summary refs log tree commit diff
diff options
context:
space:
mode:
-rw-r--r--build-aux/hydra/gnu-system.scm2
-rw-r--r--gnu-system.am29
-rw-r--r--gnu/packages/base.scm33
-rw-r--r--gnu/packages/bison.scm4
-rw-r--r--gnu/packages/commencement.scm51
-rw-r--r--gnu/packages/cpio.scm14
-rw-r--r--gnu/packages/cross-base.scm204
-rw-r--r--gnu/packages/databases.scm4
-rw-r--r--gnu/packages/flex.scm2
-rw-r--r--gnu/packages/gawk.scm4
-rw-r--r--gnu/packages/gcc.scm44
-rw-r--r--gnu/packages/gettext.scm3
-rw-r--r--gnu/packages/glib.scm1
-rw-r--r--gnu/packages/gnome.scm1
-rw-r--r--gnu/packages/image.scm21
-rw-r--r--gnu/packages/jemalloc.scm8
-rw-r--r--gnu/packages/ld-wrapper.in12
-rw-r--r--gnu/packages/linux.scm25
-rw-r--r--gnu/packages/make-bootstrap.scm22
-rw-r--r--gnu/packages/maths.scm4
-rw-r--r--gnu/packages/mp3.scm8
-rw-r--r--gnu/packages/nettle.scm6
-rw-r--r--gnu/packages/ocaml.scm2
-rw-r--r--gnu/packages/openssl.scm4
-rw-r--r--gnu/packages/patches/cpio-fix-symlink-bad-length-test.patch44
-rw-r--r--gnu/packages/patches/findutils-localstatedir.patch14
-rw-r--r--gnu/packages/patches/gawk-shell.patch18
-rw-r--r--gnu/packages/patches/gcc-arm-link-spec-fix.patch4
-rw-r--r--gnu/packages/patches/gettext-msgunfmt.patch58
-rw-r--r--gnu/packages/patches/gsl-poly-test-fix-pt1.patch84
-rw-r--r--gnu/packages/patches/gsl-poly-test-fix-pt2.patch27
-rw-r--r--gnu/packages/patches/guile-linux-syscalls.patch12
-rw-r--r--gnu/packages/patches/libtiff-CVE-2012-4564.patch33
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-1960.patch148
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-1961.patch770
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-4231.patch19
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-4232.patch20
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-4243.patch39
-rw-r--r--gnu/packages/patches/libtiff-CVE-2013-4244.patch20
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch30
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch42
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch45
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch295
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch32
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch83
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch34
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch77
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch16
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-8129.patch45
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-9330.patch47
-rw-r--r--gnu/packages/patches/libtiff-CVE-2014-9655.patch88
-rw-r--r--gnu/packages/patches/mdadm-gcc-4.9-fix.patch38
-rw-r--r--gnu/packages/patches/patch-hurd-path-max.patch48
-rw-r--r--gnu/packages/patches/sed-hurd-path-max.patch34
-rw-r--r--gnu/packages/patches/tar-d_ino_in_dirent-fix.patch33
-rw-r--r--gnu/packages/patches/tar-skip-unreliable-tests.patch32
-rw-r--r--gnu/packages/perl.scm55
-rw-r--r--gnu/packages/unrtf.scm46
-rw-r--r--gnu/packages/xml.scm58
-rw-r--r--guix/packages.scm12
60 files changed, 2737 insertions, 271 deletions
diff --git a/build-aux/hydra/gnu-system.scm b/build-aux/hydra/gnu-system.scm
index 83cc6fb177..556dd7ac2e 100644
--- a/build-aux/hydra/gnu-system.scm
+++ b/build-aux/hydra/gnu-system.scm
@@ -101,7 +101,7 @@ SYSTEM."
   ;; Note: Don't put the '-final' package variants because (1) that's
   ;; implicit, and (2) they cannot be cross-built (due to the explicit input
   ;; chain.)
-  (list gcc-4.8 gcc-4.7 glibc binutils
+  (list gcc-4.8 gcc-4.9 gcc-5.1 glibc binutils
         gmp mpfr mpc coreutils findutils diffutils patch sed grep
         gawk gnu-gettext hello guile-2.0 zlib gzip xz
         %bootstrap-binaries-tarball
diff --git a/gnu-system.am b/gnu-system.am
index c061747cd7..a420d71a2f 100644
--- a/gnu-system.am
+++ b/gnu-system.am
@@ -403,6 +403,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/cpio-CVE-2014-9112-pt3.patch		\
   gnu/packages/patches/cpio-CVE-2014-9112-pt4.patch		\
   gnu/packages/patches/cpio-CVE-2014-9112-pt5.patch		\
+  gnu/packages/patches/cpio-fix-symlink-bad-length-test.patch	\
   gnu/packages/patches/cpio-gets-undeclared.patch		\
   gnu/packages/patches/cpufrequtils-fix-aclocal.patch		\
   gnu/packages/patches/crossmap-allow-system-pysam.patch	\
@@ -421,6 +422,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/emacs-exec-path.patch			\
   gnu/packages/patches/eudev-rules-directory.patch		\
   gnu/packages/patches/findutils-absolute-paths.patch		\
+  gnu/packages/patches/findutils-localstatedir.patch		\
   gnu/packages/patches/flashrom-use-libftdi1.patch		\
   gnu/packages/patches/flex-bison-tests.patch			\
   gnu/packages/patches/fltk-shared-lib-defines.patch		\
@@ -431,6 +433,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/gcc-libvtv-runpath.patch			\
   gnu/packages/patches/gcc-5.0-libvtv-runpath.patch		\
   gnu/packages/patches/geoclue-config.patch			\
+  gnu/packages/patches/gettext-msgunfmt.patch			\
   gnu/packages/patches/ghostscript-runpath.patch		\
   gnu/packages/patches/gitolite-openssh-6.8-compat.patch	\
   gnu/packages/patches/glib-tests-desktop.patch			\
@@ -448,6 +451,8 @@ dist_patch_DATA =						\
   gnu/packages/patches/grep-CVE-2015-1345.patch			\
   gnu/packages/patches/grub-gets-undeclared.patch		\
   gnu/packages/patches/grub-freetype.patch			\
+  gnu/packages/patches/gsl-poly-test-fix-pt1.patch		\
+  gnu/packages/patches/gsl-poly-test-fix-pt2.patch		\
   gnu/packages/patches/guile-1.8-cpp-4.5.patch			\
   gnu/packages/patches/guile-arm-fixes.patch			\
   gnu/packages/patches/guile-default-utf8.patch			\
@@ -471,6 +476,25 @@ dist_patch_DATA =						\
   gnu/packages/patches/liboop-mips64-deplibs-fix.patch		\
   gnu/packages/patches/libmad-mips-newgcc.patch			\
   gnu/packages/patches/libtheora-config-guess.patch		\
+  gnu/packages/patches/libtiff-CVE-2012-4564.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-1960.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-1961.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-4231.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-4232.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-4243.patch		\
+  gnu/packages/patches/libtiff-CVE-2013-4244.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-8129.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-9330.patch		\
+  gnu/packages/patches/libtiff-CVE-2014-9655.patch		\
   gnu/packages/patches/libtool-skip-tests2.patch		\
   gnu/packages/patches/libssh-CVE-2014-0017.patch		\
   gnu/packages/patches/libvpx-fix-armhf-link.patch		\
@@ -487,6 +511,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/maxima-defsystem-mkdir.patch		\
   gnu/packages/patches/mc-fix-ncurses-build.patch		\
   gnu/packages/patches/mcron-install.patch			\
+  gnu/packages/patches/mdadm-gcc-4.9-fix.patch			\
   gnu/packages/patches/mhash-keygen-test-segfault.patch		\
   gnu/packages/patches/mit-krb5-init-fix.patch			\
   gnu/packages/patches/mpc123-initialize-ao.patch		\
@@ -509,6 +534,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/patchelf-page-size.patch			\
   gnu/packages/patches/patchelf-rework-for-arm.patch		\
   gnu/packages/patches/patchutils-xfail-gendiff-tests.patch	\
+  gnu/packages/patches/patch-hurd-path-max.patch		\
   gnu/packages/patches/pavucontrol-sigsegv.patch		\
   gnu/packages/patches/perl-gd-options-passthrough-and-fontconfig.patch \
   gnu/packages/patches/perl-module-pluggable-search.patch	\
@@ -556,6 +582,7 @@ dist_patch_DATA =						\
   gnu/packages/patches/ratpoison-shell.patch			\
   gnu/packages/patches/readline-link-ncurses.patch		\
   gnu/packages/patches/ripperx-libm.patch			\
+  gnu/packages/patches/sed-hurd-path-max.patch			\
   gnu/packages/patches/scheme48-tests.patch			\
   gnu/packages/patches/scotch-test-threading.patch		\
   gnu/packages/patches/sdl-libx11-1.6.patch			\
@@ -567,6 +594,8 @@ dist_patch_DATA =						\
   gnu/packages/patches/soprano-find-clucene.patch		\
   gnu/packages/patches/subversion-sqlite-3.8.9-fix.patch	\
   gnu/packages/patches/superlu-dist-scotchmetis.patch		\
+  gnu/packages/patches/tar-d_ino_in_dirent-fix.patch		\
+  gnu/packages/patches/tar-skip-unreliable-tests.patch		\
   gnu/packages/patches/tcsh-fix-autotest.patch			\
   gnu/packages/patches/teckit-cstdio.patch			\
   gnu/packages/patches/texi2html-document-encoding.patch	\
diff --git a/gnu/packages/base.scm b/gnu/packages/base.scm
index c6206fdce2..31331a1080 100644
--- a/gnu/packages/base.scm
+++ b/gnu/packages/base.scm
@@ -101,7 +101,8 @@ including, for example, recursive directory searching.")
                                 ".tar.bz2"))
             (sha256
              (base32
-              "1myvrmh99jsvk7v3d7crm0gcrq51hmmm1r2kjyyci152in1x2j7h"))))
+              "1myvrmh99jsvk7v3d7crm0gcrq51hmmm1r2kjyyci152in1x2j7h"))
+            (patches (list (search-patch "sed-hurd-path-max.patch")))))
    (build-system gnu-build-system)
    (synopsis "Stream editor")
    (arguments
@@ -136,7 +137,10 @@ implementation offers several extensions over the standard utility.")
                                 version ".tar.xz"))
             (sha256
              (base32
-              "1wi2zwm4c9r3h3b8y4w0nm0qq897kn8kyj9k22ba0iqvxj48vvk4"))))
+              "1wi2zwm4c9r3h3b8y4w0nm0qq897kn8kyj9k22ba0iqvxj48vvk4"))
+            (patches (map search-patch
+                          '("tar-d_ino_in_dirent-fix.patch"
+                            "tar-skip-unreliable-tests.patch")))))
    (build-system gnu-build-system)
    (synopsis "Managing tar archives")
    (description
@@ -159,7 +163,8 @@ standard utility.")
                                   version ".tar.xz"))
               (sha256
                (base32
-                "16d2r9kpivaak948mxzc0bai45mqfw73m113wrkmbffnalv1b5gx"))))
+                "16d2r9kpivaak948mxzc0bai45mqfw73m113wrkmbffnalv1b5gx"))
+              (patches (list (search-patch "patch-hurd-path-max.patch")))))
    (build-system gnu-build-system)
    (native-inputs `(("ed", ed)))
    (synopsis "Apply differences to originals, with optional backups")
@@ -205,14 +210,20 @@ interactive means to merge two files.")
             (sha256
              (base32
               "0amn0bbwqvsvvsh6drfwz20ydc2czk374lzw5kksbh6bf78k4ks3"))
-            (patches (list (search-patch "findutils-absolute-paths.patch")))))
+            (patches (map search-patch
+                          '("findutils-absolute-paths.patch"
+                            "findutils-localstatedir.patch")))))
    (build-system gnu-build-system)
    (arguments
-    ;; Work around cross-compilation failure.
-    ;; See <http://savannah.gnu.org/bugs/?27299#comment1>.
-    (if (%current-target-system)
-        '(#:configure-flags '("gl_cv_func_wcwidth_works=yes"))
-        '()))
+    `(#:configure-flags (list
+                         ;; Tell 'updatedb' to write to /var.
+                         "--localstatedir=/var"
+
+                         ;; Work around cross-compilation failure.  See
+                         ;; <http://savannah.gnu.org/bugs/?27299#comment1>.
+                         ,@(if (%current-target-system)
+                               '("gl_cv_func_wcwidth_works=yes")
+                               '()))))
    (synopsis "Operating on files matching given criteria")
    (description
     "Findutils supplies the basic file directory searching utilities of the
@@ -672,14 +683,14 @@ test environments.")
 (define-public which
   (package
     (name "which")
-    (version "2.20")
+    (version "2.21")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/which/which-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1y2p50zadb36izzh2zw4dm5hvdiydqf3qa88l8kav20dcmfbc5yl"))))
+                "1bgafvy3ypbhhfznwjv1lxmd6mci3x1byilnnkc7gcr486wlb8pl"))))
     (build-system gnu-build-system)
     (home-page "https://gnu.org/software/which/")
     (synopsis "Find full path of shell commands")
diff --git a/gnu/packages/bison.scm b/gnu/packages/bison.scm
index 43ab216797..c8ec8cc274 100644
--- a/gnu/packages/bison.scm
+++ b/gnu/packages/bison.scm
@@ -40,7 +40,9 @@
        (base32
         "1qbgf6q1n2z17k8g33444m0q68kf3fbiq65q7jlrzpvvj73jh957"))))
     (build-system gnu-build-system)
-    (native-inputs `(("perl" ,perl)))
+    (native-inputs `(("perl" ,perl)
+                     ;; m4 is not present in PATH when cross-building
+                     ("m4" ,m4)))
     (inputs `(("flex" ,flex)))
     (propagated-inputs `(("m4" ,m4)))
     (home-page "http://www.gnu.org/software/bison/")
diff --git a/gnu/packages/commencement.scm b/gnu/packages/commencement.scm
index 9cabaa0886..ebf770bfa7 100644
--- a/gnu/packages/commencement.scm
+++ b/gnu/packages/commencement.scm
@@ -137,6 +137,28 @@
      (arguments
       `(#:guile ,%bootstrap-guile
         #:implicit-inputs? #f
+
+        #:modules ((guix build gnu-build-system)
+                   (guix build utils)
+                   (ice-9 ftw))                    ; for 'scandir'
+        #:phases (alist-cons-after
+                  'install 'add-symlinks
+                  (lambda* (#:key outputs #:allow-other-keys)
+                    ;; The cross-gcc invokes 'as', 'ld', etc, without the
+                    ;; triplet prefix, so add symlinks.
+                    (let ((out (assoc-ref outputs "out"))
+                          (triplet-prefix (string-append ,(boot-triplet) "-")))
+                      (define (has-triplet-prefix? name)
+                        (string-prefix? triplet-prefix name))
+                      (define (remove-triplet-prefix name)
+                        (substring name (string-length triplet-prefix)))
+                      (with-directory-excursion (string-append out "/bin")
+                        (for-each (lambda (name)
+                                    (symlink name (remove-triplet-prefix name)))
+                                  (scandir "." has-triplet-prefix?)))
+                      #t))
+                  %standard-phases)
+
         ,@(substitute-keyword-arguments (package-arguments binutils)
             ((#:configure-flags cf)
              `(cons ,(string-append "--target=" (boot-triplet))
@@ -145,7 +167,7 @@
 
