTFOUND,
-       and it will return instead of continuing to "dns".  Thus, the
-       line
-
-         hosts: mdns4_minimal [NOTFOUND=return] dns mdns4
-
-       does work because "status" will contain UNAVAIL after the
-       failure to find mdns4_minimal. */
-    ./nss-skip-unavail.patch
-  ++ [
-    /* Have rpcgen(1) look for cpp(1) in $PATH.  */
-    ./rpcgen-path.patch
-
-    /* Allow nixos and nix handle the locale-archive. */
-    ./nix-locale-archive.patch
-  ]
-
-  ++ (stdenv.lib.optional (hurdHeaders == null)
-
-      /* Don't use /etc/ld.so.cache, for non-NixOS systems.  Currently
-         disabled on GNU/Hurd, which uses a more recent libc snapshot. */
-         ./dont_use_system_ld_so_cache.patch )
-
-  ++ [
-    /* Without this patch many KDE binaries crash. */
-    ./glibc-elf-localscope.patch
-  ] ++ stdenv.lib.optional installLocales ./catalan-firstdays.patch;
-
-  postPatch = ''
-    # Needed for glibc to build with the gnumake 3.82
-    # http://comments.gmane.org/gmane.linux.lfs.support/31227
-    sed -i 's/ot \$/ot:\n\ttouch $@\n$/' manual/Makefile
-
-    # nscd needs libgcc, and we don't want it dynamically linked
-    # because we don't want it to depend on bootstrap-tools libs.
-    echo "LDFLAGS-nscd += -static-libgcc" >> nscd/Makefile
-  '';
-
-  configureFlags = [
-    "-C"
-    "--enable-add-ons"
-    "--sysconfdir=/etc"
-    "--localedir=/var/run/current-system/sw/lib/locale"
-    "libc_cv_ssp=no"
-    (if kernelHeaders != null
-     then "--with-headers=${kernelHeaders}/include"
-     else "--without-headers")
-    (if profilingLibraries
-     then "--enable-profile"
-     else "--disable-profile")
-  ] ++ stdenv.lib.optionals (cross == null && kernelHeaders != null) [
-    "--enable-kernel=2.6.35"
-  ] ++ stdenv.lib.optionals (cross != null) [
-    (if cross.withTLS then "--with-tls" else "--without-tls")
-    (if cross.float == "soft" then "--without-fp" else "--with-fp")
-  ] ++ stdenv.lib.optionals (cross != null
-        && cross.platform ? kernelMajor
-        && cross.platform.kernelMajor == "2.6") [
-    "--enable-kernel=2.6.0"
-    "--with-__thread"
-  ] ++ stdenv.lib.optionals (cross == null &&
-       (stdenv.system == "armv5tel-linux")) [
-    "--host=arm-linux-gnueabi"
-    "--build=arm-linux-gnueabi"
-    "--without-fp"
-
-    # To avoid linking with -lgcc_s (dynamic link)
-    # so the glibc does not depend on its compiler store path
-    "libc_cv_as_needed=no"
-  ] ++ stdenv.lib.optionals (cross == null && stdenv.platform.name == "raspberrypi") [
-    "--host=arm-linux-gnueabi"
-    "--build=arm-linux-gnueabi"
-    "--with-fp"
-
-    # To avoid linking with -lgcc_s (dynamic link)
-    # so the glibc does not depend on its compiler store path
-    "libc_cv_as_needed=no"
-  ];
-
-  installFlags = [ "sysconfdir=$(out)/etc" ];
-  
-  buildInputs = stdenv.lib.optionals (cross != null) [ gccCross ]
-    ++ stdenv.lib.optional (mig != null) mig;
-
-  # Needed to install share/zoneinfo/zone.tab.  Set to impure /bin/sh to
-  # prevent a retained dependency on the bootstrap tools in the stdenv-linux
-  # bootstrap.
-  BASH_SHELL = "/bin/sh";
-
-  # Workaround for this bug:
-  #   http://sourceware.org/bugzilla/show_bug.cgi?id=411
-  # I.e. when gcc is compiled with --with-arch=i686, then the
-  # preprocessor symbol `__i686' will be defined to `1'.  This causes
-  # the symbol __i686.get_pc_thunk.dx to be mangled.
-  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString (stdenv.system == "i686-linux") "-U__i686";
-}
-
-# Remove the `gccCross' attribute so that the *native* glibc store path
-# doesn't depend on whether `gccCross' is null or not.
-// (removeAttrs args [ "gccCross" ]) //
-
-{
-  name = name + "-${version}" +
-    stdenv.lib.optionalString (cross != null) "-${cross.config}";
-
-  src =
-    if hurdHeaders != null
-    then fetchgit {
-      # Shamefully the "official" glibc won't build on GNU, so use the one
-      # maintained by the Hurd folks, `tschwinge/Roger_Whittaker' branch.
-      # See <http://www.gnu.org/software/hurd/source_repositories/glibc.html>.
-      url = "git://git.sv.gnu.org/hurd/glibc.git";
-      sha256 = "cecec9dd5a2bafc875c56b058b6d7628a22b250b53747513dec304f31ffdb82d";
-      rev = "d3cdecf18e6550b0984a42b43ed48c5fb26501e1";
-    }
-    else fetchurl {
-      url = "mirror://gnu/glibc/glibc-${version}.tar.bz2";
-      sha256 = "1cnv319ysc8nkwpqw6f6ymb6b8hbl0nyvyx48sddkrj50lmcjwq1";
-    };
-
-  # `fetchurl' is a function and thus should not be passed to the
-  # `derivation' primitive.
-  fetchurl = null;
-
-  # Remove absolute paths from `configure' & co.; build out-of-tree.
-  preConfigure = ''
-    export PWD_P=$(type -tP pwd)
-    for i in configure io/ftwtest-sh; do
-        # Can't use substituteInPlace here because replace hasn't been
-        # built yet in the bootstrap.
-        sed -i "$i" -e "s^/bin/pwd^$PWD_P^g"
-    done
-
-    ${if needsPorts then "tar xvf ${srcPorts}" else ""}
-
-    mkdir ../build
-    cd ../build
-
-    configureScript="`pwd`/../$sourceRoot/configure"
-
-    ${preConfigure}
-  '';
-
-  meta = {
-    homepage = http://www.gnu.org/software/libc/;
-    description = "The GNU C Library"
-      + stdenv.lib.optionalString (hurdHeaders != null) ", for GNU/Hurd";
-
-    longDescription =
-      '' Any Unix-like operating system needs a C library: the library which
-         defines the "system calls" and other basic facilities such as
-         open, malloc, printf, exit...
-
-         The GNU C library is used as the C library in the GNU system and
-         most systems with the Linux kernel.
-      '';
-
-    license = "LGPLv2+";
-
-    maintainers = [ stdenv.lib.maintainers.ludo ];
-    #platforms = stdenv.lib.platforms.linux;
-  } // meta;
-}
-
-//
-
-(if hurdHeaders != null
- then {
-   # Work around the fact that the configure snippet that looks for
-   # <hurd/version.h> does not honor `--with-headers=$sysheaders' and that
-   # glibc expects Mach, Hurd, and pthread headers to be in the same place.
-   CPATH = "${hurdHeaders}/include:${machHeaders}/include:${libpthreadHeaders}/include";
-
-   # `fetchgit' is a function and thus should not be passed to the
-   # `derivation' primitive.
-   fetchgit = null;
-
-   # Install NSS stuff in the right place.
-   # XXX: This will be needed for all new glibcs and isn't Hurd-specific.
-   makeFlags = ''vardbdir="$out/var/db"'';
- }
- else { }))
diff --git a/pkgs/development/libraries/glibc/2.13/default.nix b/pkgs/development/libraries/glibc/2.13/default.nix
