From ca5b73114f13e6f34ded3c415721939c196e07dd Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludo@gnu.org>
Date: Thu, 22 Mar 2018 11:42:22 +0100
Subject: gnu: shepherd: Update to 0.4.0.

* gnu/packages/admin.scm (shepherd): Update to 0.4.0.  Remove patches.
* gnu/packages/patches/shepherd-close-fds.patch,
gnu/packages/patches/shepherd-herd-status-sorted.patch: Remove.
* gnu/local.mk (dist_patch_DATA): Remove them.
* gnu/services/admin.scm (%default-rotations): Remove
/var/log/shepherd.log.
---
 gnu/local.mk | 2 --
 1 file changed, 2 deletions(-)

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index 686595cd58..b0196c7313 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1086,8 +1086,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/sdl-libx11-1.6.patch			\
   %D%/packages/patches/seq24-rename-mutex.patch			\
   %D%/packages/patches/shadow-CVE-2018-7169.patch		\
-  %D%/packages/patches/shepherd-close-fds.patch			\
-  %D%/packages/patches/shepherd-herd-status-sorted.patch	\
   %D%/packages/patches/shishi-fix-libgcrypt-detection.patch	\
   %D%/packages/patches/slim-session.patch			\
   %D%/packages/patches/slim-config.patch			\
-- 
cgit v1.2.3


From ec40a0501f08c9d95318612d7c67aed13e509287 Mon Sep 17 00:00:00 2001
From: Danny Milosavljevic <dannym@scratchpost.org>
Date: Tue, 13 Mar 2018 03:20:53 +0100
Subject: gnu: Add lyx.

* gnu/packages/patches/lyx-2.2.3-fix-test.patch: New file.
* gnu/local.mk: Add it.
* gnu/packages/tex.scm (lyx): New variable.
---
 gnu/local.mk                                  |  1 +
 gnu/packages/patches/lyx-2.2.3-fix-test.patch | 13 ++++
 gnu/packages/tex.scm                          | 92 +++++++++++++++++++++++++++
 3 files changed, 106 insertions(+)
 create mode 100644 gnu/packages/patches/lyx-2.2.3-fix-test.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index b0196c7313..26d2369a5a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -901,6 +901,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/luminance-hdr-qt-printer.patch		\
   %D%/packages/patches/lvm2-static-link.patch			\
   %D%/packages/patches/lxsession-use-gapplication.patch         \
+  %D%/packages/patches/lyx-2.2.3-fix-test.patch			\
   %D%/packages/patches/mailutils-uninitialized-memory.patch	\
   %D%/packages/patches/make-impure-dirs.patch			\
   %D%/packages/patches/mars-install.patch			\
diff --git a/gnu/packages/patches/lyx-2.2.3-fix-test.patch b/gnu/packages/patches/lyx-2.2.3-fix-test.patch
new file mode 100644
index 0000000000..10b7d2a3a9
--- /dev/null
+++ b/gnu/packages/patches/lyx-2.2.3-fix-test.patch
@@ -0,0 +1,13 @@
+See https://www.lyx.org/trac/ticket/10800#comment:17
+diff --git a/src/tex2lyx/test/test-structure.lyx.lyx b/src/tex2lyx/test/test-structure.lyx.lyx
+index feff755cd2..2c7f2ace5c 100644
+--- a/src/tex2lyx/test/test-structure.lyx.lyx
++++ b/src/tex2lyx/test/test-structure.lyx.lyx
+@@ -212,7 +212,7 @@ This causes the
+ \begin_inset Flex Flex:Strong
+ status collapsed
+ 
+-\begin_layout Standard
++\begin_layout Plain Layout
+ logikalmkup
+ \end_layout
diff --git a/gnu/packages/tex.scm b/gnu/packages/tex.scm
index 266e42d5aa..c8ea45aee4 100644
--- a/gnu/packages/tex.scm
+++ b/gnu/packages/tex.scm
@@ -10,6 +10,7 @@
 ;;; Copyright © 2017 Leo Famulari <leo@famulari.name>
 ;;; Copyright © 2017 Marius Bakke <mbakke@fastmail.com>
 ;;; Copyright © 2017 Tobias Geerinckx-Rice <me@tobias.gr>
+;;; Copyright © 2018 Danny Milosavljevic <dannym+a@scratchpost.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -30,6 +31,7 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
   #:use-module (guix build-system trivial)
@@ -38,8 +40,10 @@
   #:use-module (guix git-download)
   #:use-module (guix svn-download)
   #:use-module (gnu packages)
+  #:use-module (gnu packages algebra)
   #:use-module (gnu packages autotools)
   #:use-module (gnu packages bash)
+  #:use-module (gnu packages boost)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages fontutils)
   #:use-module (gnu packages gd)
@@ -47,6 +51,7 @@
   #:use-module (gnu packages gtk)
   #:use-module (gnu packages icu4c)
   #:use-module (gnu packages image)
+  #:use-module (gnu packages libreoffice)
   #:use-module (gnu packages lua)
   #:use-module (gnu packages multiprecision)
   #:use-module (gnu packages pdf)
@@ -4263,3 +4268,90 @@ develop documents with LaTeX, in a single application.")
 plain TeX, and Eplain, originally written by Paul Abrahams, Kathryn Hargreaves,
 and Karl Berry.")
     (license license:fdl1.3+)))
+
+(define-public lyx
+  (package
+    (name "lyx")
+    (version "2.2.3")
+    (source (origin
+             (method url-fetch)
+             (uri (string-append "http://ftp.lyx.org/pub/lyx/stable/2.2.x/"
+                                 name "-" version ".tar.gz"))
+             (sha256
+              (base32
+               "0xvaz0i371nn2ndinc0d3ywj76ivb62649a4sdgwbivisiahd2fj"))
+             (patches (search-patches "lyx-2.2.3-fix-test.patch"))
+             (modules '((guix build utils)))
+             (snippet
+              '(begin
+                (delete-file-recursively "3rdparty")
+                #t))))
+    (build-system cmake-build-system)
+    (arguments
+     `(#:configure-flags `("-DLYX_USE_QT=QT5"
+                           "-DLYX_EXTERNAL_BOOST=1"
+                           "-DLYX_INSTALL=1"
+                           "-DLYX_RELEASE=1"
+                           ,(string-append "-DLYX_INSTALL_PREFIX="
+                                           (assoc-ref %outputs "out")
+                                           ;; Exact name and level is necessary.
+                                           "/lyx2.2"))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-python
+           (lambda* (#:key inputs #:allow-other-keys)
+             (substitute* '("src/support/os.cpp")
+              (("\"python ")
+               (string-append "\""
+                              (assoc-ref inputs "python-2")
+                              "/bin/python ")))
+             #t))
+         (add-after 'patch-python 'patch-installer
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* "CMakeLists.txt"
+              (("/usr/local/man/man1")
+               (string-append (assoc-ref outputs "out")
+                              "/share/man/man1")))
+             #t))
+         (add-after 'patch-python 'patch-desktop-file
+           (lambda* (#:key outputs #:allow-other-keys)
+             (substitute* "lib/lyx.desktop.in"
+              (("Exec=")
+               (string-append "Exec="
+                              (assoc-ref outputs "out")
+                              "/")))
+             #t))
+         (add-before 'check 'setenv-check
+           (lambda _
+             (setenv "LYX_DIR_22x" (string-append (getcwd) "/../lyx-"
+                                                  ,version "/lib"))
+             #t))
+         (add-after 'install 'install-symlinks
+           (lambda* (#:key outputs #:allow-other-keys)
+             (let ((out (assoc-ref outputs "out")))
+               (mkdir-p (string-append out "/bin"))
+               (symlink "../lyx2.2/bin/lyx2.2"
+                (string-append out "/bin/lyx2.2"))
+               #t))))))
+    (inputs
+     `(("boost" ,boost)
+       ("hunspell" ,hunspell) ; Note: Could also use aspell instead.
+       ("libx11" ,libx11)
+       ("python-2" ,python-2)
+       ("qtbase" ,qtbase)
+       ("qtsvg" ,qtsvg)
+       ("zlib" ,zlib)))
+    (propagated-inputs
+     `(("texlive" ,texlive))) ; article.cls is in texmf-dist.
+    (native-inputs
+     `(("python-2" ,python-2)
+       ("pkg-config" ,pkg-config)
+       ("bc" ,bc)))
+    (home-page "http://www.lyx.org/")
+    (synopsis "Document preparation system with GUI")
+    (description "LyX is a document preparation system.  It excels at letting
+you create complex technical and scientific articles with mathematics,
+cross-references, bibliographies, indexes, etc.  It is very good for working
+with documents of any length in which the usual processing abilities are
+required: automatic sectioning and pagination, spell checking and so forth.")
+    (license license:gpl2+)))
-- 
cgit v1.2.3