 (define gcc-boot0
   (package-with-bootstrap-guile
-   (package (inherit gcc-4.8)
+   (package (inherit gcc-4.9)
      (name "gcc-cross-boot0")
      (arguments
       `(#:guile ,%bootstrap-guile
@@ -155,7 +177,7 @@
                    (ice-9 regex)
                    (srfi srfi-1)
                    (srfi srfi-26))
-        ,@(substitute-keyword-arguments (package-arguments gcc-4.8)
+        ,@(substitute-keyword-arguments (package-arguments gcc-4.9)
             ((#:configure-flags flags)
              `(append (list ,(string-append "--target=" (boot-triplet))
 
@@ -177,6 +199,8 @@
                             "--disable-libsanitizer"
                             "--disable-libitm"
                             "--disable-libgomp"
+                            "--disable-libcilkrts"
+                            "--disable-libvtv"
                             "--disable-libssp"
                             "--disable-libquadmath"
                             "--disable-decimal-float")
@@ -216,7 +240,7 @@
                     (with-directory-excursion
                         (string-append out "/lib/gcc/"
                                        ,(boot-triplet)
-                                       "/" ,(package-version gcc-4.8))
+                                       "/" ,(package-version gcc-4.9))
                       (symlink "libgcc.a" "libgcc_eh.a"))))
                 ,phases))))))
 
@@ -232,7 +256,7 @@
 
      ;; No need for Texinfo at this stage.
      (native-inputs (alist-delete "texinfo"
-                                  (package-native-inputs gcc-4.8))))))
+                                  (package-native-inputs gcc-4.9))))))
 
 (define perl-boot0
   (package-with-bootstrap-guile
@@ -270,10 +294,7 @@
   ;; 2nd stage inputs.
   `(("gcc" ,gcc-boot0)
     ("binutils-cross" ,binutils-boot0)
-
-    ;; Keep "binutils" here because the cross-gcc invokes `as', not the
-    ;; cross-`as'.
-    ,@%boot0-inputs))
+    ,@(alist-delete "binutils" %boot0-inputs)))
 