deleted file mode 100644
index f80ed9372e63..000000000000
--- a/pkgs/development/libraries/glibc/2.13/default.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{ stdenv, fetchurl, kernelHeaders
-, machHeaders ? null, hurdHeaders ? null, libpthreadHeaders ? null
-, mig ? null, fetchgit ? null
-, installLocales ? true
-, profilingLibraries ? false
-, gccCross ? null
-, debugSymbols ? false
-}:
-
-assert stdenv.gcc.gcc != null;
-
-let
-  build = import ./common.nix;
-  cross = if gccCross != null then gccCross.target else null;
-in
-  build cross ({
-    name = "glibc"
-      + stdenv.lib.optionalString (hurdHeaders != null) "-hurd"
-      + stdenv.lib.optionalString debugSymbols "-debug";
-
-    inherit fetchurl stdenv kernelHeaders installLocales profilingLibraries
-      gccCross;
-
-    builder = ./builder.sh;
-
-    # When building glibc from bootstrap-tools, we need libgcc_s at RPATH for
-    # any program we run, because the gcc will have been placed at a new
-    # store path than that determined when built (as a source for the
-    # bootstrap-tools tarball)
-    # Building from a proper gcc staying in the path where it was installed,
-    # libgcc_s will not be at {gcc}/lib, and gcc's libgcc will be found without
-    # any special hack.
-    preInstall = ''
-      if [ -f ${stdenv.gcc.gcc}/lib/libgcc_s.so.1 ]; then
-          mkdir -p $out/lib
-          ln -s ${stdenv.gcc.gcc}/lib/libgcc_s.so.1 $out/lib/libgcc_s.so.1
-      fi
-    '';
-
-    meta.description = "The GNU C Library";
-  }
-
-  //
-
-  (if debugSymbols
-   then {
-     # Build with debugging symbols, but leave optimizations on and don't
-     # attempt to keep the build tree.
-     dontStrip = true;
-     dontCrossStrip = true;
-     NIX_STRIP_DEBUG = 0;
-   }
-   else {})
-
-  //
-
-  (if hurdHeaders != null
-   then rec {
-     inherit machHeaders hurdHeaders libpthreadHeaders mig fetchgit;
-
-     propagatedBuildInputs = [ machHeaders hurdHeaders libpthreadHeaders ];
-
-     passthru = {
-       # When building GCC itself `propagatedBuildInputs' above is not
-       # honored, so we pass it here so that the GCC builder can do the right
-       # thing.
-       inherit propagatedBuildInputs;
-     };
-   }
-   else { })
-
-  //
-
-  (if cross != null
-   then {
-      preConfigure = ''
-        sed -i s/-lgcc_eh//g "../$sourceRoot/Makeconfig"
-
-        cat > config.cache << "EOF"
-        libc_cv_forced_unwind=yes
-        libc_cv_c_cleanup=yes
-        libc_cv_gnu89_inline=yes
-        # Only due to a problem in gcc configure scripts:
-        libc_cv_sparc64_tls=${if cross.withTLS then "yes" else "no"}
-        EOF
-        export BUILD_CC=gcc
-        export CC="$crossConfig-gcc"
-        export AR="$crossConfig-ar"
-        export RANLIB="$crossConfig-ranlib"
-
-        dontStrip=1
-      '';
-
-      # To avoid a dependency on the build system 'bash'.
-      preFixup = ''
-        rm $out/bin/{ldd,tzselect,catchsegv,xtrace}
-      '';
-    }
-   else {}))
diff --git a/pkgs/development/libraries/glibc/2.13/dont_use_system_ld_so_cache.patch b/pkgs/development/libraries/glibc/2.13/dont_use_system_ld_so_cache.patch
deleted file mode 100644
index 444eb8251e49..000000000000
--- a/pkgs/development/libraries/glibc/2.13/dont_use_system_ld_so_cache.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff -Naur glibc-2.13-orig/elf/ldconfig.c glibc-2.13/elf/ldconfig.c
---- glibc-2.13-orig/elf/ldconfig.c	2011-01-17 23:34:07.000000000 -0500
-+++ glibc-2.13/elf/ldconfig.c	2012-04-10 23:28:45.957492340 -0400
-@@ -51,7 +51,7 @@
- #endif
- 
- #ifndef LD_SO_CONF
--# define LD_SO_CONF SYSCONFDIR "/ld.so.conf"
-+# define LD_SO_CONF PREFIX "/etc/ld.so.conf"
- #endif
- 
- /* Get libc version number.  */
-diff -Naur glibc-2.13-orig/elf/Makefile glibc-2.13/elf/Makefile
---- glibc-2.13-orig/elf/Makefile	2011-01-17 23:34:07.000000000 -0500
-+++ glibc-2.13/elf/Makefile	2012-04-10 23:27:05.666477442 -0400
-@@ -459,11 +459,11 @@
- $(objpfx)sprof: $(libdl)
- 
- $(objpfx)ldconfig: $(ldconfig-modules:%=$(objpfx)%.o)
--SYSCONF-FLAGS := -D'SYSCONFDIR="$(sysconfdir)"'
--CFLAGS-ldconfig.c = $(SYSCONF-FLAGS) -D'LIBDIR="$(libdir)"' \
-+PREFIX-FLAGS := -D'PREFIX="$(prefix)"'
-+CFLAGS-ldconfig.c = $(PREFIX-FLAGS) -D'LIBDIR="$(libdir)"' \
- 		    -D'SLIBDIR="$(slibdir)"' -DIS_IN_ldconfig=1
--CFLAGS-dl-cache.c = $(SYSCONF-FLAGS)
--CFLAGS-cache.c = $(SYSCONF-FLAGS)
-+CFLAGS-dl-cache.c = $(PREFIX-FLAGS)
-+CFLAGS-cache.c = $(PREFIX-FLAGS)
- 
- CPPFLAGS-.os += $(if $(filter $(@F),$(patsubst %,%.os,$(all-rtld-routines))),-DNOT_IN_libc=1 -DIS_IN_rtld=1)
- 
-diff -Naur glibc-2.13-orig/sysdeps/generic/dl-cache.h glibc-2.13/sysdeps/generic/dl-cache.h
---- glibc-2.13-orig/sysdeps/generic/dl-cache.h	2011-01-17 23:34:07.000000000 -0500
-+++ glibc-2.13/sysdeps/generic/dl-cache.h	2012-04-10 23:28:20.077488815 -0400
-@@ -29,7 +29,7 @@
- #endif
- 
- #ifndef LD_SO_CACHE
--# define LD_SO_CACHE SYSCONFDIR "/ld.so.cache"
-+# define LD_SO_CACHE PREFIX "/etc/ld.so.cache"
- #endif
- 
- #ifndef add_system_dir
diff --git a/pkgs/development/libraries/glibc/2.13/glibc-elf-localscope.patch b/pkgs/development/libraries/glibc/2.13/glibc-elf-localscope.patch
deleted file mode 100644
index 98f7f81087bb..000000000000
--- a/pkgs/development/libraries/glibc/2.13/glibc-elf-localscope.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-diff -ru a/elf/dl-close.c b/elf/dl-close.c
---- a/elf/dl-close.c	2011-02-04 00:35:03.000000000 +0100
-+++ b/elf/dl-close.c	2011-02-22 02:16:12.367883000 +0100
-@@ -180,24 +186,28 @@
-       /* Signal the object is still needed.  */
-       l->l_idx = IDX_STILL_USED;
- 
-+#define mark_used(dmap) \
-+  do {								\
-+    if ((dmap)->l_idx != IDX_STILL_USED)			\
-+      {								\
-+	assert ((dmap)->l_idx >= 0 && (dmap)->l_idx < nloaded);	\
-+								\
-+	if (!used[(dmap)->l_idx])				\
-+	  {							\
-+	    used[(dmap)->l_idx] = 1;				\
-+	    if ((dmap)->l_idx - 1 < done_index)			\
-+	      done_index = (dmap)->l_idx - 1;			\
-+	  }							\
-+      }								\
-+  } while (0)
-+
-       /* Mark all dependencies as used.  */
-       if (l->l_initfini != NULL)
- 	{
- 	  struct link_map **lp = &l->l_initfini[1];
- 	  while (*lp != NULL)
- 	    {
--	      if ((*lp)->l_idx != IDX_STILL_USED)
--		{
--		  assert ((*lp)->l_idx >= 0 && (*lp)->l_idx < nloaded);
--
--		  if (!used[(*lp)->l_idx])
--		    {
--		      used[(*lp)->l_idx] = 1;
--		      if ((*lp)->l_idx - 1 < done_index)
--			done_index = (*lp)->l_idx - 1;