From 929e2d9f984bbe841d712eb049abae9d83c3df74 Mon Sep 17 00:00:00 2001
From: Tobias Geerinckx-Rice <me@tobias.gr>
Date: Sat, 24 Mar 2018 21:05:55 +0100
Subject: gnu: links: Update to 2.15.

* gnu/packages/web-browsers.scm (links): Update to 2.15.
[source]: Remove patch for fixed CVE.
* gnu/packages/patches/links-CVE-2017-11114.patch: Delete file.
* gnu/local.mk (dist_patch_DATA): Remove it.
---
 gnu/local.mk                                    |  1 -
 gnu/packages/patches/links-CVE-2017-11114.patch | 99 -------------------------
 gnu/packages/web-browsers.scm                   |  7 +-
 3 files changed, 3 insertions(+), 104 deletions(-)
 delete mode 100644 gnu/packages/patches/links-CVE-2017-11114.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index 26d2369a5a..b810e7b02f 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -884,7 +884,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/lierolibre-newer-libconfig.patch		\
   %D%/packages/patches/lierolibre-remove-arch-warning.patch	\
   %D%/packages/patches/lierolibre-try-building-other-arch.patch	\
-  %D%/packages/patches/links-CVE-2017-11114.patch		\
   %D%/packages/patches/linux-pam-no-setfsuid.patch		\
   %D%/packages/patches/lirc-localstatedir.patch			\
   %D%/packages/patches/llvm-3.5-fix-clang-build-with-gcc5.patch	\
diff --git a/gnu/packages/patches/links-CVE-2017-11114.patch b/gnu/packages/patches/links-CVE-2017-11114.patch
deleted file mode 100644
index c5ac9884b5..0000000000
--- a/gnu/packages/patches/links-CVE-2017-11114.patch
+++ /dev/null
@@ -1,99 +0,0 @@
-Fix CVE-2017-11114:
-
-https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11114
-http://seclists.org/fulldisclosure/2017/Jul/76
-
-Patch copied from Debian:
-
-https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870299#12
-
-Origin: upstream, commit: fee5dca79a93a37024e494b985386a5fe60bc1b7
-Origin: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=870299#12
-Author: Mikulas Patocka <mikulas@twibright.com>
-Date:   Wed Aug 2 20:13:29 2017 +0200
-Subject: Fix read out of memory in case of corrupted UTF-8 data
-
----
- charsets.c |   37 +------------------------------------
- links.h    |    9 ++++-----
- 2 files changed, 5 insertions(+), 41 deletions(-)
-
-Index: links-2.14/charsets.c
-===================================================================
---- links-2.14.orig/charsets.c
-+++ links-2.14/charsets.c
-@@ -215,41 +215,6 @@ static struct conv_table *get_translatio
- 	return utf_table;
- }
- 
--unsigned short int utf8_2_uni_table[0x200] = {
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 128,	0, 0, 0, 192,	0,
--	0, 0, 256,	0, 0, 0, 320,	0, 0, 0, 384,	0, 0, 0, 448,	0,
--	0, 0, 512,	0, 0, 0, 576,	0, 0, 0, 640,	0, 0, 0, 704,	0,
--	0, 0, 768,	0, 0, 0, 832,	0, 0, 0, 896,	0, 0, 0, 960,	0,
--	0, 0, 1024,	0, 0, 0, 1088,	0, 0, 0, 1152,	0, 0, 0, 1216,	0,
--	0, 0, 1280,	0, 0, 0, 1344,	0, 0, 0, 1408,	0, 0, 0, 1472,	0,
--	0, 0, 1536,	0, 0, 0, 1600,	0, 0, 0, 1664,	0, 0, 0, 1728,	0,
--	0, 0, 1792,	0, 0, 0, 1856,	0, 0, 0, 1920,	0, 0, 0, 1984,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--	0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0, 0, 0, 0,	0,
--};
--
- unsigned char utf_8_1[256] = {
- 	6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
- 	7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7,
-@@ -269,7 +234,7 @@ unsigned char utf_8_1[256] = {
- 	3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 2, 2, 1, 1, 6, 6,
- };
- 
--static_const unsigned min_utf_8[9] = {
-+static_const unsigned min_utf_8[8] = {
- 	0, 0x4000000, 0x200000, 0x10000, 0x800, 0x80, 0x100, 0x1,
- };
- 
-Index: links-2.14/links.h
-===================================================================
---- links-2.14.orig/links.h
-+++ links-2.14/links.h
-@@ -3906,15 +3906,14 @@ unsigned char *cp_strchr(int charset, un
- void init_charset(void);
- 
- unsigned get_utf_8(unsigned char **p);
--extern unsigned short int utf8_2_uni_table[0x200];
- #define GET_UTF_8(s, c)							\
- do {									\
- 	if ((unsigned char)(s)[0] < 0x80)				\
- 		(c) = (s)++[0];						\
--	else if (((c) = utf8_2_uni_table[((unsigned char)(s)[0] << 2) +	\
--				((unsigned char)(s)[1] >> 6) - 0x200]))	\
--		(c) += (unsigned char)(s)[1] & 0x3f, (s) += 2;		\
--	else								\
-+	else if ((unsigned char)(s)[0] >= 0xc2 && (unsigned char)(s)[0] < 0xe0 &&\
-+	         ((unsigned char)(s)[1] & 0xc0) == 0x80) {		\
-+		(c) = (unsigned char)(s)[0] * 0x40 + (unsigned char)(s)[1], (c) -= 0x3080, (s) += 2;\
-+	} else								\
- 		(c) = get_utf_8(&(s));					\
- } while (0)
- #define FWD_UTF_8(s)							\