 (define glibc-final-with-bootstrap-bash
   ;; The final libc, "cross-built".  If everything went well, the resulting
@@ -331,7 +352,7 @@
 (define (cross-gcc-wrapper gcc binutils glibc bash)
   "Return a wrapper for the pseudo-cross toolchain GCC/BINUTILS/GLIBC
 that makes it available under the native tool names."
-  (package (inherit gcc-4.8)
+  (package (inherit gcc-4.9)
     (name (string-append (package-name gcc) "-wrapped"))
     (source #f)
     (build-system trivial-build-system)
@@ -499,7 +520,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
   ;; (remember that GCC-BOOT0 cannot build libstdc++.)
   ;; TODO: Write in terms of 'make-libstdc++'.
   (package-with-bootstrap-guile
-   (package (inherit gcc-4.8)
+   (package (inherit gcc-4.9)
      (name "libstdc++")
      (arguments
       `(#:guile ,%bootstrap-guile
@@ -518,7 +539,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
                                             (assoc-ref %outputs "out")
                                             "/include"
                                             ;; "/include/c++/"
-                                            ;; ,(package-version gcc-4.8)
+                                            ;; ,(package-version gcc-4.9)
                                             ))))
      (outputs '("out"))
      (inputs %boot2-inputs)
@@ -530,6 +551,12 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
   ;; The final GCC.
   (package (inherit gcc-boot0)
     (name "gcc")
+
+    ;; XXX: Currently #:allowed-references applies to all the outputs but the
+    ;; "debug" output contains disallowed references, notably
+    ;; linux-libre-headers.  Disable the debugging output to work around that.
+    (outputs (delete "debug" (package-outputs gcc-boot0)))
+
     (arguments
      `(#:guile ,%bootstrap-guile
        #:implicit-inputs? #f
@@ -546,7 +573,7 @@ exec ~a/bin/~a-~a -B~a/lib -Wl,-dynamic-linker -Wl,~a/~a \"$@\"~%"
        ;; doesn't honor $LIBRARY_PATH, which breaks `gnu-build-system'.)
        ,@(substitute-keyword-arguments (package-arguments gcc-boot0)
            ((#:configure-flags boot-flags)
-            (let loop ((args (package-arguments gcc-4.8)))
+            (let loop ((args (package-arguments gcc-4.9)))
               (match args
                 ((#:configure-flags normal-flags _ ...)
                  normal-flags)
diff --git a/gnu/packages/cpio.scm b/gnu/packages/cpio.scm
index 87f85d00e8..cfb416239d 100644
--- a/gnu/packages/cpio.scm
+++ b/gnu/packages/cpio.scm
@@ -36,12 +36,14 @@
              (sha256
               (base32
                "1gavgpzqwgkpagjxw72xgxz52y1ifgz0ckqh8g7cckz7jvyhp0mv"))
-             (patches (list (search-patch "cpio-CVE-2014-9112-pt1.patch")
-                            (search-patch "cpio-CVE-2014-9112-pt2.patch")
-                            (search-patch "cpio-CVE-2014-9112-pt3.patch")
-                            (search-patch "cpio-CVE-2014-9112-pt4.patch")
-                            (search-patch "cpio-CVE-2014-9112-pt5.patch")
-                            (search-patch "cpio-gets-undeclared.patch")))))
+             (patches (map search-patch
+                           '("cpio-CVE-2014-9112-pt1.patch"
+                             "cpio-CVE-2014-9112-pt2.patch"
+                             "cpio-CVE-2014-9112-pt3.patch"
+                             "cpio-CVE-2014-9112-pt4.patch"
+                             "cpio-CVE-2014-9112-pt5.patch"
+                             "cpio-fix-symlink-bad-length-test.patch"
+                             "cpio-gets-undeclared.patch")))))
     (build-system gnu-build-system)
 
     ;; FIXME: autoconf is needed to run autom4te, to update to test suite
diff --git a/gnu/packages/cross-base.scm b/gnu/packages/cross-base.scm
index f1aca505d8..9c27483466 100644
--- a/gnu/packages/cross-base.scm
+++ b/gnu/packages/cross-base.scm
@@ -85,101 +85,107 @@ may be either a libc package or #f.)"
   ;; Set the current target system so that 'glibc-dynamic-linker' returns the
   ;; right name.
   (parameterize ((%current-target-system target))
-    (substitute-keyword-arguments (package-arguments gcc-4.8)
-      ((#:configure-flags flags)
-       `(append (list ,(string-append "--target=" target)
-                      ,@(if libc
-                            '()
-                            `( ;; Disable features not needed at this stage.
-                              "--disable-shared" "--enable-static"
-
-                              ;; Disable C++ because libstdc++'s configure
-                              ;; script otherwise fails with "Link tests are not
-                              ;; allowed after GCC_NO_EXECUTABLES."
-                              "--enable-languages=c"
-
-                              "--disable-threads"  ;libgcc, would need libc
-                              "--disable-libatomic"
-                              "--disable-libmudflap"
-                              "--disable-libgomp"
-                              "--disable-libssp"
-                              "--disable-libquadmath"
-                              "--disable-decimal-float" ;would need libc
-                              )))
-
-                ,(if libc
-                     flags
-                     `(remove (cut string-match "--enable-languages.*" <>)
-                              ,flags))))
-      ((#:make-flags flags)
-       (if libc
-           `(let ((libc (assoc-ref %build-inputs "libc")))
-              ;; FLAGS_FOR_TARGET are needed for the target libraries to receive
-              ;; the -Bxxx for the startfiles.
-              (cons (string-append "FLAGS_FOR_TARGET=-B" libc "/lib")
-                    ,flags))
-           flags))
-      ((#:phases phases)
-       (let ((phases
-              `(alist-cons-after
-                'install 'make-cross-binutils-visible
-                (lambda* (#:key outputs inputs #:allow-other-keys)
-                  (let* ((out      (assoc-ref outputs "out"))
-                         (libexec  (string-append out "/libexec/gcc/"
-                                                  ,target))
-                         (binutils (string-append
-                                    (assoc-ref inputs "binutils-cross")
-                                    "/bin/" ,target "-"))
-                         (wrapper  (string-append
-                                    (assoc-ref inputs "ld-wrapper-cross")
-                                    "/bin/" ,target "-ld")))
-                    (for-each (lambda (file)
-                                (symlink (string-append binutils file)
-                                         (string-append libexec "/"
-                                                        file)))
-                              '("as" "nm"))
-                    (symlink wrapper (string-append libexec "/ld"))
-                    #t))
-                ,phases)))
-         (if libc
-             `(alist-cons-before
-               'configure 'set-cross-path
-               (lambda* (#:key inputs #:allow-other-keys)
-                 ;; Add the cross Linux headers to CROSS_CPATH, and remove them
-                 ;; from CPATH.
-                 (let ((libc  (assoc-ref inputs "libc"))
-                       (linux (assoc-ref inputs
-                                         "libc/linux-headers")))
-                   (define (cross? x)
-                     ;; Return #t if X is a cross-libc or cross Linux.
-                     (or (string-prefix? libc x)
-                         (string-prefix? linux x)))
-
-                   (setenv "CROSS_CPATH"
-                           (string-append libc "/include:"
-                                          linux "/include"))
-                   (setenv "CROSS_LIBRARY_PATH"
-                           (string-append libc "/lib"))
-
-                   (let ((cpath   (search-path-as-string->list
-                                   (getenv "CPATH")))
-                         (libpath (search-path-as-string->list
-                                   (getenv "LIBRARY_PATH"))))
-                     (setenv "CPATH"
-                             (list->search-path-as-string
-                              (remove cross? cpath) ":"))
-                     (setenv "LIBRARY_PATH"
-                             (list->search-path-as-string
-                              (remove cross? libpath) ":"))
-                     #t)))
-               ,phases)
-             phases)))
-      ((#:strip-binaries? _)
-       ;; Disable stripping as this can break binaries, with object files of
-       ;; libgcc.a showing up as having an unknown architecture.  See
-       ;; <http://lists.fedoraproject.org/pipermail/arm/2010-August/000663.html>
-       ;; for instance.
-       #f))))
+    ;; Disable stripping as this can break binaries, with object files of
+    ;; libgcc.a showing up as having an unknown architecture.  See
+    ;; <http://lists.fedoraproject.org/pipermail/arm/2010-August/000663.html>
+    ;; for instance.
+    (let ((args `(#:strip-binaries? #f
+                  ,@(package-arguments gcc-4.9))))
+     (substitute-keyword-arguments args
+       ((#:configure-flags flags)
+        `(append (list ,(string-append "--target=" target)
+                       ,@(if libc
+                             '()
+                             `( ;; Disable features not needed at this stage.
+                               "--disable-shared" "--enable-static"
+
+                               ;; Disable C++ because libstdc++'s configure
+                               ;; script otherwise fails with "Link tests are not
+                               ;; allowed after GCC_NO_EXECUTABLES."
+                               "--enable-languages=c"
+
+                               "--disable-threads" ;libgcc, would need libc
+                               "--disable-libatomic"
+                               "--disable-libmudflap"
+                               "--disable-libgomp"
+                               "--disable-libssp"
+                               "--disable-libquadmath"
+                               "--disable-decimal-float" ;would need libc
+                               )))
+
+                 ,(if libc
+                      flags
+                      `(remove (cut string-match "--enable-languages.*" <>)
+                               ,flags))))
+       ((#:make-flags flags)
+        (if libc
+            `(let ((libc (assoc-ref %build-inputs "libc")))
+               ;; FLAGS_FOR_TARGET are needed for the target libraries to receive
+               ;; the -Bxxx for the startfiles.
+               (cons (string-append "FLAGS_FOR_TARGET=-B" libc "/lib")
+                     ,flags))
+            flags))
+       ((#:phases phases)
+        (let ((phases
+               `(alist-cons-after
+                 'install 'make-cross-binutils-visible
+                 (lambda* (#:key outputs inputs #:allow-other-keys)
+                   (let* ((out      (assoc-ref outputs "out"))
+                          (libexec  (string-append out "/libexec/gcc/"
+                                                   ,target))
+                          (binutils (string-append
+                                     (assoc-ref inputs "binutils-cross")
+                                     "/bin/" ,target "-"))
+                          (wrapper  (string-append
+                                     (assoc-ref inputs "ld-wrapper-cross")
+                                     "/bin/" ,target "-ld")))
+                     (for-each (lambda (file)
+                                 (symlink (string-append binutils file)
+                                          (string-append libexec "/"
+                                                         file)))
+                               '("as" "nm"))
+                     (symlink wrapper (string-append libexec "/ld"))
+                     #t))
+                 (alist-replace
+                  'install
+                  (lambda _
+                    ;; Unlike our 'strip' phase, this will do the right thing
+                    ;; for cross-compilers.
+                    (zero? (system* "make" "install-strip")))
+                  ,phases))))
+          (if libc
+              `(alist-cons-before
+                'configure 'set-cross-path
+                (lambda* (#:key inputs #:allow-other-keys)
+                  ;; Add the cross Linux headers to CROSS_CPATH, and remove them
+                  ;; from CPATH.
+                  (let ((libc  (assoc-ref inputs "libc"))
+                        (linux (assoc-ref inputs
+                                          "libc/linux-headers")))
+                    (define (cross? x)
+                      ;; Return #t if X is a cross-libc or cross Linux.
+                      (or (string-prefix? libc x)
+                          (string-prefix? linux x)))
+
+                    (setenv "CROSS_CPATH"
+                            (string-append libc "/include:"
+                                           linux "/include"))
+                    (setenv "CROSS_LIBRARY_PATH"
+                            (string-append libc "/lib"))
+
+                    (let ((cpath   (search-path-as-string->list
+                                    (getenv "CPATH")))
+                          (libpath (search-path-as-string->list
+                                    (getenv "LIBRARY_PATH"))))
+                      (setenv "CPATH"
+                              (list->search-path-as-string
+                               (remove cross? cpath) ":"))
+                      (setenv "LIBRARY_PATH"
+                              (list->search-path-as-string
+                               (remove cross? libpath) ":"))
+                      #t)))
+                ,phases)
+              phases)))))))
 