--		    }
--		}
--
-+	      mark_used(*lp);
- 	      ++lp;
- 	    }
- 	}
-@@ -206,19 +216,25 @@
- 	for (unsigned int j = 0; j < l->l_reldeps->act; ++j)
- 	  {
- 	    struct link_map *jmap = l->l_reldeps->list[j];
--
--	    if (jmap->l_idx != IDX_STILL_USED)
--	      {
--		assert (jmap->l_idx >= 0 && jmap->l_idx < nloaded);
--
--		if (!used[jmap->l_idx])
--		  {
--		    used[jmap->l_idx] = 1;
--		    if (jmap->l_idx - 1 < done_index)
--		      done_index = jmap->l_idx - 1;
--		  }
--	      }
-+	    mark_used(jmap);
- 	  }
-+      /* And the same for owners of our scopes; normally, our last
-+	 scope provider would render us unused, but this can be
-+	 prevented by the NODELETE flag. */
-+      if (__builtin_expect(l->l_type == lt_loaded
-+	                   && (l->l_flags_1 & DF_1_NODELETE), 0))
-+	for (size_t cnt = 0; l->l_scope[cnt] != NULL; ++cnt)
-+	  /* This relies on l_scope[] entries being always set either
-+	     to its own l_symbolic_searchlist address, or some map's
-+	     l_searchlist address.  */
-+	  if (l->l_scope[cnt] != &l->l_symbolic_searchlist)
-+	    {
-+	      struct link_map *ls = (struct link_map *)
-+		((char *) l->l_scope[cnt]
-+		 - offsetof (struct link_map, l_searchlist));
-+	      assert (ls->l_ns == nsid);
-+	      mark_used(ls);
-+	    }
-     }
- 
-   /* Sort the entries.  */
diff --git a/pkgs/development/libraries/glibc/2.13/info.nix b/pkgs/development/libraries/glibc/2.13/info.nix
deleted file mode 100644
index 75bd996d9bc5..000000000000
--- a/pkgs/development/libraries/glibc/2.13/info.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ stdenv, fetchurl, texinfo, perl }:
-
-let build = import ./common.nix;
-in
-  /* null cross builder */
-  build null {
-    name = "glibc-info";
-
-    inherit fetchurl stdenv;
-
-    configureFlags = [ "--enable-add-ons" ];
-
-    buildInputs = [ texinfo perl ];
-
-    buildPhase = "make info";
-
-    # I don't know why the info is not generated in 'build'
-    # Somehow building the info still does not work, because the final
-    # libc.info hasn't a Top node.
-    installPhase = ''
-      mkdir -p "$out/share/info"
-      cp -v "../$sourceRoot/manual/"*.info* "$out/share/info"
-    '';
-
-    meta.description = "GNU Info manual of the GNU C Library";
-  }
diff --git a/pkgs/development/libraries/glibc/2.13/locales-builder.sh b/pkgs/development/libraries/glibc/2.13/locales-builder.sh
deleted file mode 100644
index d732e208fa22..000000000000
--- a/pkgs/development/libraries/glibc/2.13/locales-builder.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-# Glibc cannot have itself in its RPATH.
-export NIX_NO_SELF_RPATH=1
-
-source $stdenv/setup
-
-postConfigure() {
-    # Hack: get rid of the `-static' flag set by the bootstrap stdenv.
-    # This has to be done *after* `configure' because it builds some
-    # test binaries.
-    export NIX_CFLAGS_LINK=
-    export NIX_LDFLAGS_BEFORE=
-
-    export NIX_DONT_SET_RPATH=1
-    unset CFLAGS
-}
-
-genericBuild
diff --git a/pkgs/development/libraries/glibc/2.13/locales.nix b/pkgs/development/libraries/glibc/2.13/locales.nix
deleted file mode 100644
index b7eae50ca385..000000000000
--- a/pkgs/development/libraries/glibc/2.13/locales.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-/* This function builds just the `lib/locale/locale-archive' file from
-   Glibc and nothing else.  If `allLocales' is true, all supported
-   locales are included; otherwise, just the locales listed in
-   `locales'.  See localedata/SUPPORTED in the Glibc source tree for
-   the list of all supported locales:
-   http://sourceware.org/cgi-bin/cvsweb.cgi/libc/localedata/SUPPORTED?cvsroot=glibc
-*/
-
-{ stdenv, fetchurl, allLocales ? true, locales ? ["en_US.UTF-8/UTF-8"] }:
-
-let build = import ./common.nix;
-in
-  build null {
-    name = "glibc-locales";
-
-    inherit fetchurl stdenv;
-    installLocales = true;
-
-    builder = ./locales-builder.sh;
-
-    # Awful hack: `localedef' doesn't allow the path to `locale-archive'
-    # to be overriden, but you *can* specify a prefix, i.e. it will use
-    # <prefix>/<path-to-glibc>/lib/locale/locale-archive.  So we use
-    # $TMPDIR as a prefix, meaning that the locale-archive is placed in
-    # $TMPDIR/nix/store/...-glibc-.../lib/locale/locale-archive.
-    buildPhase =
-      ''
-        mkdir -p $TMPDIR/"$(dirname $(readlink -f $(type -p localedef)))/../lib/locale"
-
-        # Hack to allow building of the locales (needed since glibc-2.12)
-        sed -i -e "s,^LOCALEDEF=.*,LOCALEDEF=localedef --prefix=$TMPDIR," -e \
-            /library-path/d ../glibc-2*/localedata/Makefile
-        ${if allLocales then "" else
-            "echo SUPPORTED-LOCALES=\"${toString locales}\" > ../glibc-2*/localedata/SUPPORTED"}
-
-        make localedata/install-locales \
-            localedir=$out/lib/locale \
-      '';
-
-    installPhase =
-      ''
-        mkdir -p "$out/lib/locale"
-        cp -v "$TMPDIR/nix/store/"*"/lib/locale/locale-archive" "$out/lib/locale"
-      '';
-
-    meta.description = "Locale information for the GNU C Library";
-  }
diff --git a/pkgs/development/libraries/glibc/2.13/nix-locale-archive.patch b/pkgs/development/libraries/glibc/2.13/nix-locale-archive.patch
deleted file mode 100644
index aca904f7ff44..000000000000
--- a/pkgs/development/libraries/glibc/2.13/nix-locale-archive.patch
+++ /dev/null
@@ -1,116 +0,0 @@
-diff --git a/locale/loadarchive.c b/locale/loadarchive.c
-index d545f17..0d8638a 100644
---- a/locale/loadarchive.c
-+++ b/locale/loadarchive.c
-@@ -124,6 +124,25 @@ calculate_head_size (const struct locarhead *h)
- }
- 
- 
-+static int
-+open_locale_archive ()
-+{
-+  int fd = -1;
-+  char *path = getenv ("LOCALE_ARCHIVE_2_11");
-+  char *path2 = getenv ("LOCALE_ARCHIVE");
-+  const char *usualpath = "/usr/lib/locale/locale-archive";
-+  if (path)
-+    fd = open_not_cancel_2 (path, O_RDONLY|O_LARGEFILE);
-+  if (path2 && fd < 0)
-+    fd = open_not_cancel_2 (path2, O_RDONLY|O_LARGEFILE);
-+  if (fd < 0)
-+    fd = open_not_cancel_2 (archfname, O_RDONLY|O_LARGEFILE);
-+  if (fd < 0)
-+    fd = open_not_cancel_2 (usualpath, O_RDONLY|O_LARGEFILE);
-+  return fd;
-+}
-+
-+
- /* Find the locale *NAMEP in the locale archive, and return the
-    internalized data structure for its CATEGORY data.  If this locale has
-    already been loaded from the archive, just returns the existing data
-@@ -203,7 +222,7 @@ _nl_load_locale_from_archive (int category, const char **namep)
-       archmapped = &headmap;