diff --git a/gnu/packages/web-browsers.scm b/gnu/packages/web-browsers.scm
index ef39d71411..6c929d326d 100644
--- a/gnu/packages/web-browsers.scm
+++ b/gnu/packages/web-browsers.scm
@@ -79,15 +79,14 @@ older or slower computers and embedded systems.")
 (define-public links
   (package
     (name "links")
-    (version "2.14")
+    (version "2.15")
     (source (origin
               (method url-fetch)
               (uri (string-append "http://links.twibright.com/download/"
                                   name "-" version ".tar.bz2"))
-              (patches (search-patches "links-CVE-2017-11114.patch"))
-              (sha256
+                (sha256
                (base32
-                "1f24y83wa1vzzjq5kp857gjqdpnmf8pb29yw7fam0m8wxxw0c3gp"))))
+                "1jp3xyvp87a188b4kg5ycqahrazj7928zncgsznzn54w8d5iqahy"))))
     (build-system gnu-build-system)
     (arguments
      `(#:phases
-- 
cgit v1.2.3


From 6cf2ac3cd6a42ded34814ac9120c7637cf3f8c7f Mon Sep 17 00:00:00 2001
From: Danny Milosavljevic <dannym@scratchpost.org>
Date: Sun, 25 Mar 2018 14:11:35 +0200
Subject: gnu: Add pure.

* gnu/packages/pure.scm: New file.
* gnu/local.mk (GNU_SYSTEM_MODULES): Add it.
---
 gnu/local.mk          |  1 +
 gnu/packages/pure.scm | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 gnu/packages/pure.scm

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index b810e7b02f..933649f43b 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -349,6 +349,7 @@ GNU_SYSTEM_MODULES =				\
   %D%/packages/pumpio.scm			\
   %D%/packages/pretty-print.scm			\
   %D%/packages/protobuf.scm			\
+  %D%/packages/pure.scm				\
   %D%/packages/pv.scm				\
   %D%/packages/python.scm			\
   %D%/packages/python-crypto.scm		\
diff --git a/gnu/packages/pure.scm b/gnu/packages/pure.scm
new file mode 100644
index 0000000000..b0fd93b39b
--- /dev/null
+++ b/gnu/packages/pure.scm
@@ -0,0 +1,68 @@
+;;; GNU Guix --- Functional package management for GNU
+;;; Copyright © 2018 Danny Milosavljevic <dannym@scratchpost.org>
+;;;
+;;; This file is part of GNU Guix.
+;;;
+;;; GNU Guix is free software; you can redistribute it and/or modify it
+;;; under the terms of the GNU General Public License as published by
+;;; the Free Software Foundation; either version 3 of the License, or (at
+;;; your option) any later version.
+;;;
+;;; GNU Guix is distributed in the hope that it will be useful, but
+;;; WITHOUT ANY WARRANTY; without even the implied warranty of
+;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;;; GNU General Public License for more details.
+;;;
+;;; You should have received a copy of the GNU General Public License
+;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
+
+(define-module (gnu packages pure)
+  #:use-module ((guix licenses) #:prefix license:)
+  #:use-module (guix packages)
+  #:use-module (guix download)
+  #:use-module (guix git-download)
+  #:use-module (guix utils)
+  #:use-module (guix build-system gnu)
+  #:use-module (guix gexp)
+  #:use-module (gnu packages)
+  #:use-module (gnu packages llvm)
+  #:use-module (gnu packages multiprecision))
+
+(define-public pure
+  (package
+    (name "pure")
+    (version "0.67")
+    (source
+     (origin
+       (method url-fetch)
+       (uri (string-append "https://github.com/agraef/pure-lang/releases/"
+                           "download/pure-" version "/"
+                           "pure-" version ".tar.gz"))
+       (sha256
+        (base32
+         "1hlx5dx6n70rbg668yc97yj4jbnrv0dpfw3l9b0ffmcgr76f6ba4"))))
+    (build-system gnu-build-system)
+    (arguments
+     `(#:make-flags (list (string-append "LDFLAGS=-Wl,-rpath="
+                                         (assoc-ref %outputs "out")
+                                         "/lib"))
+       #:phases
+       (modify-phases %standard-phases
+         (add-after 'unpack 'patch-llvm-lookup
+           (lambda _
+             (substitute* "configure"
+               (("-lLLVM-[$][{]llvm_version[}]")
+                "`$LLVMCONF --libs`"))
+             #t)))))
+    (inputs
+     `(("gmp" ,gmp)
+       ("llvm" ,llvm-3.5)
+       ("mpfr" ,mpfr)))
+    (home-page "https://agraef.github.io/pure-lang/")
+    (synopsis "Pure programming Language")
+    (description "@code{pure} is a programming language based on term
+rewriting.  It offers equational definitions with pattern matching,
+full symbolic rewriting capabilities, dynamic typing, eager and lazy
+evaluation, lexical closures, built-in list and matrix support and
+a C interface.")
+    (license license:gpl3+)))
-- 
cgit v1.2.3