 (define (cross-gcc-patches target)
   "Return GCC patches needed for TARGET."
@@ -193,14 +199,14 @@ may be either a libc package or #f.)"
   "Return a cross-compiler for TARGET, where TARGET is a GNU triplet.  Use
 XBINUTILS as the associated cross-Binutils.  If LIBC is false, then build a
 GCC that does not target a libc; otherwise, target that libc."
-  (package (inherit gcc-4.8)
+  (package (inherit gcc-4.9)
     (name (string-append "gcc-cross-"
                          (if libc "" "sans-libc-")
                          target))
-    (source (origin (inherit (package-source gcc-4.8))
+    (source (origin (inherit (package-source gcc-4.9))
               (patches
                (append
-                (origin-patches (package-source gcc-4.8))
+                (origin-patches (package-source gcc-4.9))
                 (cons (search-patch "gcc-cross-environment-variables.patch")
                       (cross-gcc-patches target))))))
 
@@ -230,7 +236,7 @@ GCC that does not target a libc; otherwise, target that libc."
        ("libc-native" ,@(assoc-ref %final-inputs "libc"))
 
        ;; Remaining inputs.
-       ,@(let ((inputs (append (package-inputs gcc-4.8)
+       ,@(let ((inputs (append (package-inputs gcc-4.9)
                                (alist-delete "libc" %final-inputs))))
            (if libc
                `(("libc" ,libc)
diff --git a/gnu/packages/databases.scm b/gnu/packages/databases.scm
index 3e3fd1a560..3ab2fcdcf3 100644
--- a/gnu/packages/databases.scm
+++ b/gnu/packages/databases.scm
@@ -284,7 +284,7 @@ types are supported, as is encryption.")
 (define-public sqlite
   (package
    (name "sqlite")
-   (version "3.8.9")
+   (version "3.8.10.2")
    (source (origin
             (method url-fetch)
             ;; TODO: Download from sqlite.org once this bug :
@@ -304,7 +304,7 @@ types are supported, as is encryption.")
                     "/sqlite-autoconf-" numeric-version ".tar.gz")))
             (sha256
              (base32
-              "18k90bbfvvgc5204nm1hzw0vsj9ygzv7zbq3z6zrya6j5hwvdsvn"))))
+              "09nnaqx50gl1vmfvdipirizr61q3s0ywlql50f9kr1bx9rdfb0l3"))))
    (build-system gnu-build-system)
    (inputs `(("readline" ,readline)))
    (arguments
diff --git a/gnu/packages/flex.scm b/gnu/packages/flex.scm
index e76535cc17..7988e930e7 100644
--- a/gnu/packages/flex.scm
+++ b/gnu/packages/flex.scm
@@ -60,6 +60,8 @@
               (inputs (alist-delete "flex" (package-inputs bison))))))
        `(("bison" ,bison-for-tests)
          ("indent" ,indent))))
+    ;; m4 is not present in PATH when cross-building
+    (native-inputs `(("m4" ,m4)))
     (propagated-inputs `(("m4" ,m4)))
     (home-page "http://flex.sourceforge.net/")
     (synopsis "Fast lexical analyser generator")
diff --git a/gnu/packages/gawk.scm b/gnu/packages/gawk.scm
index 06ecf6a064..d2639a32a3 100644
--- a/gnu/packages/gawk.scm
+++ b/gnu/packages/gawk.scm
@@ -28,13 +28,13 @@
 (define-public gawk
   (package
    (name "gawk")
-   (version "4.1.1")
+   (version "4.1.3")
    (source (origin
             (method url-fetch)
             (uri (string-append "mirror://gnu/gawk/gawk-" version
                                 ".tar.xz"))
             (sha256
-             (base32 "1nz83vpss8xv7m475sv4qhhj40g74nvcw0y9kwq9ds8wzfmcdm7g"))))
+             (base32 "09d6pmx6h3i2glafm0jd1v1iyrs03vcyv2rkz12jisii3vlmbkz3"))))
    (build-system gnu-build-system)
    (arguments
     `(#:parallel-tests? #f                ; test suite fails in parallel
diff --git a/gnu/packages/gcc.scm b/gnu/packages/gcc.scm
index 73e8ae97e8..c370fe8212 100644
--- a/gnu/packages/gcc.scm
+++ b/gnu/packages/gcc.scm
@@ -64,15 +64,7 @@ where the OS part is overloaded to denote a specific ABI---into GCC
          '())))
 
 (define-public gcc-4.7
-  (let* ((stripped? #t)                           ; TODO: make this a parameter
-         (install-target
-          (lambda ()
-            ;; The 'install-strip' rule uses the native 'strip' instead of
-            ;; 'TARGET-strip' when cross-compiling.  Thus, use 'install' in that
-            ;; case.
-            (if (and stripped? (not (%current-target-system)))
-                "install-strip"
-                "install")))
+  (let* ((stripped? #t)      ;whether to strip the compiler, not the libraries
          (maybe-target-tools
           (lambda ()
             ;; Return the `_FOR_TARGET' variables that are needed when
@@ -144,8 +136,9 @@ where the OS part is overloaded to denote a specific ABI---into GCC
 