- 
-       /* The archive has never been opened.  */
--      fd = open_not_cancel_2 (archfname, O_RDONLY|O_LARGEFILE);
-+      fd = open_locale_archive ();
-       if (fd < 0)
- 	/* Cannot open the archive, for whatever reason.  */
- 	return NULL;
-@@ -394,7 +413,7 @@ _nl_load_locale_from_archive (int category, const char **namep)
- 	  if (fd == -1)
- 	    {
- 	      struct stat64 st;
--	      fd = open_not_cancel_2 (archfname, O_RDONLY|O_LARGEFILE);
-+	      fd = open_locale_archive ();
- 	      if (fd == -1)
- 		/* Cannot open the archive, for whatever reason.  */
- 		return NULL;
-diff --git a/locale/programs/locale.c b/locale/programs/locale.c
-index 77262b7..fddc00d 100644
---- a/locale/programs/locale.c
-+++ b/locale/programs/locale.c
-@@ -628,6 +628,20 @@ nameentcmp (const void *a, const void *b)
- 		  ((const struct nameent *) b)->name);
- }
- 
-+static int
-+open_nix_locale_archive (const char * fname, int access)
-+{
-+  int fd = -1;
-+  char *path = getenv ("LOCALE_ARCHIVE_2_11");
-+  char *path2 = getenv ("LOCALE_ARCHIVE");
-+  if (path)
-+    fd = open64 (path, access);
-+  if (path2 && fd < 0)
-+    fd = open64 (path2, access);
-+  if (fd < 0)
-+    fd = open64 (fname, access);
-+  return fd;
-+}
- 
- static int
- write_archive_locales (void **all_datap, char *linebuf)
-@@ -641,7 +658,7 @@ write_archive_locales (void **all_datap, char *linebuf)
-   int fd, ret = 0;
-   uint32_t cnt;
- 
--  fd = open64 (ARCHIVE_NAME, O_RDONLY);
-+  fd = open_nix_locale_archive (ARCHIVE_NAME, O_RDONLY);
-   if (fd < 0)
-     return 0;
- 
-diff --git a/locale/programs/locarchive.c b/locale/programs/locarchive.c
-index 85ba77d..3ad2af8 100644
---- a/locale/programs/locarchive.c
-+++ b/locale/programs/locarchive.c
-@@ -512,6 +512,20 @@ enlarge_archive (struct locarhandle *ah, const struct locarhead *head)
-   *ah = new_ah;
- }
- 
-+static int
-+open_nix_locale_archive (const char * fname, int access)
-+{
-+  int fd = -1;
-+  char *path = getenv ("LOCALE_ARCHIVE_2_11");
-+  char *path2 = getenv ("LOCALE_ARCHIVE");
-+  if (path)
-+    fd = open64 (path, access);
-+  if (path2 && fd < 0)
-+    fd = open64 (path2, access);
-+  if (fd < 0)
-+    fd = open64 (fname, access);
-+  return fd;
-+}
- 
- void
- open_archive (struct locarhandle *ah, bool readonly)
-@@ -531,7 +548,7 @@ open_archive (struct locarhandle *ah, bool readonly)
-   while (1)
-     {
-       /* Open the archive.  We must have exclusive write access.  */
--      fd = open64 (archivefname, readonly ? O_RDONLY : O_RDWR);
-+      fd = open_nix_locale_archive (archivefname, readonly ? O_RDONLY : O_RDWR);
-       if (fd == -1)
- 	{
- 	  /* Maybe the file does not yet exist.  */
diff --git a/pkgs/development/libraries/glibc/2.13/nss-skip-unavail.patch b/pkgs/development/libraries/glibc/2.13/nss-skip-unavail.patch
deleted file mode 100644
index e48dc2bc0a6e..000000000000
--- a/pkgs/development/libraries/glibc/2.13/nss-skip-unavail.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff -ru glibc-2.11.2-orig/sysdeps/posix/getaddrinfo.c glibc-2.11.2/sysdeps/posix/getaddrinfo.c
---- glibc-2.11.2-orig/sysdeps/posix/getaddrinfo.c	2010-05-19 22:38:20.000000000 +0200
-+++ glibc-2.11.2/sysdeps/posix/getaddrinfo.c	2010-08-05 18:39:54.259556327 +0200
-@@ -505,8 +505,6 @@
- 	  int no_data = 0;
- 	  int no_inet6_data = 0;
- 	  service_user *nip = NULL;
--	  enum nss_status inet6_status = NSS_STATUS_UNAVAIL;
--	  enum nss_status status = NSS_STATUS_UNAVAIL;
- 	  int no_more;
- 	  int old_res_options;
- 
-@@ -702,6 +700,8 @@
- 
- 	  while (!no_more)
- 	    {
-+ 	      enum nss_status inet6_status = NSS_STATUS_UNAVAIL;
-+ 	      enum nss_status status = NSS_STATUS_UNAVAIL;
- 	      no_data = 0;
- 	      nss_gethostbyname4_r fct4
- 		= __nss_lookup_function (nip, "gethostbyname4_r");
diff --git a/pkgs/development/libraries/glibc/2.13/rpcgen-path.patch b/pkgs/development/libraries/glibc/2.13/rpcgen-path.patch
deleted file mode 100644
index fbb03dd5fade..000000000000
--- a/pkgs/development/libraries/glibc/2.13/rpcgen-path.patch
+++ /dev/null
@@ -1,72 +0,0 @@
-By default, rpcgen(1) looks for cpp(1) from a list of fixed absolute paths
-(`/lib/cpp', etc.), which may only be overrided with the `-Y' option.  This
-patch makes it run any `cpp' command found in $PATH.
-
---- glibc-2.7/sunrpc/rpc_main.c	2006-11-10 21:54:46.000000000 +0100
-+++ glibc-2.7/sunrpc/rpc_main.c	2009-04-22 14:32:10.000000000 +0200
-@@ -79,7 +79,7 @@ static const char *cmdname;
- 
- static const char *svcclosetime = "120";
- static int cppDefined;	/* explicit path for C preprocessor */
--static const char *CPP = SUNOS_CPP;
-+static const char *CPP = "cpp";
- static const char CPPFLAGS[] = "-C";
- static char *pathbuf;
- static int cpp_pid;
-@@ -108,7 +108,6 @@ static char *extendfile (const char *fil
- static void open_output (const char *infile, const char *outfile);
- static void add_warning (void);
- static void clear_args (void);
--static void find_cpp (void);
- static void open_input (const char *infile, const char *define);
- static int check_nettype (const char *name, const char *list_to_check[]);
- static void c_output (const char *infile, const char *define,
-@@ -327,31 +326,6 @@ clear_args (void)
-   argcount = FIXEDARGS;
- }
- 
--/* make sure that a CPP exists */
--static void
--find_cpp (void)
--{
--  struct stat buf;
--
--  if (stat (CPP, &buf) < 0)
--    {				/* /lib/cpp or explicit cpp does not exist */
--      if (cppDefined)
--	{
--	  fprintf (stderr, _ ("cannot find C preprocessor: %s \n"), CPP);
--	  crash ();
--	}
--      else
--	{			/* try the other one */
--	  CPP = SVR4_CPP;
--	  if (stat (CPP, &buf) < 0)
--	    {			/* can't find any cpp */
--	      fputs (_ ("cannot find any C preprocessor (cpp)\n"), stdout);
--	      crash ();
--	    }
--	}
--    }
--}
--
- /*
-  * Open input file with given define for C-preprocessor
-  */
-@@ -370,7 +344,6 @@ open_input (const char *infile, const ch
-   switch (cpp_pid)
-     {
-     case 0:
--      find_cpp ();
-       putarg (0, CPP);
-       putarg (1, CPPFLAGS);
-       addarg (define);
-@@ -380,7 +353,7 @@ open_input (const char *infile, const ch
-       close (1);
-       dup2 (pd[1], 1);
-       close (pd[0]);
--      execv (arglist[0], (char **) arglist);
-+      execvp (arglist[0], (char **) arglist);
-       perror ("execv");
-       exit (1);
-     case -1:
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2cc7760b713c..adbbfe69e5c2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3797,14 +3797,6 @@ let
 