From bab9793f54f055e814428fe6e312b0f80b629333 Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efraim@flashner.co.il>
Date: Mon, 26 Mar 2018 12:19:14 +0300
Subject: gnu: classpath: Add aarch64-linux support.

* gnu/packages/java.scm (classpath-bootstrap, classpath-0.99)[source]:
Add patch.
* gnu/packages/patches/classpath-aarch64-support.patch: New file.
* gnu/local.mk (dist_patch_DATA): Register it.
---
 gnu/local.mk                                       |  1 +
 gnu/packages/java.scm                              |  6 +++--
 .../patches/classpath-aarch64-support.patch        | 29 ++++++++++++++++++++++
 3 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 gnu/packages/patches/classpath-aarch64-support.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index 933649f43b..b1fe6122e0 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -594,6 +594,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/clang-3.8-libc-search-path.patch		\
   %D%/packages/patches/clang-runtime-asan-build-fixes.patch	\
   %D%/packages/patches/clang-runtime-esan-build-fixes.patch	\
+  %D%/packages/patches/classpath-aarch64-support.patch		\
   %D%/packages/patches/clementine-remove-crypto++-dependency.patch	\
   %D%/packages/patches/clementine-use-openssl.patch		\
   %D%/packages/patches/clisp-glibc-2.26.patch			\
diff --git a/gnu/packages/java.scm b/gnu/packages/java.scm
index 3248bebfc0..4a6172a8cc 100644
--- a/gnu/packages/java.scm
+++ b/gnu/packages/java.scm
@@ -129,7 +129,8 @@ and binary format defined in The Java Virtual Machine Specification.")
                                   version ".tar.gz"))
               (sha256
                (base32
-                "0i99wf9xd3hw1sj2sazychb9prx8nadxh2clgvk3zlmb28v0jbfz"))))
+                "0i99wf9xd3hw1sj2sazychb9prx8nadxh2clgvk3zlmb28v0jbfz"))
+              (patches (search-patches "classpath-aarch64-support.patch"))))
     (build-system gnu-build-system)
     (arguments
      `(#:configure-flags
@@ -424,7 +425,8 @@ the standard javac executable.")))
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1j7cby4k66f1nvckm48xcmh352b1d1b33qk7l6hi7dp9i9zjjagr"))))
+                "1j7cby4k66f1nvckm48xcmh352b1d1b33qk7l6hi7dp9i9zjjagr"))
+              (patches (search-patches "classpath-aarch64-support.patch"))))
     (arguments
      `(#:configure-flags
        (list (string-append "--with-ecj-jar="
diff --git a/gnu/packages/patches/classpath-aarch64-support.patch b/gnu/packages/patches/classpath-aarch64-support.patch
new file mode 100644
index 0000000000..6fdac0c4fb
--- /dev/null
+++ b/gnu/packages/patches/classpath-aarch64-support.patch
@@ -0,0 +1,29 @@
+This is modeled after the ia64 support. Aarch64 can be either big endian
+or little endian, so we add the case for both.
+
+---
+ native/fdlibm/ieeefp.h | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+diff --git a/native/fdlibm/ieeefp.h b/native/fdlibm/ieeefp.h
+index 1a9740f..73455c0 100644
+--- a/native/fdlibm/ieeefp.h
++++ b/native/fdlibm/ieeefp.h
+@@ -27,6 +27,14 @@
+ #endif
+ #endif
+ 
++#ifdef __aarch64__
++#ifdef __BIG_ENDIAN__
++#define __IEEE_BIG_ENDIAN
++#else
++#define __IEEE_LITTLE_ENDIAN
++#endif
++#endif
++
+ #ifdef __hppa__
+ #define __IEEE_BIG_ENDIAN
+ #endif
+-- 
+2.16.3
+
-- 
cgit v1.2.3


From d2c036557adb5146e70096f9a54bba898ecdc00f Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludovic.courtes@inria.fr>
Date: Mon, 26 Mar 2018 18:03:57 +0200
Subject: gnu: hwloc@2: Update to 2.0.1.