       ;; Separate out the run-time support libraries because all the
       ;; dynamic-linked objects depend on it.
-      (outputs '("out"                     ; commands, etc. (60+ MiB)
-                 "lib"))                   ; libgcc_s, libgomp, etc. (15+ MiB)
+      (outputs '("out"                    ;commands, etc. (60+ MiB)
+                 "lib"                    ;libgcc_s, libgomp, etc. (15+ MiB)
+                 "debug"))                ;debug symbols of run-time libraries
 
       (inputs `(("gmp" ,gmp)
                 ("mpfr" ,mpfr)
@@ -160,7 +153,6 @@ where the OS part is overloaded to denote a specific ABI---into GCC
 
       (arguments
        `(#:out-of-source? #t
-         #:strip-binaries? ,stripped?
          #:configure-flags ,(configure-flags)
          #:make-flags
          ;; None of the flags below are needed when doing a Canadian cross.
@@ -235,8 +227,8 @@ where the OS part is overloaded to denote a specific ABI---into GCC
                    ;; below, make sure to update the relevant code in
                    ;; %gcc-static package as needed.
                    (format #f "#define GNU_USER_TARGET_LIB_SPEC \
-\"-L~a/lib %{!static:-rpath=~a/lib %{!static-libgcc:-rpath=~a/lib64 -rpath=~a/lib -lgcc_s}} \" ~a"
-                           libc libc libdir libdir suffix))
+\"-L~a/lib %{!static:-rpath=~a/lib %{!static-libgcc:-rpath=~a/lib -lgcc_s}} \" ~a"
+                           libc libc libdir suffix))
                   (("#define GNU_USER_TARGET_STARTFILE_SPEC.*$" line)
                    (format #f "#define STANDARD_STARTFILE_PREFIX_1 \"~a/lib\"
 #define STANDARD_STARTFILE_PREFIX_2 \"\"
@@ -248,6 +240,20 @@ where the OS part is overloaded to denote a specific ABI---into GCC
                 (("static char const sed_cmd_z\\[\\] =.*;")
                  "static char const sed_cmd_z[] = \"sed\";"))
 
+              (when (file-exists? "libbacktrace")
+                ;; GCC 4.8+ comes with libbacktrace.  By default it builds
+                ;; with -Werror, which fails with a -Wcast-qual error in glibc
+                ;; 2.21's stdlib-bsearch.h.  Remove -Werror.
+                (substitute* "libbacktrace/configure"
+                  (("WARN_FLAGS=(.*)-Werror" _ flags)
+                   (string-append "WARN_FLAGS=" flags)))
+
+                (when (file-exists? "libsanitizer/libbacktrace")
+                  ;; Same in libsanitizer's bundled copy (!) found in 4.9+.
+                  (substitute* "libsanitizer/libbacktrace/Makefile.in"
+                    (("-Werror")
+                     ""))))
+
               ;; Add a RUNPATH to libstdc++.so so that it finds libgcc_s.
               ;; See <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=32354>
               ;; and <http://bugs.gnu.org/20358>.
@@ -280,11 +286,7 @@ where the OS part is overloaded to denote a specific ABI---into GCC
              (substitute* "Makefile"
                (("^TOPLEVEL_CONFIGURE_ARGUMENTS=(.*)$" _ rest)
                 "TOPLEVEL_CONFIGURE_ARGUMENTS=\n")))
-           (alist-replace 'install
-                          (lambda* (#:key outputs #:allow-other-keys)
-                            (zero?
-                             (system* "make" ,(install-target))))
-                          %standard-phases)))))
+           %standard-phases))))
 
       (native-search-paths
        (list (search-path-specification
@@ -313,10 +315,6 @@ Go.  It also includes runtime support libraries for these languages.")
               (sha256
                (base32
                 "15c6gwm6dzsaagamxkak5smdkf1rdfbqqjs9jdbrp3lbg4ism02a"))
-
-              ;; ARM 'link' spec issue reported at
-              ;; <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65711> and
-              ;; <https://gcc.gnu.org/ml/gcc-patches/2015-04/msg01387.html>.
               (patches (list (search-patch "gcc-arm-link-spec-fix.patch")))))))
 
 (define-public gcc-4.9
diff --git a/gnu/packages/gettext.scm b/gnu/packages/gettext.scm
index 3a96cd613c..9289946178 100644
--- a/gnu/packages/gettext.scm
+++ b/gnu/packages/gettext.scm
@@ -42,7 +42,8 @@
                                  version ".tar.gz"))
              (sha256
               (base32
-               "0gvz86m4cs8bdf3mwmwsyx6lrq4ydfxgadrgd9jlx32z3bnz3jca"))))
+               "0gvz86m4cs8bdf3mwmwsyx6lrq4ydfxgadrgd9jlx32z3bnz3jca"))
+             (patches (list (search-patch "gettext-msgunfmt.patch")))))
     (build-system gnu-build-system)
     (inputs
      `(("expat" ,expat)))
diff --git a/gnu/packages/glib.scm b/gnu/packages/glib.scm
index 305c89c022..88c61b676b 100644
--- a/gnu/packages/glib.scm
+++ b/gnu/packages/glib.scm
@@ -317,6 +317,7 @@ The intltool collection can be used to do these things:
     (build-system gnu-build-system)
     (propagated-inputs
      `(("libxml2" ,libxml2)
+       ("python2-libxml2" ,python2-libxml2)
        ("python-2" ,python-2)))
     (home-page "http://www.itstool.org")
     (synopsis "Tool to translate XML documents with PO files")
diff --git a/gnu/packages/gnome.scm b/gnu/packages/gnome.scm
index 21ca3a8363..f7a6465eb6 100644
--- a/gnu/packages/gnome.scm
+++ b/gnu/packages/gnome.scm
@@ -173,6 +173,7 @@ The gnome-about program helps find which version of GNOME is installed.")
     (native-inputs
      `(("intltool" ,intltool)
        ("docbook-xml" ,docbook-xml-4.4)
+       ("python2-libxml2" ,python2-libxml2)
        ("libxml2" ,libxml2)
        ("libxslt" ,libxslt)
        ("pkg-config" ,pkg-config)
diff --git a/gnu/packages/image.scm b/gnu/packages/image.scm
index 17da5f6391..ad4acb787e 100644
--- a/gnu/packages/image.scm
+++ b/gnu/packages/image.scm
@@ -112,7 +112,26 @@ image files in PBMPLUS PPM/PGM, GIF, BMP, and Targa file formats.")
             (uri (string-append "ftp://ftp.remotesensing.org/pub/libtiff/tiff-"
                    version ".tar.gz"))
             (sha256 (base32
-                     "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa"))))
+                     "0wj8d1iwk9vnpax2h29xqc2hwknxg3s0ay2d5pxkg59ihbifn6pa"))
+            (patches (map search-patch '("libtiff-CVE-2012-4564.patch"
+                                         "libtiff-CVE-2013-1960.patch"
+                                         "libtiff-CVE-2013-1961.patch"
+                                         "libtiff-CVE-2013-4231.patch"
+                                         "libtiff-CVE-2013-4232.patch"
+                                         "libtiff-CVE-2013-4244.patch"
+                                         "libtiff-CVE-2013-4243.patch"
+                                         "libtiff-CVE-2014-9330.patch"
+                                         "libtiff-CVE-2014-8127-pt1.patch"
+                                         "libtiff-CVE-2014-8127-pt2.patch"
+                                         "libtiff-CVE-2014-8127-pt3.patch"
+                                         "libtiff-CVE-2014-8127-pt4.patch"
+                                         "libtiff-CVE-2014-8128-pt1.patch"
+                                         "libtiff-CVE-2014-8128-pt2.patch"
+                                         "libtiff-CVE-2014-8128-pt3.patch"
+                                         "libtiff-CVE-2014-8129.patch"
+                                         "libtiff-CVE-2014-9655.patch"
+                                         "libtiff-CVE-2014-8128-pt4.patch"
+                                         "libtiff-CVE-2014-8128-pt5.patch")))))
    (build-system gnu-build-system)
    (inputs `(("zlib" ,zlib)
              ("libjpeg-8" ,libjpeg-8)))
diff --git a/gnu/packages/jemalloc.scm b/gnu/packages/jemalloc.scm
index 8a25cb08b8..5b4c2e0853 100644
--- a/gnu/packages/jemalloc.scm
+++ b/gnu/packages/jemalloc.scm
@@ -20,6 +20,8 @@
   #:use-module ((guix licenses) #:select (bsd-2))
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages gcc)
   #:use-module (guix build-system gnu))
 