   glibcCross = glibc217Cross;
 
-  glibc213 = (callPackage ../development/libraries/glibc/2.13 {
-    kernelHeaders = linuxHeaders;
-    installLocales = config.glibc.locales or false;
-    machHeaders = null;
-    hurdHeaders = null;
-    gccCross = null;
-  }) // (if crossSystem != null then { crossDrv = glibc213Cross; } else {});
-
   glibc217 = callPackage ../development/libraries/glibc/2.17 {
     kernelHeaders = linuxHeaders;
     installLocales = config.glibc.locales or false;

From 0f53a2e9f3261998cd10e5c3588c2df0de3218a4 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 9 May 2013 13:52:05 +0200
Subject: [PATCH 03/11] glibc: Require Linux 2.6.32 instead of 2.6.35

By popular demand.  For instance, many widely used RHEL systems are
still on 2.6.32.
---
 pkgs/development/libraries/glibc/2.17/common.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/glibc/2.17/common.nix b/pkgs/development/libraries/glibc/2.17/common.nix
index 413a0d7aae82..23ec1c46ad7b 100644
--- a/pkgs/development/libraries/glibc/2.17/common.nix
+++ b/pkgs/development/libraries/glibc/2.17/common.nix
@@ -81,7 +81,7 @@ stdenv.mkDerivation ({
        then "--enable-profile"
        else "--disable-profile")
     ] ++ stdenv.lib.optionals (cross == null && kernelHeaders != null) [
-      "--enable-kernel=2.6.35"
+      "--enable-kernel=2.6.32"
     ] ++ stdenv.lib.optionals (cross != null) [
       (if cross.withTLS then "--with-tls" else "--without-tls")
       (if cross.float == "soft" then "--without-fp" else "--with-fp")