* gnu/packages/mpi.scm (hwloc-2.0): Update to 2.0.1.
[source]: Remove 'patches'.
* gnu/packages/patches/hwloc-tests-without-sysfs.patch: Remove.
* gnu/local.mk (dist_patch_DATA): Adjust accordingly.
---
 gnu/local.mk                                       |  1 -
 gnu/packages/mpi.scm                               |  5 ++-
 .../patches/hwloc-tests-without-sysfs.patch        | 42 ----------------------
 3 files changed, 2 insertions(+), 46 deletions(-)
 delete mode 100644 gnu/packages/patches/hwloc-tests-without-sysfs.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index b1fe6122e0..e5c8bcfb78 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -781,7 +781,6 @@ dist_patch_DATA =						\
   %D%/packages/patches/htop-fix-process-tree.patch		\
   %D%/packages/patches/hubbub-sort-entities.patch		\
   %D%/packages/patches/hurd-fix-eth-multiplexer-dependency.patch        \
-  %D%/packages/patches/hwloc-tests-without-sysfs.patch		\
   %D%/packages/patches/hydra-disable-darcs-test.patch		\
   %D%/packages/patches/icecat-avoid-bundled-libraries.patch	\
   %D%/packages/patches/icecat-use-system-graphite2.patch	\
diff --git a/gnu/packages/mpi.scm b/gnu/packages/mpi.scm
index 9c2f44dac4..99c09fb267 100644
--- a/gnu/packages/mpi.scm
+++ b/gnu/packages/mpi.scm
@@ -117,7 +117,7 @@ bind processes, and much more.")
   ;; Note: 2.0 isn't the default yet, see above.
   (package
     (inherit hwloc)
-    (version "2.0.0")
+    (version "2.0.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "https://www.open-mpi.org/software/hwloc/v"
@@ -125,8 +125,7 @@ bind processes, and much more.")
                                   "/downloads/hwloc-" version ".tar.bz2"))
               (sha256
                (base32
-                "021765f9y6pxcxrvfpzzwaig16ypfbph5xjpkd29qkhzs9r6zrcr"))
-              (patches (search-patches "hwloc-tests-without-sysfs.patch"))))
+                "0jf0krj1h95flmb784ifv9vnkdnajjz00p4zbhmja7vm4v67axdr"))))
 
     ;; libnuma is no longer needed.
     (inputs (alist-delete "numactl" (package-inputs hwloc)))))
diff --git a/gnu/packages/patches/hwloc-tests-without-sysfs.patch b/gnu/packages/patches/hwloc-tests-without-sysfs.patch
deleted file mode 100644
index ea6ec41616..0000000000
--- a/gnu/packages/patches/hwloc-tests-without-sysfs.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-Fix a test failure in the build environment, where /sys is missing.
-From <https://github.com/bgoglin/hwloc/commit/a2cc4f2e2bf4a8bbdd61b578a62e27e7482799cf.patch>.
-
-From a2cc4f2e2bf4a8bbdd61b578a62e27e7482799cf Mon Sep 17 00:00:00 2001
-From: Brice Goglin <Brice.Goglin@inria.fr>
-Date: Tue, 6 Feb 2018 17:13:26 +0100
-Subject: [PATCH] linux: honor the filtering cores and packages when reading
- topology from cpuinfo
-
-Caused a make check crash in lstopo --filter all:none in chroot without sysfs.
-
-Thanks to Ludovic Courtes for the report.
-
-Signed-off-by: Brice Goglin <Brice.Goglin@inria.fr>
----
- hwloc/topology-linux.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/hwloc/topology-linux.c b/hwloc/topology-linux.c
-index 290da0d72..e1bbf94e1 100644
---- a/hwloc/topology-linux.c
-+++ b/hwloc/topology-linux.c
-@@ -4101,7 +4101,8 @@ look_cpuinfo(struct hwloc_topology *topology,
-     }
-   /* create package objects */
-   hwloc_debug("%u pkgs%s\n", numpkgs, missingpkg ? ", but some missing package" : "");
--  if (!missingpkg && numpkgs>0) {
-+  if (!missingpkg && numpkgs>0
-+      && hwloc_filter_check_keep_object_type(topology, HWLOC_OBJ_PACKAGE)) {
-     for (i = 0; i < numpkgs; i++) {
-       struct hwloc_obj *obj = hwloc_alloc_setup_object(topology, HWLOC_OBJ_PACKAGE, Lpkg_to_Ppkg[i]);
-       int doneinfos = 0;
-@@ -4145,7 +4146,8 @@ look_cpuinfo(struct hwloc_topology *topology,
-     }
-   /* create Core objects */
-   hwloc_debug("%u cores%s\n", numcores, missingcore ? ", but some missing core" : "");
--  if (!missingcore && numcores>0) {
-+  if (!missingcore && numcores>0
-+      && hwloc_filter_check_keep_object_type(topology, HWLOC_OBJ_CORE)) {
-     for (i = 0; i < numcores; i++) {
-       struct hwloc_obj *obj = hwloc_alloc_setup_object(topology, HWLOC_OBJ_CORE, Lcore_to_Pcore[i]);
-       obj->cpuset = hwloc_bitmap_alloc();
-- 
cgit v1.2.3


From 196c8b3739d16241da73c78536ce86aaab948677 Mon Sep 17 00:00:00 2001
From: Oleg Pykhalov <go.wigust@gmail.com>
Date: Sun, 25 Mar 2018 11:40:44 +0300
Subject: gnu: translate-shell: Update to 0.9.6.7.