 (define-public jemalloc
@@ -35,6 +37,12 @@
                (base32
                 "1zl4vxxjvhg72bdl53sl0idz9wp18c6yzjdmqcnwm09wvmcj2v71"))))
     (build-system gnu-build-system)
+    ;; XXX FIXME: Use gcc-4.8 on i686 to work around
+    ;; <http://bugs.gnu.org/20856>.
+    (native-inputs (if (and (not (%current-target-system))
+                            (string-prefix? "i686-" (%current-system)))
+                       `(("gcc" ,(canonical-package gcc-4.8)))
+                       '()))
     (home-page "http://www.canonware.com/jemalloc/")
     (synopsis "General-purpose scalable concurrent malloc implementation")
     (description
diff --git a/gnu/packages/ld-wrapper.in b/gnu/packages/ld-wrapper.in
index db662e7d76..c3d6fa1005 100644
--- a/gnu/packages/ld-wrapper.in
+++ b/gnu/packages/ld-wrapper.in
@@ -143,12 +143,16 @@ exec @GUILE@ -c "(load-compiled \"@SELF@.go\") (apply $main (cdr (command-line))
   (define path+files+args
     (fold (lambda (argument result)
             (match result
-              ((library-path library-files ("-dynamic-linker" . rest))
-               ;; When passed '-dynamic-linker ld.so', ignore 'ld.so'.
-               ;; See <http://bugs.gnu.org/20102>.
+              ((library-path library-files
+                             ((and flag
+                                   (or "-dynamic-linker" "-plugin"))
+                              . rest))
+               ;; When passed '-dynamic-linker ld.so', ignore 'ld.so'; when
+               ;; passed '-plugin liblto_plugin.so', ignore
+               ;; 'liblto_plugin.so'.  See <http://bugs.gnu.org/20102>.
                (list library-path
                      library-files
-                     (cons* argument "-dynamic-linker" rest)))
+                     (cons* argument flag rest)))
               ((library-path library-files previous-args)
                (cond ((string-prefix? "-L" argument) ;augment the search path
                       (list (append library-path
diff --git a/gnu/packages/linux.scm b/gnu/packages/linux.scm
index f636b91bf0..986a51a46a 100644
--- a/gnu/packages/linux.scm
+++ b/gnu/packages/linux.scm
@@ -108,12 +108,21 @@
                (and (zero? (system* "make"
                                     (string-append "INSTALL_HDR_PATH=" out)
                                     "headers_install"))
-                    (mkdir (string-append out "/include/config"))
-                    (call-with-output-file
-                        (string-append out
-                                       "/include/config/kernel.release")
-                      (lambda (p)
-                        (format p "~a-default~%" ,version))))))))
+                    (begin
+                      (mkdir (string-append out "/include/config"))
+                      (call-with-output-file
+                          (string-append out
+                                         "/include/config/kernel.release")
+                        (lambda (p)
+                          (format p "~a-default~%" ,version)))
+
+                      ;; Remove the '.install' and '..install.cmd' files; the
+                      ;; latter contains store paths, which pulls in bootstrap
+                      ;; binaries in the build environment, and prevents bit
+                      ;; reproducibility for the bootstrap binaries.
+                      (for-each delete-file (find-files out "\\.install"))
+
+                      #t))))))
    (package
     (name "linux-libre-headers")
     (version version)
@@ -135,6 +144,7 @@
                  (alist-replace
                   'install ,install-phase
                   (alist-delete 'configure %standard-phases)))
+       #:allowed-references ()
        #:tests? #f))
     (synopsis "GNU Linux-Libre kernel headers")
     (description "Headers of the Linux-Libre kernel.")
@@ -2127,7 +2137,8 @@ MPEG-2 and audio over Linux IEEE 1394.")
                     version ".tar.xz"))
               (sha256
                (base32
-                "132vdvh3myjgcjn6i9w90ck16ddjxjcszklzkyvr4f5ifqd7wfhg"))))
+                "132vdvh3myjgcjn6i9w90ck16ddjxjcszklzkyvr4f5ifqd7wfhg"))
+              (patches (list (search-patch "mdadm-gcc-4.9-fix.patch")))))
     (build-system gnu-build-system)
     (inputs
      `(("udev" ,eudev)))
diff --git a/gnu/packages/make-bootstrap.scm b/gnu/packages/make-bootstrap.scm
index 7f1b6d50b0..2a7c4bd6f2 100644
--- a/gnu/packages/make-bootstrap.scm
+++ b/gnu/packages/make-bootstrap.scm
@@ -103,11 +103,11 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
             ("cross-binutils" ,(cross-binutils target))
             ,@%final-inputs))
         `(("libc" ,(glibc-for-bootstrap))
-          ("gcc" ,(package (inherit gcc-4.8)
+          ("gcc" ,(package (inherit gcc-4.9)
                     (outputs '("out")) ; all in one so libgcc_s is easily found
                     (inputs
                      `(("libc",(glibc-for-bootstrap))
-                       ,@(package-inputs gcc-4.8)))))
+                       ,@(package-inputs gcc-4.9)))))
           ,@(fold alist-delete %final-inputs '("libc" "gcc")))))
 
   (package-with-explicit-inputs p inputs
@@ -181,7 +181,7 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                             ;; Since we use `-static', remove
                             ;; `-export-dynamic'.
                             (substitute* "configure"
-                              (("-export-dynamic") "")))
+                              (("-Wl,-export-dynamic") "")))
                           ,phases)))))
                 (inputs (if (%current-target-system)
                             `(("bash" ,%bash-static))
@@ -374,10 +374,6 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
              (copy-recursively (string-append linux "/include/asm-generic")
                                (string-append incdir "/asm-generic"))
 
-             ;; Remove the '.install' and '..install.cmd' files; the latter
-             ;; contains store paths, which prevents bit reproducibility.
-             (for-each delete-file (find-files incdir "\\.install"))
-
              #t))))
       (inputs `(("libc" ,(let ((target (%current-target-system)))
                            (if target
@@ -393,7 +389,7 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
 (define %gcc-static
   ;; A statically-linked GCC, with stripped-down functionality.
   (package-with-relocatable-glibc
-   (package (inherit gcc-4.8)
+   (package (inherit gcc-4.9)
      (name "gcc-static")
      (outputs '("out"))                           ; all in one
      (arguments
@@ -402,7 +398,7 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                    (srfi srfi-1)
                    (srfi srfi-26)
                    (ice-9 regex))
-        ,@(substitute-keyword-arguments (package-arguments gcc-4.8)
+        ,@(substitute-keyword-arguments (package-arguments gcc-4.9)
             ((#:guile _) #f)
             ((#:implicit-inputs? _) #t)
             ((#:configure-flags flags)
@@ -426,6 +422,8 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
                        "--disable-libsanitizer"
                        "--disable-libitm"
                        "--disable-libgomp"
+                       "--disable-libcilkrts"
+                       "--disable-libvtv"
                        "--disable-libssp"
                        "--disable-libquadmath"
                        "--disable-decimal-float")
@@ -455,12 +453,12 @@ for `sh' in $PATH, and without nscd, and with static NSS modules."
             ("gmp-native" ,gmp)
             ("mpfr-native" ,mpfr)
             ("mpc-native" ,mpc)
-            ,@(package-native-inputs gcc-4.8))
-          (package-native-inputs gcc-4.8))))))
+            ,@(package-native-inputs gcc-4.9))
+          (package-native-inputs gcc-4.9))))))
 
 (define %gcc-stripped
   ;; The subset of GCC files needed for bootstrap.
-  (package (inherit gcc-4.8)
+  (package (inherit gcc-4.9)
     (name "gcc-stripped")
     (build-system trivial-build-system)
     (source #f)
diff --git a/gnu/packages/maths.scm b/gnu/packages/maths.scm
index 6fbe6fd27d..421baf5e5b 100644
--- a/gnu/packages/maths.scm
+++ b/gnu/packages/maths.scm
@@ -154,7 +154,9 @@ semiconductors.")
                           version ".tar.gz"))
       (sha256
        (base32
-        "0lrgipi0z6559jqh82yx8n4xgnxkhzj46v96dl77hahdp58jzg3k"))))
+        "0lrgipi0z6559jqh82yx8n4xgnxkhzj46v96dl77hahdp58jzg3k"))
+      (patches (map search-patch '("gsl-poly-test-fix-pt1.patch"
+                                   "gsl-poly-test-fix-pt2.patch")))))
     (build-system gnu-build-system)
     (arguments
      `(#:parallel-tests? #f
diff --git a/gnu/packages/mp3.scm b/gnu/packages/mp3.scm
index 55ab4b497c..c7efbae8c1 100644
--- a/gnu/packages/mp3.scm
+++ b/gnu/packages/mp3.scm
@@ -21,6 +21,8 @@
   #:use-module ((guix licenses) #:prefix license:)
   #:use-module (gnu packages)
   #:use-module (gnu packages autotools)
+  #:use-module (gnu packages base)
+  #:use-module (gnu packages gcc)
   #:use-module (gnu packages cdrom)
   #:use-module (gnu packages compression)
   #:use-module (gnu packages gettext)
@@ -335,6 +337,12 @@ use with CD-recording software).")
               (base32
                "1zr3kadv35ii6liia0bpfgxpag27xcivp571ybckpbz4b10nnd14"))))
     (build-system gnu-build-system)
+    ;; XXX FIXME: Use gcc-4.8 on i686 to work around
+    ;; <http://bugs.gnu.org/20856>.
+    (native-inputs (if (and (not (%current-target-system))
+                            (string-prefix? "i686-" (%current-system)))
+                       `(("gcc" ,(canonical-package gcc-4.8)))
+                       '()))
     (home-page "http://lame.sourceforge.net/")
     (synopsis "MPEG Audio Layer III (MP3) encoder")
     (description "LAME is a high quality MPEG Audio Layer III (MP3) encoder.")
diff --git a/gnu/packages/nettle.scm b/gnu/packages/nettle.scm
index ed140d43c0..77c5080c0a 100644
--- a/gnu/packages/nettle.scm
+++ b/gnu/packages/nettle.scm
@@ -56,17 +56,17 @@ themselves.")
     (license gpl2+)))
 