From c2a16ec01208e44cd37baed6654e2d6cc9909b35 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <eelco.dolstra@logicblox.com>
Date: Thu, 9 May 2013 13:57:59 +0200
Subject: [PATCH 04/11] glibc: Security fixes.

CVE-2013-0242, CVE-2013-1914.
---
 .../libraries/glibc/2.17/common.nix           |  6 ++
 .../libraries/glibc/2.17/cve-2013-0242.patch  | 87 +++++++++++++++++++
 .../libraries/glibc/2.17/cve-2013-1914.patch  | 52 +++++++++++
 3 files changed, 145 insertions(+)
 create mode 100644 pkgs/development/libraries/glibc/2.17/cve-2013-0242.patch
 create mode 100644 pkgs/development/libraries/glibc/2.17/cve-2013-1914.patch

diff --git a/pkgs/development/libraries/glibc/2.17/common.nix b/pkgs/development/libraries/glibc/2.17/common.nix
index 23ec1c46ad7b..e0588a6275d6 100644
--- a/pkgs/development/libraries/glibc/2.17/common.nix
+++ b/pkgs/development/libraries/glibc/2.17/common.nix
@@ -55,6 +55,12 @@ stdenv.mkDerivation ({
          rfc3484_sort: Assertion `src->results[i].native == -1 ||
          src->results[i].native == a2_native' failed." crashes. */
       ./glibc-rh739743.patch
+
+      /* Fix buffer overrun in regexp matcher. */
+      ./cve-2013-0242.patch
+
+      /* Fix stack overflow in getaddrinfo with many results. */
+      ./cve-2013-1914.patch
     ];
 
   postPatch = ''
diff --git a/pkgs/development/libraries/glibc/2.17/cve-2013-0242.patch b/pkgs/development/libraries/glibc/2.17/cve-2013-0242.patch
new file mode 100644
index 000000000000..1d6557071e1a
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.17/cve-2013-0242.patch
@@ -0,0 +1,87 @@
+When extending regex buffers, make sure we allocate enough room for the
+state log.  Merely doubling the space may not be enough if the current
+node has accepted a long run of characters.  This part of the code only
+triggers with multibyte characters.
+
+Andreas.
+
+	[BZ #15078]
+	* posix/regexec.c (extend_buffers): Add parameter min_len.
+	(check_matching): Pass minimum needed length.
+	(clean_state_log_if_needed): Likewise.
+	(get_subexp): Likewise.
+	* posix/Makefile (tests): Add bug-regex34.
+	(bug-regex34-ENV): Define.
+	* posix/bug-regex34.c: New file.
+
+diff --git a/posix/regexec.c b/posix/regexec.c
+index 7f2de85..5ca2bf6 100644
+--- a/posix/regexec.c
++++ b/posix/regexec.c
+@@ -197,7 +197,7 @@ static int group_nodes_into_DFAstates (const re_dfa_t *dfa,
+ static int check_node_accept (const re_match_context_t *mctx,
+ 			      const re_token_t *node, int idx)
+      internal_function;
+-static reg_errcode_t extend_buffers (re_match_context_t *mctx)
++static reg_errcode_t extend_buffers (re_match_context_t *mctx, int min_len)
+      internal_function;
+ 
+ /* Entry point for POSIX code.  */
+@@ -1160,7 +1160,7 @@ check_matching (re_match_context_t *mctx, int fl_longest_match,
+ 	  || (BE (next_char_idx >= mctx->input.valid_len, 0)
+ 	      && mctx->input.valid_len < mctx->input.len))
+ 	{
+-	  err = extend_buffers (mctx);
++	  err = extend_buffers (mctx, next_char_idx + 1);
+ 	  if (BE (err != REG_NOERROR, 0))
+ 	    {
+ 	      assert (err == REG_ESPACE);
+@@ -1738,7 +1738,7 @@ clean_state_log_if_needed (re_match_context_t *mctx, int next_state_log_idx)
+ 	  && mctx->input.valid_len < mctx->input.len))
+     {
+       reg_errcode_t err;
+-      err = extend_buffers (mctx);
++      err = extend_buffers (mctx, next_state_log_idx + 1);
+       if (BE (err != REG_NOERROR, 0))
+ 	return err;
+     }
+@@ -2792,7 +2792,7 @@ get_subexp (re_match_context_t *mctx, int bkref_node, int bkref_str_idx)
+ 		  if (bkref_str_off >= mctx->input.len)
+ 		    break;
+ 
+-		  err = extend_buffers (mctx);
++		  err = extend_buffers (mctx, bkref_str_off + 1);
+ 		  if (BE (err != REG_NOERROR, 0))
+ 		    return err;
+ 
+@@ -4102,7 +4102,7 @@ check_node_accept (const re_match_context_t *mctx, const re_token_t *node,
+ 
+ static reg_errcode_t
+ internal_function __attribute_warn_unused_result__
+-extend_buffers (re_match_context_t *mctx)
++extend_buffers (re_match_context_t *mctx, int min_len)
+ {
+   reg_errcode_t ret;
+   re_string_t *pstr = &mctx->input;
+@@ -4111,8 +4111,10 @@ extend_buffers (re_match_context_t *mctx)
+   if (BE (INT_MAX / 2 / sizeof (re_dfastate_t *) <= pstr->bufs_len, 0))
+     return REG_ESPACE;
+ 
+-  /* Double the lengthes of the buffers.  */
+-  ret = re_string_realloc_buffers (pstr, MIN (pstr->len, pstr->bufs_len * 2));
++  /* Double the lengthes of the buffers, but allocate at least MIN_LEN.  */
++  ret = re_string_realloc_buffers (pstr,
++				   MAX (min_len,
++					MIN (pstr->len, pstr->bufs_len * 2)));
+   if (BE (ret != REG_NOERROR, 0))
+     return ret;
+ 
+-- 
+1.8.1.2
+
+
+-- 
+Andreas Schwab, SUSE Labs, schwab@suse.de
+GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
+"And now for something completely different."
+
diff --git a/pkgs/development/libraries/glibc/2.17/cve-2013-1914.patch b/pkgs/development/libraries/glibc/2.17/cve-2013-1914.patch
new file mode 100644
index 000000000000..c2963249f5e4
--- /dev/null
+++ b/pkgs/development/libraries/glibc/2.17/cve-2013-1914.patch
@@ -0,0 +1,52 @@
+From: Andreas Schwab <schwab@suse.de>
+Date: Thu, 21 Mar 2013 14:50:27 +0000 (+0100)
+Subject: Fix stack overflow in getaddrinfo with many results
+X-Git-Url: http://sourceware.org/git/?p=glibc.git;a=commitdiff_plain;h=1cef1b19089528db11f221e938f60b9b048945d7
+
+Fix stack overflow in getaddrinfo with many results
+---
+
+diff --git a/sysdeps/posix/getaddrinfo.c b/sysdeps/posix/getaddrinfo.c
+index d95c2d1..2309281 100644
+--- a/sysdeps/posix/getaddrinfo.c
++++ b/sysdeps/posix/getaddrinfo.c
+@@ -2489,11 +2489,27 @@ getaddrinfo (const char *name, const char *service,
+       __typeof (once) old_once = once;
+       __libc_once (once, gaiconf_init);
+       /* Sort results according to RFC 3484.  */
+-      struct sort_result results[nresults];
+-      size_t order[nresults];
++      struct sort_result *results;
++      size_t *order;
+       struct addrinfo *q;
+       struct addrinfo *last = NULL;
+       char *canonname = NULL;
++      bool malloc_results;
++
++      malloc_results
++	= !__libc_use_alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      if (malloc_results)
++	{
++	  results = malloc (nresults * (sizeof (*results) + sizeof (size_t)));
++	  if (results == NULL)
++	    {
++	      __free_in6ai (in6ai);
++	      return EAI_MEMORY;
++	    }
++	}
++      else
++	results = alloca (nresults * (sizeof (*results) + sizeof (size_t)));
++      order = (size_t *) (results + nresults);
+ 
+       /* Now we definitely need the interface information.  */
+       if (! check_pf_called)
+@@ -2664,6 +2680,9 @@ getaddrinfo (const char *name, const char *service,
+ 
+       /* Fill in the canonical name into the new first entry.  */
+       p->ai_canonname = canonname;
++
++      if (malloc_results)
++	free (results);
+     }
+ 
+   __free_in6ai (in6ai);