* gnu/packages/patches/translate-shell-fix-curl-tests.patch: New file.
* gnu/local.mk (dist_patch_DATA): Add it.
* gnu/packages/dictionaries.scm (translate-shell): Update to 0.9.6.7.
[source](patches): Add it.  [home-page]: Append slash.
---
 gnu/local.mk                                       |  1 +
 gnu/packages/dictionaries.scm                      | 11 ++--
 .../patches/translate-shell-fix-curl-tests.patch   | 60 ++++++++++++++++++++++
 3 files changed, 68 insertions(+), 4 deletions(-)
 create mode 100644 gnu/packages/patches/translate-shell-fix-curl-tests.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index e5c8bcfb78..284161fe8a 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -1117,6 +1117,7 @@ dist_patch_DATA =						\
   %D%/packages/patches/tipp10-fix-compiling.patch		\
   %D%/packages/patches/tipp10-remove-license-code.patch		\
   %D%/packages/patches/tk-find-library.patch			\
+  %D%/packages/patches/translate-shell-fix-curl-tests.patch	\
   %D%/packages/patches/ttf2eot-cstddef.patch			\
   %D%/packages/patches/ttfautohint-source-date-epoch.patch	\
   %D%/packages/patches/tophat-build-with-later-seqan.patch	\
diff --git a/gnu/packages/dictionaries.scm b/gnu/packages/dictionaries.scm
index 3f50070ef7..85979ba096 100644
--- a/gnu/packages/dictionaries.scm
+++ b/gnu/packages/dictionaries.scm
@@ -27,6 +27,7 @@
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system python)
   #:use-module (guix build-system trivial)
+  #:use-module (gnu packages)
   #:use-module (gnu packages base)
   #:use-module (gnu packages curl)
   #:use-module (gnu packages emacs)
@@ -239,7 +240,7 @@ and a Python library.")
 (define-public translate-shell
   (package
     (name "translate-shell")
-    (version "0.9.6.4")
+    (version "0.9.6.7")
     (source
       (origin
         (method url-fetch)
@@ -247,7 +248,8 @@ and a Python library.")
                             version ".tar.gz"))
         (sha256
          (base32
-          "1fg6nf1plvgimc57fsdr9rcjbf7jvmk5jrlj5ya509vpdcdgvj2s"))
+          "0inv6r3qbihn2ff1sgcly89r04k4vgcbvvyl50ln0mxlapbhpy95"))
+        (patches (search-patches "translate-shell-fix-curl-tests.patch"))
         (file-name (string-append name "-" version ".tar.gz"))))
     (build-system gnu-build-system)
     (arguments
@@ -261,7 +263,8 @@ and a Python library.")
                     (emacs (string-append (assoc-ref inputs "emacs") "/bin/emacs")))
                (install-file "google-translate-mode.el" dest)
                (emacs-generate-autoloads ,name dest)))))
-       #:make-flags (list (string-append "PREFIX=" %output))
+       #:make-flags (list (string-append "PREFIX=" %output)
+                          "NETWORK_ACCESS=no test")
        #:imported-modules (,@%gnu-build-system-modules (guix build emacs-utils))
        #:modules ((guix build gnu-build-system)
                   (guix build emacs-utils)
@@ -274,7 +277,7 @@ and a Python library.")
     (native-inputs
      `(("emacs" ,emacs-minimal)
        ("util-linux" ,util-linux))) ; hexdump, for the test
-    (home-page "https://www.soimort.org/translate-shell")
+    (home-page "https://www.soimort.org/translate-shell/")
     (synopsis "Translations from the command line")
     (description
      "Translate Shell (formerly Google Translate CLI) is a command-line
diff --git a/gnu/packages/patches/translate-shell-fix-curl-tests.patch b/gnu/packages/patches/translate-shell-fix-curl-tests.patch
new file mode 100644
index 0000000000..33731462b8
--- /dev/null
+++ b/gnu/packages/patches/translate-shell-fix-curl-tests.patch
@@ -0,0 +1,60 @@
+This patch fixes Curl related tests for 'translate-shell'.
+
+Upstream bug URL:
+
+https://github.com/soimort/translate-shell/issues/221
+
+From bb9f32d3145125ba664b6b05bf0a2fd34108e9d2 Mon Sep 17 00:00:00 2001
+From: Mort Yao <soi@mort.ninja>
+Date: Sun, 25 Mar 2018 03:14:33 +0200
+Subject: [PATCH] TestUtils: perform curl-related tests only if NETWORK_ACCESS
+ is set to yes (#221)
+
+---
+ test/TestUtils.awk | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+diff --git a/test/TestUtils.awk b/test/TestUtils.awk
+index 08bb2e9..1c141e5 100644
+--- a/test/TestUtils.awk
++++ b/test/TestUtils.awk
+@@ -30,22 +30,24 @@ BEGIN {
+         assertTrue(newerVersion("2", "1.9.9999"))
+     }
+ 
+-    T("curl()", 1)
+-    {
+-        delete tokens; delete ast
+-        tokenize(tokens, curl("https://httpbin.org/get"))
+-        parseJson(ast, tokens)
+-        assertEqual(unparameterize(ast[0 SUBSEP "url"]),
+-                    "https://httpbin.org/get")
+-    }
++    if (yn(ENVIRON["NETWORK_ACCESS"])) { # if network access enabled
++        T("curl()", 1)
++        {
++            delete tokens; delete ast
++            tokenize(tokens, curl("https://httpbin.org/get"))
++            parseJson(ast, tokens)
++            assertEqual(unparameterize(ast[0 SUBSEP "url"]),
++                        "https://httpbin.org/get")
++        }
+ 
+-    T("curlPost()", 1)
+-    {
+-        delete tokens; delete ast
+-        tokenize(tokens, curlPost("https://httpbin.org/post", "fizz=buzz"))
+-        parseJson(ast, tokens)
+-        assertEqual(unparameterize(ast[0 SUBSEP "url"]),
+-                    "https://httpbin.org/post")
++        T("curlPost()", 1)
++        {
++            delete tokens; delete ast
++            tokenize(tokens, curlPost("https://httpbin.org/post", "fizz=buzz"))
++            parseJson(ast, tokens)
++            assertEqual(unparameterize(ast[0 SUBSEP "url"]),
++                        "https://httpbin.org/post")
++        }
+     }
+ 
+     T("dump()", 3)
-- 
cgit v1.2.3


From 4d99a3215c1cb3eda1e9f1159e6fb87915d7390a Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Tue, 27 Mar 2018 18:59:20 -0400
Subject: gnu: mupdf: Fix CVE-2018-{6544,1000051}.