 (define-public nettle
-  ;; This version is not API-compatible with version 2.  In particular GnuTLS
+  ;; This version is not API-compatible with version 2.  In particular, lsh
   ;; cannot use it yet.  So keep it separate.
   (package (inherit nettle-2)
-    (version "3.1")
+    (version "3.1.1")
     (source (origin
               (method url-fetch)
               (uri (string-append "mirror://gnu/nettle/nettle-"
                                   version ".tar.gz"))
               (sha256
                (base32
-                "1ly9kz5fgc8ilykz07crqwgjsfn4p2s6565gj1aq0w4fr179v1gn"))))
+                "0k1x57zviysvi91lkk66cg8v819vywm5g5yqs22wppfqcifx5m2z"))))
     (arguments
      (substitute-keyword-arguments (package-arguments nettle-2)
        ((#:configure-flags flags)
diff --git a/gnu/packages/ocaml.scm b/gnu/packages/ocaml.scm
index 84841d017c..d283acdc1e 100644
--- a/gnu/packages/ocaml.scm
+++ b/gnu/packages/ocaml.scm
@@ -58,7 +58,7 @@
     (inputs
      `(("libx11" ,libx11)
        ;; For libiberty, needed for objdump support.
-       ("gcc:lib" ,(canonical-package gcc-4.8) "lib")
+       ("gcc:lib" ,(canonical-package gcc-4.9) "lib")
        ("zlib" ,zlib)))                       ;also needed for objdump support
     (arguments
      `(#:modules ((guix build gnu-build-system)
diff --git a/gnu/packages/openssl.scm b/gnu/packages/openssl.scm
index dec51a1e04..92f702e59d 100644
--- a/gnu/packages/openssl.scm
+++ b/gnu/packages/openssl.scm
@@ -29,14 +29,14 @@
 (define-public openssl
   (package
    (name "openssl")
-   (version "1.0.2b")
+   (version "1.0.2c")
    (source (origin
             (method url-fetch)
             (uri (string-append "ftp://ftp.openssl.org/source/openssl-" version
                                 ".tar.gz"))
             (sha256
              (base32
-              "0gwf4fy1yqmai6wph0g9lh09iarwxaa70hm7jm0rf1qakz68im6m"))
+              "10vasdg52qiyqvgbp14n9z7ghglmhzvag9qpiz2nfqssycvvlf00"))
             (patches (list (search-patch "openssl-runpath.patch")))))
    (build-system gnu-build-system)
    (native-inputs `(("perl" ,perl)))
diff --git a/gnu/packages/patches/cpio-fix-symlink-bad-length-test.patch b/gnu/packages/patches/cpio-fix-symlink-bad-length-test.patch
new file mode 100644
index 0000000000..58a5a478c9
--- /dev/null
+++ b/gnu/packages/patches/cpio-fix-symlink-bad-length-test.patch
@@ -0,0 +1,44 @@
+From bebf9662c406d1d137a66c567d8748b489d352e7 Mon Sep 17 00:00:00 2001
+From: Pavel Raiskup <praiskup@redhat.com>
+Date: Thu, 4 Jun 2015 13:27:42 +0200
+Subject: [PATCH] tests: fix expected output for old file
+
+Thanks Victor Rodriguez.  Upstream thread:
+http://lists.gnu.org/archive/html/bug-cpio/2015-06/msg00000.html
+
+* tests/symlink-bad-length.at (STDOUT): Expect the year string
+'2014' is printed and not time because the file in archive is
+older than 6 months.
+* Thanks: Mention Victor.
+---
+ THANKS                      | 1 +
+ tests/symlink-bad-length.at | 2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/THANKS b/THANKS
+index 45b0dfb..3228df9 100644
+--- a/THANKS
++++ b/THANKS
+@@ -23,6 +23,7 @@ Mitsuru Chinen		<mchinen@yamato.ibm.com>
+ Peter Breitenlohner     <peb@mppmu.mpg.de>
+ Peter Vrabec            <pvrabec@redhat.com>
+ Robert Millan           <rmh@aybabtu.com>
++Victor Rodriguez        <vm.rod25@gmail.com>
+ 
+ Local Variables:
+ mode: Fundamental
+diff --git a/tests/symlink-bad-length.at b/tests/symlink-bad-length.at
+index e1a7093..2cdc692 100644
+--- a/tests/symlink-bad-length.at
++++ b/tests/symlink-bad-length.at
+@@ -57,7 +57,7 @@ cat stderr | grep -v \
+ echo >&2 STDERR
+ ],
+ [0],
+-[-rw-rw-r--   1 10029    10031          13 Nov 25 11:52 FILE
++[-rw-rw-r--   1 10029    10031          13 Nov 25  2014 FILE
+ ],[STDERR
+ ])
+ 
+-- 
+2.1.0
diff --git a/gnu/packages/patches/findutils-localstatedir.patch b/gnu/packages/patches/findutils-localstatedir.patch
new file mode 100644
index 0000000000..c774303cf1
--- /dev/null
+++ b/gnu/packages/patches/findutils-localstatedir.patch
@@ -0,0 +1,14 @@
+Do not try to create $localstatedir (aka. /var) since we don't have
+write access.
+
+--- findutils-4.4.2/locate/Makefile.in	2015-06-04 12:40:52.690935795 +0200
++++ findutils-4.4.2/locate/Makefile.in	2015-06-04 12:41:32.087286685 +0200
+@@ -1212,7 +1212,7 @@ updatedb: updatedb.sh Makefile
+ 	chmod +x $@
+ 
+ install-data-hook:
+-	$(top_srcdir)/build-aux/mkinstalldirs $(DESTDIR)$(localstatedir)
++	true
+ 
+ dblocation.texi: Makefile
+ 	echo '@set LOCATE_DB $(LOCATE_DB)' > $@
diff --git a/gnu/packages/patches/gawk-shell.patch b/gnu/packages/patches/gawk-shell.patch
index 89b8540a8d..80e9c65475 100644
--- a/gnu/packages/patches/gawk-shell.patch
+++ b/gnu/packages/patches/gawk-shell.patch
@@ -2,9 +2,9 @@ As for libc's `system', change Awk to look for `sh' in $PATH.  This patch is
 only meant to be used during bootstrapping, where we don't know in advance the
 absolute file name of `sh'.
 
---- gawk-4.0.0/io.c	2011-05-18 20:47:29.000000000 +0200
-+++ gawk-4.0.0/io.c	2012-12-18 15:56:06.000000000 +0100
-@@ -1759,7 +1759,7 @@ two_way_open(const char *str, struct red
+--- gawk-4.1.3/io.c	2015-05-19 15:37:20.000000000 +0200
++++ gawk-4.1.3/io.c	2015-06-09 18:39:36.918414881 +0200
+@@ -1945,7 +1945,7 @@ two_way_open(const char *str, struct red
  
  			signal(SIGPIPE, SIG_DFL);
  
@@ -13,22 +13,22 @@ absolute file name of `sh'.
  			_exit(errno == ENOENT ? 127 : 126);
  
  		case -1:
-@@ -1924,7 +1924,7 @@ use_pipes:
- 		    || close(ctop[0]) == -1 || close(ctop[1]) == -1)
+@@ -2129,7 +2129,7 @@ use_pipes:
  			fatal(_("close of pipe failed (%s)"), strerror(errno));
  		/* stderr does NOT get dup'ed onto child's stdout */
+ 		signal(SIGPIPE, SIG_DFL);
 -		execl("/bin/sh", "sh", "-c", str, NULL);
 +		execlp("sh", "sh", "-c", str, NULL);
  		_exit(errno == ENOENT ? 127 : 126);
  	}
- #endif /* NOT __EMX__ */
-@@ -2074,7 +2074,7 @@ gawk_popen(const char *cmd, struct redir
- 			fatal(_("moving pipe to stdout in child failed (dup: %s)"), strerror(errno));
+ #endif /* NOT __EMX__, NOT __MINGW32__ */
+@@ -2323,7 +2323,7 @@ gawk_popen(const char *cmd, struct redir
  		if (close(p[0]) == -1 || close(p[1]) == -1)
  			fatal(_("close of pipe failed (%s)"), strerror(errno));
+ 		signal(SIGPIPE, SIG_DFL);
 -		execl("/bin/sh", "sh", "-c", cmd, NULL);
 +		execlp("sh", "sh", "-c", cmd, NULL);
  		_exit(errno == ENOENT ? 127 : 126);
  	}
- #endif /* NOT __EMX__ */
+ #endif /* NOT __EMX__, NOT __MINGW32__ */
 
diff --git a/gnu/packages/patches/gcc-arm-link-spec-fix.patch b/gnu/packages/patches/gcc-arm-link-spec-fix.patch
index 0ffe8a1810..e00ed1bac0 100644
--- a/gnu/packages/patches/gcc-arm-link-spec-fix.patch
+++ b/gnu/packages/patches/gcc-arm-link-spec-fix.patch
@@ -1,6 +1,10 @@
 Do not pass -dynamic-linker to linker when !shared.
 Fixes <http://bugs.gnu.org/20102>.
 