From 0f8a1b29d276b3ad126ecd483ffa76a0bf6d9590 Mon Sep 17 00:00:00 2001
From: Domen Kozar <domen@dev.si>
Date: Sun, 26 May 2013 13:22:55 +0200
Subject: [PATCH 05/11] unzip: add bzip2 as native build input

---
 pkgs/tools/archivers/unzip/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/tools/archivers/unzip/default.nix b/pkgs/tools/archivers/unzip/default.nix
index 8309a2102ab4..f939c968c44d 100644
--- a/pkgs/tools/archivers/unzip/default.nix
+++ b/pkgs/tools/archivers/unzip/default.nix
@@ -9,6 +9,7 @@ stdenv.mkDerivation ({
     sha256 = "0dxx11knh3nk95p2gg2ak777dd11pr7jx5das2g49l262scrcv83";
   };
 
+  nativeBuildInputs = [ bzip2 ];
   buildInputs = [ bzip2 ] ++ stdenv.lib.optional enableNLS libnatspec;
 
   makefile = "unix/Makefile";

From 4968acde6bde9750fde32728777d2e7ab453a073 Mon Sep 17 00:00:00 2001
From: "Jason \"Don\" O'Conal" <lovek323@gmail.com>
Date: Tue, 11 Jun 2013 13:56:43 +1000
Subject: [PATCH 06/11] Add vim syntastic plugin

---
 pkgs/misc/vim-plugins/default.nix | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/pkgs/misc/vim-plugins/default.nix b/pkgs/misc/vim-plugins/default.nix
index b0c70d958217..3a24bee43de3 100644
--- a/pkgs/misc/vim-plugins/default.nix
+++ b/pkgs/misc/vim-plugins/default.nix
@@ -126,4 +126,23 @@ in
     };
   };
 
+  syntastic = stdenv.mkDerivation {
+    name = "vim-syntastic-3.0.0";
+   
+    src = fetchurl {
+      url = "https://github.com/scrooloose/syntastic/archive/3.0.0.tar.gz";
+      sha256 = "0nf69wpa8qa7xcfvywy2khmazs4dn1i2nal9qwjh2bzrbwbbkdyl";
+    };
+
+    buildPhase = "";
+
+    installPhase = ''
+      mkdir -p "$out/vim-plugins"
+      cp -R autoload "$out/vim-plugins"
+      cp -R doc "$out/vim-plugins"
+      cp -R plugin "$out/vim-plugins"
+      cp -R syntax_checkers "$out/vim-plugins"
+    '';
+  };
 }
+

From b7b98f04a23c7263a79b05995dc616ff19447599 Mon Sep 17 00:00:00 2001
From: "Jason \"Don\" O'Conal" <lovek323@gmail.com>
Date: Sat, 15 Jun 2013 20:48:20 +1000
Subject: [PATCH 07/11] vim_configurable: improvements

* add ruby interpreter (may have been accidentally removed, or may never
  have existed)
* allow selection of GUI options by setting `config.vim.gui`
---
 pkgs/applications/editors/vim/configurable.nix | 4 +++-
 pkgs/top-level/all-packages.nix                | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/vim/configurable.nix b/pkgs/applications/editors/vim/configurable.nix
index b598a3d461e7..d9211203cadc 100644
--- a/pkgs/applications/editors/vim/configurable.nix
+++ b/pkgs/applications/editors/vim/configurable.nix
@@ -40,7 +40,8 @@ composableDerivation {
       }.src;
     };
 
-    configureFlags = ["--enable-gui=auto" "--with-features=${args.features}"];
+    configureFlags
+      = [ "--enable-gui=${args.gui}" "--with-features=${args.features}" ];
 
     nativeBuildInputs
       = [ ncurses pkgconfig gtk libX11 libXext libSM libXpm libXt libXaw libXau
@@ -76,6 +77,7 @@ composableDerivation {
 
   cfg = {
     pythonSupport    = config.vim.python or true;
+    rubySupport      = config.vim.ruby or true;
     nlsSupport       = config.vim.nls or false;
     tclSupport       = config.vim.tcl or false;
     multibyteSupport = config.vim.multibyte or false;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 239c9a5a41b8..190035b9e3e4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8261,6 +8261,7 @@ let
 
     features = "huge"; # one of  tiny, small, normal, big or huge
     lua = pkgs.lua5;
+    gui = config.vim.gui or "auto";
 