* gnu/packages/patches/mupdf-CVE-2018-1000051.patch,
gnu/packages/patches/mupdf-CVE-2018-6544.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/pdf.scm (mupdf)[source]: Use them.
---
 gnu/local.mk                                      |   2 +
 gnu/packages/patches/mupdf-CVE-2018-1000051.patch |  88 +++++++++++++++++
 gnu/packages/patches/mupdf-CVE-2018-6544.patch    | 109 ++++++++++++++++++++++
 gnu/packages/pdf.scm                              |   4 +-
 4 files changed, 202 insertions(+), 1 deletion(-)
 create mode 100644 gnu/packages/patches/mupdf-CVE-2018-1000051.patch
 create mode 100644 gnu/packages/patches/mupdf-CVE-2018-6544.patch

(limited to 'gnu/local.mk')

diff --git a/gnu/local.mk b/gnu/local.mk
index 284161fe8a..0575a2fe32 100644
--- a/gnu/local.mk
+++ b/gnu/local.mk
@@ -929,6 +929,8 @@ dist_patch_DATA =						\
   %D%/packages/patches/mumps-build-parallelism.patch		\
   %D%/packages/patches/mupdf-build-with-latest-openjpeg.patch	\
   %D%/packages/patches/mupdf-CVE-2017-17858.patch		\
+  %D%/packages/patches/mupdf-CVE-2018-6544.patch		\
+  %D%/packages/patches/mupdf-CVE-2018-1000051.patch		\
   %D%/packages/patches/mupen64plus-ui-console-notice.patch	\
   %D%/packages/patches/mutt-store-references.patch		\
   %D%/packages/patches/net-tools-bitrot.patch			\
diff --git a/gnu/packages/patches/mupdf-CVE-2018-1000051.patch b/gnu/packages/patches/mupdf-CVE-2018-1000051.patch
new file mode 100644
index 0000000000..bb78c46f80
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2018-1000051.patch
@@ -0,0 +1,88 @@
+Fix CVE-2018-1000051:
+
+https://bugs.ghostscript.com/show_bug.cgi?id=698873
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000051
+
+Patch copied from upstream source repository:
+
+https://git.ghostscript.com/?p=mupdf.git;a=commit;h=321ba1de287016b0036bf4a56ce774ad11763384
+
+From 321ba1de287016b0036bf4a56ce774ad11763384 Mon Sep 17 00:00:00 2001
+From: Sebastian Rasmussen <sebras@gmail.com>
+Date: Tue, 19 Dec 2017 23:47:47 +0100
+Subject: [PATCH] Bug 698825: Do not drop borrowed colorspaces.
+
+Previously the borrowed colorspace was dropped when updating annotation
+appearances, leading to use after free warnings from valgrind/ASAN.
+---
+ source/pdf/pdf-appearance.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+diff --git a/source/pdf/pdf-appearance.c b/source/pdf/pdf-appearance.c
+index 70f684f4..d7a1dddd 100644
+--- a/source/pdf/pdf-appearance.c
++++ b/source/pdf/pdf-appearance.c
+@@ -2170,7 +2170,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 	fz_device *dev = NULL;
+ 	font_info font_rec;
+ 	fz_text *text = NULL;
+-	fz_colorspace *cs = NULL;
+ 	fz_matrix page_ctm;
+ 
+ 	pdf_page_transform(ctx, annot->page, NULL, &page_ctm);
+@@ -2184,11 +2183,11 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 	fz_var(dlist);
+ 	fz_var(dev);
+ 	fz_var(text);
+-	fz_var(cs);
+ 	fz_try(ctx)
+ 	{
+ 		char *contents = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_Contents));
+ 		char *da = pdf_to_str_buf(ctx, pdf_dict_get(ctx, obj, PDF_NAME_DA));
++		fz_colorspace *cs;
+ 		fz_point pos;
+ 		fz_rect rect;
+ 
+@@ -2223,7 +2222,6 @@ void pdf_update_free_text_annot_appearance(fz_context *ctx, pdf_document *doc, p
+ 		fz_drop_display_list(ctx, dlist);
+ 		font_info_fin(ctx, &font_rec);
+ 		fz_drop_text(ctx, text);
+-		fz_drop_colorspace(ctx, cs);
+ 	}
+ 	fz_catch(ctx)
+ 	{
+@@ -2359,7 +2357,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 	fz_device *dev = NULL;
+ 	font_info font_rec;
+ 	fz_text *text = NULL;
+-	fz_colorspace *cs = NULL;
+ 	fz_path *path = NULL;
+ 	fz_buffer *fzbuf = NULL;
+ 	fz_matrix page_ctm;
+@@ -2375,7 +2372,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 	fz_var(dlist);
+ 	fz_var(dev);
+ 	fz_var(text);
+-	fz_var(cs);
+ 	fz_var(fzbuf);
+ 	fz_try(ctx)
+ 	{
+@@ -2384,6 +2380,7 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 		fz_rect logo_bounds;
+ 		fz_matrix logo_tm;
+ 		fz_rect rect;
++		fz_colorspace *cs = fz_device_rgb(ctx); /* Borrowed reference */
+ 
+ 		pdf_to_rect(ctx, pdf_dict_get(ctx, annot->obj, PDF_NAME_Rect), &annot_rect);
+ 		rect = annot_rect;
+@@ -2396,7 +2393,6 @@ void pdf_set_signature_appearance(fz_context *ctx, pdf_document *doc, pdf_annot
+ 		fz_bound_path(ctx, path, NULL, &fz_identity, &logo_bounds);
+ 		center_rect_within_rect(&logo_bounds, &rect, &logo_tm);
+ 		fz_concat(&logo_tm, &logo_tm, &page_ctm);
+-		cs = fz_device_rgb(ctx); /* Borrowed reference */
+ 		fz_fill_path(ctx, dev, path, 0, &logo_tm, cs, logo_color, 1.0f, NULL);
+ 
+ 		get_font_info(ctx, doc, dr, da, &font_rec);
+-- 
+2.16.3
+
diff --git a/gnu/packages/patches/mupdf-CVE-2018-6544.patch b/gnu/packages/patches/mupdf-CVE-2018-6544.patch
new file mode 100644
index 0000000000..b2c8f849f3
