[bug#27937] Update php to 7.1.8

[Julien Lepiller <julien@lepiller.eu>]

[-- Attachment #1: Type: text/plain, Size: 787 bytes --]

Le Fri, 4 Aug 2017 11:01:38 -0400,
Leo Famulari <leo@famulari.name> a écrit :
 
> 
> Okay, I'll look into it this weekend, unless somebody beats me to it.
> 
> Next time there are lots of Guix people gathered together, I want to
> hold some kind of "security updates workshop", with the goal of
> helping more people feel comfortable working in this area.
> 
> For gd in particular, if you have some specific questions, I can
> answer them over email. Surely more people have questions, too. The
> discussion could result in improvements to the manual's section on
> this topic.
> 

Hi,

I think this patch fixes gd correctly. I think I'm supposed to
also make a patch for core-updates with the new gd for rebuilds to
occur in that branch, right? How do I proceed?

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #2: 0001-gnu-gd-Fix-CVE-2017-7890.patch --]
[-- Type: text/x-patch, Size: 1330 bytes --]

From 828b7458582cd6fae0e7dd2375315b6b52149554 Mon Sep 17 00:00:00 2001
From: Julien Lepiller <julien@lepiller.eu>
Date: Sat, 5 Aug 2017 09:46:13 +0200
Subject: [PATCH] gnu: gd: Fix CVE-2017-7890.

* gnu/packages/gd.scm (gd)[replacement]: New field.
(gd/fixed): New variable.
---
 gnu/packages/gd.scm | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/gnu/packages/gd.scm b/gnu/packages/gd.scm
index aac0f9664..48db1b247 100644
--- a/gnu/packages/gd.scm
+++ b/gnu/packages/gd.scm
@@ -37,6 +37,7 @@
 (define-public gd
   (package
     (name "gd")
+    (replacement gd/fixed)
 
     ;; Note: With libgd.org now pointing to github.com, genuine old
     ;; tarballs are no longer available.  Notably, versions 2.0.x are
@@ -93,6 +94,16 @@ most common applications of GD involve website development.")
                            "See COPYING file in the distribution."))
     (properties '((cpe-name . "libgd")))))
 
+(define-public gd/fixed
+  (package
+    (inherit gd)
+    (source (origin
+             (inherit (package-source gd))
+             (patches 
+               (append
+                 (origin-patches (package-source gd))
+                 (search-patches "gd-CVE-2017-7890.patch")))))))
+
 (define-public perl-gd
   (package
     (name "perl-gd")
-- 
2.13.4