gnu: mupdf: Fix CVE-2016-{10132,10133} in bundled mujs.

* gnu/packages/patches/mupdf-mujs-CVE-2016-10132.patch,
gnu/packages/patches/mupdf-mujs-CVE-2016-10133.patch: New files.
* gnu/local.mk (dist_patch_DATA): Add them.
* gnu/packages/pdf.scm (mupdf)[replacement]: New field.
(mupdf/fixed): New variable.

Co-authored-by: Leo Famulari <[email protected]>

1 files changed, 15 insertions, 1 deletions

diff --git a/gnu/packages/pdf.scm b/gnu/packages/pdf.scm
index 9b3571e67b..5e1c0db51e 100644
--- a/gnu/packages/pdf.scm
+++ b/gnu/packages/pdf.scm
@@ -6,10 +6,11 @@
 ;;; Copyright © 2016 Roel Janssen <[email protected]>
 ;;; Coypright © 2016 ng0 <[email protected]>
 ;;; Coypright © 2016 Efraim Flashner <[email protected]>
-;;; Coypright © 2016 Marius Bakke <[email protected]>
+;;; Coypright © 2016, 2017 Marius Bakke <[email protected]>
 ;;; Coypright © 2016 Ludovic Courtès <[email protected]>
 ;;; Coypright © 2016 Julien Lepiller <[email protected]>
 ;;; Copyright © 2016 Arun Isaac <[email protected]>
+;;; Copyright © 2017 Leo Famulari <[email protected]>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -480,6 +481,7 @@ extracting content or merging files.")
 (define-public mupdf
   (package
     (name "mupdf")
+    (replacement mupdf/fixed)
     (version "1.10a")
     (source
       (origin
@@ -538,6 +540,18 @@ line tools for batch rendering (pdfdraw), rewriting files (pdfclean),
 and examining the file structure (pdfshow).")
     (license license:agpl3+)))
 
+(define mupdf/fixed
+  (package
+    (inherit mupdf)
+    (source
+      (origin
+        (inherit (package-source mupdf))
+        (patches
+          (append
+            (origin-patches (package-source mupdf))
+            (search-patches "mupdf-mujs-CVE-2016-10132.patch"
+                            "mupdf-mujs-CVE-2016-10133.patch")))))))
+
 (define-public qpdf
   (package
    (name "qpdf")