     # optional features by flags
     flags = [ "python" "X11" ]; # only flag "X11" by now

From 38d22b48519e12a3a9a9e8c4cdf5730fdfb4f84b Mon Sep 17 00:00:00 2001
From: Peter Simons <simons@cryp.to>
Date: Sat, 15 Jun 2013 17:12:40 +0200
Subject: [PATCH 08/11] ess: add Emacs Speaks Statistics mode

---
 .../editors/emacs-modes/ess/default.nix       | 20 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/applications/editors/emacs-modes/ess/default.nix

diff --git a/pkgs/applications/editors/emacs-modes/ess/default.nix b/pkgs/applications/editors/emacs-modes/ess/default.nix
new file mode 100644
index 000000000000..4bd5148b9508
--- /dev/null
+++ b/pkgs/applications/editors/emacs-modes/ess/default.nix
@@ -0,0 +1,20 @@
+{ stdenv, fetchurl, emacs, texinfo }:
+
+stdenv.mkDerivation {
+  name = "ess-13.05";
+
+  src = fetchurl {
+    url = "http://ess.r-project.org/downloads/ess/ess-13.05.tgz";
+    sha256 = "007rd8hg1aclr2i8178ym5c4bi7vgmwkp802v1mkgr85h50zlfdk";
+  };
+
+  buildInputs = [ emacs texinfo ];
+
+  configurePhase = "makeFlags=PREFIX=$out";
+
+  meta = {
+    description = "Emacs Speaks Statistics";
+    homepage = "http://ess.r-project.org/";
+    license = stdenv.lib.licenses.gpl2Plus;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8b7ff569bba7..5b8ba8ca611f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7105,6 +7105,8 @@ let
 
     emms = callPackage ../applications/editors/emacs-modes/emms { };
 
+    ess = callPackage ../applications/editors/emacs-modes/ess { };
+
     flymakeCursor = callPackage ../applications/editors/emacs-modes/flymake-cursor { };
 
     gh = callPackage ../applications/editors/emacs-modes/gh { };

From 84c1d5f03b5c7e16ffa70b677f489a69410247c8 Mon Sep 17 00:00:00 2001
From: Peter Simons <simons@cryp.to>
Date: Sat, 15 Jun 2013 17:13:00 +0200
Subject: [PATCH 09/11] all-packages.nix: use blanks instead of tabs

---
 pkgs/top-level/all-packages.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b8ba8ca611f..c8f73c1c289d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9509,11 +9509,11 @@ let
       name = "patoline";
       buildInputs = [ stdenv ncurses mesa freeglut libzip gcc
                                    pack.ocaml pack.findlib pack.camomile
-	                           pack.dypgen pack.ocaml_sqlite3 pack.camlzip
-				   pack.lablgtk pack.camlimages pack.ocaml_cairo
-				   pack.lablgl pack.ocamlnet pack.cryptokit
-				   pack.ocaml_pcre pack.patoline
-				   ];
+                                   pack.dypgen pack.ocaml_sqlite3 pack.camlzip
+                                   pack.lablgtk pack.camlimages pack.ocaml_cairo
+                                   pack.lablgl pack.ocamlnet pack.cryptokit
+                                   pack.ocaml_pcre pack.patoline
+                                   ];
     # this is to circumvent the bug with libgcc_s.so.1 which is
     # not found when using thread
     extraCmds = ''

From c63f00c3378e1cc7d94580819d8e93fe793000c2 Mon Sep 17 00:00:00 2001
From: Aristid Breitkreuz <aristidb@gmail.com>
Date: Sat, 15 Jun 2013 19:31:25 +0200
Subject: [PATCH 10/11] linux 3.9.6

---
 pkgs/os-specific/linux/kernel/linux-3.9.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/linux-3.9.nix b/pkgs/os-specific/linux/kernel/linux-3.9.nix
index e87d3c3198f7..ed7451dfe5d6 100644
--- a/pkgs/os-specific/linux/kernel/linux-3.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-3.9.nix
@@ -253,7 +253,7 @@ in
 import ./generic.nix (
 
   rec {
-    version = "3.9.5";
+    version = "3.9.6";
     testing = false;
 
     preConfigure = ''
@@ -262,7 +262,7 @@ import ./generic.nix (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v3.x/${if testing then "testing/" else ""}linux-${version}.tar.xz";
-      sha256 = "05y3wrvady60p8ksjwwa5c2jia2ax9q0p7lhr62yafywh5piyfbw";
+      sha256 = "0spba7qkf56j233r84y23xl7d44ndvw5ja7h3pfhsq861dypcc0i";
     };
 
     config = configWithPlatform stdenv.platform;

From ccda14879efd818b17a0b85bb0c3a512c1ebf84d Mon Sep 17 00:00:00 2001
From: Rob Vermaas <rob.vermaas@gmail.com>
Date: Sat, 15 Jun 2013 20:46:52 +0200
Subject: [PATCH 11/11] Add unionfs-fuse and ntfs-3g to the channel

---
 pkgs/tools/filesystems/ntfs-3g/default.nix      | 1 +
 pkgs/tools/filesystems/unionfs-fuse/default.nix | 1 +
 2 files changed, 2 insertions(+)

diff --git a/pkgs/tools/filesystems/ntfs-3g/default.nix b/pkgs/tools/filesystems/ntfs-3g/default.nix
index 50ebb1b068a1..f6177fd89764 100644
--- a/pkgs/tools/filesystems/ntfs-3g/default.nix
+++ b/pkgs/tools/filesystems/ntfs-3g/default.nix
@@ -38,5 +38,6 @@ stdenv.mkDerivation rec {
     homepage = http://www.tuxera.com/community/;
     description = "FUSE-base NTFS driver with full write support";
     maintainers = [ stdenv.lib.maintainers.urkud ];
+    platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/tools/filesystems/unionfs-fuse/default.nix b/pkgs/tools/filesystems/unionfs-fuse/default.nix
index 5b681ab170c5..4da1a84e937a 100644
--- a/pkgs/tools/filesystems/unionfs-fuse/default.nix
+++ b/pkgs/tools/filesystems/unionfs-fuse/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     homepage = http://podgorny.cz/moin/UnionFsFuse;
     license = stdenv.lib.licenses.bsd3;
     maintainers = [ stdenv.lib.maintainers.shlevy ];
+    platforms = stdenv.lib.platforms.linux;
   };
 }