--- /dev/null
+++ b/gnu/packages/patches/mupdf-CVE-2018-6544.patch
@@ -0,0 +1,109 @@
+Fix CVE-2018-6544:
+
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6544
+https://bugs.ghostscript.com/show_bug.cgi?id=698830
+https://bugs.ghostscript.com/show_bug.cgi?id=698965 
+
+Patches copied from upstream source repository:
+
+https://git.ghostscript.com/?p=mupdf.git;h=26527eef77b3e51c2258c8e40845bfbc015e405d
+https://git.ghostscript.com/?p=mupdf.git;h=b03def134988da8c800adac1a38a41a1f09a1d89
+
+From b03def134988da8c800adac1a38a41a1f09a1d89 Mon Sep 17 00:00:00 2001
+From: Sebastian Rasmussen <sebras@gmail.com>
+Date: Thu, 1 Feb 2018 16:36:14 +0100
+Subject: [PATCH] Bug 698830: Avoid recursion when loading object streams
+ objects.
+
+If there were indirect references in the object stream dictionary and
+one of those indirect references referred to an object inside the object
+stream itself, mupdf would previously enter recursion only bounded by the
+exception stack. After this commit the object stream is checked if it is
+marked immediately after being loaded. If it is marked then we terminate
+the recursion at this point, if it is not marked then mark it and
+attempt to load the desired object within. We also take care to unmark
+the stream object when done or upon exception.
+---
+ source/pdf/pdf-xref.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/source/pdf/pdf-xref.c b/source/pdf/pdf-xref.c
+index 723b543c..ed09094c 100644
+--- a/source/pdf/pdf-xref.c
++++ b/source/pdf/pdf-xref.c
+@@ -1576,6 +1576,19 @@ pdf_load_obj_stm(fz_context *ctx, pdf_document *doc, int num, pdf_lexbuf *buf, i
+ 	{
+ 		objstm = pdf_load_object(ctx, doc, num);
+ 
++		if (pdf_obj_marked(ctx, objstm))
++			fz_throw(ctx, FZ_ERROR_GENERIC, "recursive object stream lookup");
++	}
++	fz_catch(ctx)
++	{
++		pdf_drop_obj(ctx, objstm);
++		fz_rethrow(ctx);
++	}
++
++	fz_try(ctx)
++	{
++		pdf_mark_obj(ctx, objstm);
++
+ 		count = pdf_to_int(ctx, pdf_dict_get(ctx, objstm, PDF_NAME_N));
+ 		first = pdf_to_int(ctx, pdf_dict_get(ctx, objstm, PDF_NAME_First));
+ 
+@@ -1655,6 +1668,7 @@ pdf_load_obj_stm(fz_context *ctx, pdf_document *doc, int num, pdf_lexbuf *buf, i
+ 		fz_drop_stream(ctx, stm);
+ 		fz_free(ctx, ofsbuf);
+ 		fz_free(ctx, numbuf);
++		pdf_unmark_obj(ctx, objstm);
+ 		pdf_drop_obj(ctx, objstm);
+ 	}
+ 	fz_catch(ctx)
+-- 
+2.16.3
+
+From 26527eef77b3e51c2258c8e40845bfbc015e405d Mon Sep 17 00:00:00 2001
+From: Sebastian Rasmussen <sebras@gmail.com>
+Date: Mon, 29 Jan 2018 02:00:48 +0100
+Subject: [PATCH] Bug 698830: Don't drop unkept stream if running out of error
+ stack.
+
+Under normal conditions where fz_keep_stream() is called inside
+fz_try() we may call fz_drop_stream() in fz_catch() upon exceptions.
+The issue comes when fz_keep_stream() has not yet been called but is
+dropped in fz_catch(). This happens in the PDF from the bug when
+fz_try() runs out of exception stack, and next the code in fz_catch()
+runs, dropping the caller's reference to the filter chain stream!
+
+The simplest way of fixing this it to always keep the filter chain
+stream before fz_try() is called. That way fz_catch() may drop the
+stream whether an exception has occurred or if the fz_try() ran out of
+exception stack.
+---
+ source/pdf/pdf-stream.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/source/pdf/pdf-stream.c b/source/pdf/pdf-stream.c
+index c89da5c4..c6ba7ad3 100644
+--- a/source/pdf/pdf-stream.c
++++ b/source/pdf/pdf-stream.c
+@@ -303,14 +303,13 @@ pdf_open_raw_filter(fz_context *ctx, fz_stream *chain, pdf_document *doc, pdf_ob
+ 		*orig_gen = 0;
+ 	}
+ 
+-	fz_var(chain);
++	chain = fz_keep_stream(ctx, chain);
+ 
+ 	fz_try(ctx)
+ 	{
+ 		len = pdf_to_int(ctx, pdf_dict_get(ctx, stmobj, PDF_NAME_Length));
+ 
+-		/* don't close chain when we close this filter */
+-		chain2 = fz_keep_stream(ctx, chain);
++		chain2 = chain;
+ 		chain = NULL;
+ 		chain = fz_open_null(ctx, chain2, len, offset);
+ 
+-- 
+2.16.3
+
diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index a5d57cd5ec..84b53b00b4 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -574,7 +574,9 @@ extracting content or merging files.")
         (uri (string-append "https://mupdf.com/downloads/archive/"
                             name "-" version "-source.tar.xz"))
         (patches (search-patches "mupdf-build-with-latest-openjpeg.patch"
-                                 "mupdf-CVE-2017-17858.patch"))
+                                 "mupdf-CVE-2017-17858.patch"
+                                 "mupdf-CVE-2018-6544.patch"
+                                 "mupdf-CVE-2018-1000051.patch"))
         (sha256
          (base32
           "0b9j0gqbc3jhmx87r6idcsh8lnb30840c3hyx6dk2gdjqqh3hysp"))
-- 
cgit v1.2.3