libtiff: pull (mostly) security patches from Arch

Also enable lzma support and check phase.

pkgs/development/libraries/libtiff/default.nix

@@ -1,7 +1,13 @@
-{ stdenv, fetchurl, zlib, libjpeg }:
+{ stdenv, fetchurl, fetchsvn, pkgconfig, zlib, libjpeg, xz }:
-
-let version = "4.0.3"; in
 
+let
+  version = "4.0.3";
+  patchDir = fetchsvn {
+    url = svn://svn.archlinux.org/packages/libtiff/trunk;
+    rev = "198247";
+    sha256 = "0a47l0zkc1zz7wxg64cyjv9z1djdvfyxgmwd03znlsac4zijkcy4";
+  };
+in
 stdenv.mkDerivation rec {
   name = "libtiff-${version}";
 
@@ -13,10 +19,27 @@ stdenv.mkDerivation rec {
     sha256 = "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa";
   };
 
-  propagatedBuildInputs = [ zlib libjpeg ];
+  patchPhase = ''
+    for p in ${patchDir}/*-{2013-4244,2012-4447,2012-4564,2013-1960,2013-1961,libjpeg-turbo}.patch; do
+      patch -p1 < "$p"
+    done
+    (
+    cd tools
+    for p in ${patchDir}/*-CVE-{2013-4231,2013-4232}.patch; do
+      patch -p0 < "$p"
+    done
+    )
+    patch -p0 < ${patchDir}/*-tiff2pdf-colors.patch
+  '';
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  propagatedBuildInputs = [ zlib libjpeg xz ]; #TODO: opengl support (bogus configure detection)
 
   enableParallelBuilding = true;
 
+  doCheck = true;
+
   meta = {
     description = "Library and utilities for working with the TIFF image file format";
     homepage = http://www.remotesensing.org/libtiff/;