+ARM 'link' spec issue reported at
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65711 and
+https://gcc.gnu.org/ml/gcc-patches/2015-04/msg01387.html.
+
 Patch by Ludovic Courtès <ludo@gnu.org>.
 
 --- gcc-4.8.4/gcc/config/arm/linux-elf.h.orig	2015-04-08 20:31:20.376900478 +0200
diff --git a/gnu/packages/patches/gettext-msgunfmt.patch b/gnu/packages/patches/gettext-msgunfmt.patch
new file mode 100644
index 0000000000..4a50abddc2
--- /dev/null
+++ b/gnu/packages/patches/gettext-msgunfmt.patch
@@ -0,0 +1,58 @@
+From <http://git.savannah.gnu.org/cgit/gettext.git/patch/?id=5d3eeaa0d3b7f4f6932bd29d859925a940b69459>.
+
+2015-03-11  Daiki Ueno  <ueno@gnu.org>
+
+	msgunfmt: Check allocated size for static segment
+	Reported by Max Lin in:
+	http://lists.gnu.org/archive/html/bug-gettext/2015-03/msg00005.html
+	* read-mo.c (get_sysdep_string): Check if the embedded segment
+	size is valid, before adding it to the string length.
+
+diff --git a/gettext-tools/src/read-mo.c b/gettext-tools/src/read-mo.c
+index b97bbad..1c024a8 100644
+--- a/gettext-tools/src/read-mo.c
++++ b/gettext-tools/src/read-mo.c
+@@ -149,6 +149,7 @@ get_sysdep_string (const struct binary_mo_file *bfp, size_t offset,
+   nls_uint32 s_offset;
+ 
+   /* Compute the length.  */
++  s_offset = get_uint32 (bfp, offset);
+   length = 0;
+   for (i = 4; ; i += 8)
+     {
+@@ -158,9 +159,14 @@ get_sysdep_string (const struct binary_mo_file *bfp, size_t offset,
+       nls_uint32 ss_length;
+       nls_uint32 ss_offset;
+       size_t ss_end;
++      size_t s_end;
+       size_t n;
+ 
++      s_end = xsum (s_offset, segsize);
++      if (size_overflow_p (s_end) || s_end > bfp->size)
++        error (EXIT_FAILURE, 0, _("file \"%s\" is truncated"), bfp->filename);
+       length += segsize;
++      s_offset += segsize;
+ 
+       if (sysdepref == SEGMENTS_END)
+         break;
+@@ -175,7 +181,7 @@ get_sysdep_string (const struct binary_mo_file *bfp, size_t offset,
+       ss_end = xsum (ss_offset, ss_length);
+       if (size_overflow_p (ss_end) || ss_end > bfp->size)
+         error (EXIT_FAILURE, 0, _("file \"%s\" is truncated"), bfp->filename);
+-      if (!(ss_length > 0 && bfp->data[ss_offset + ss_length - 1] == '\0'))
++      if (!(ss_length > 0 && bfp->data[ss_end - 1] == '\0'))
+         {
+           char location[30];
+           sprintf (location, "sysdep_segment[%u]", (unsigned int) sysdepref);
+@@ -198,11 +204,8 @@ get_sysdep_string (const struct binary_mo_file *bfp, size_t offset,
+       nls_uint32 sysdep_segment_offset;
+       nls_uint32 ss_length;
+       nls_uint32 ss_offset;
+-      size_t s_end = xsum (s_offset, segsize);
+       size_t n;
+ 
+-      if (size_overflow_p (s_end) || s_end > bfp->size)
+-        error (EXIT_FAILURE, 0, _("file \"%s\" is truncated"), bfp->filename);
+       memcpy (p, bfp->data + s_offset, segsize);
+       p += segsize;
+       s_offset += segsize;
diff --git a/gnu/packages/patches/gsl-poly-test-fix-pt1.patch b/gnu/packages/patches/gsl-poly-test-fix-pt1.patch
new file mode 100644
index 0000000000..3d1ed4243c
--- /dev/null
+++ b/gnu/packages/patches/gsl-poly-test-fix-pt1.patch
@@ -0,0 +1,84 @@
+From 9cc12d0377dd634b1b97954d076b715f982853b7 Mon Sep 17 00:00:00 2001
+From: Patrick Alken <alken@colorado.edu>
+Date: Fri, 4 Apr 2014 13:36:16 -0600
+Subject: [PATCH] bug fix in sorting of complex numbers (bug #39055)
+
+---
+ poly/test.c | 49 ++++++++++++++++++++++++++++++-------------------
+ 1 file changed, 30 insertions(+), 19 deletions(-)
+
+diff --git a/poly/test.c b/poly/test.c
+index 9c147f6..d090802 100644
+--- a/poly/test.c
++++ b/poly/test.c
+@@ -25,11 +25,21 @@
+ #include <gsl/gsl_poly.h>
+ #include <gsl/gsl_heapsort.h>
+ 
++/* sort by Re(z) then by Im(z) */
+ static int
+ cmp_cplx(const double *a, const double *b)
+ {
+-	double t = (a[0] * a[0] + a[1] * a[1]) - (b[0] * b[0] + b[1] * b[1]);
+-	return t < 0.0 ? -1 : t > 0.0 ? 1 : 0;
++  double r = a[0] - b[0];
++
++  if (r == 0.0)
++    {
++      double t = a[1] - b[1];
++	    return t < 0.0 ? -1 : t > 0.0 ? 1 : 0;
++    }
++  else if (r < 0.0)
++    return -1;
++  else
++    return 1;
+ }
+ 
+ int
+@@ -534,25 +544,26 @@ main (void)
+        Problem reported by Munagala Ramanath (bug #39055)
+     */
+ 
+-    double a[16] = { 32, -48, -8, 28, -8, 16, -16, 12, -16, 6, 10, -17, 10, 2, -4, 1 };
++    double a[16] = { 32, -48, -8, 28, -8, 16, -16, 12,
++                    -16, 6, 10, -17, 10, 2, -4, 1 };
+     double z[16*2];
+ 
+-    double expected[16*20] = {
+-	   1.0000000000000000,  0.00000000000000000,
+-	   1.0000000000000000,  0.00000000000000000,
+-	  -1.0000000000000000,  0.00000000000000000,
+-	 -0.65893856175240950,  0.83459757287426684,
+-	 -0.65893856175240950, -0.83459757287426684,
+-	-0.070891117403341281,  -1.1359249087587791,
+-	-0.070891117403341281,   1.1359249087587791,
+-	   1.1142366961812986, -0.48083981203389980,
+-	   1.1142366961812986,  0.48083981203389980,
+-	  -1.3066982484920768,  0.00000000000000000,
+-	  0.57284747839410854,   1.1987808988289705,
+-	  0.57284747839410854,  -1.1987808988289705,
+-	  -1.6078107423472359,  0.00000000000000000,
+-	   2.0000000000000000,  0.00000000000000000,
+-	   2.0000000000000000,  0.00000000000000000 };
++    double expected[16*2] = {
++     -1.6078107423472359,    0.00000000000000000,
++     -1.3066982484920768,    0.00000000000000000,
++     -1.0000000000000000,    0.00000000000000000,
++     -0.65893856175240950,  -0.83459757287426684,
++     -0.65893856175240950,   0.83459757287426684,
++     -0.070891117403341281, -1.1359249087587791,
++     -0.070891117403341281,  1.1359249087587791,
++      0.57284747839410854,  -1.1987808988289705,
++      0.57284747839410854,   1.1987808988289705,
++      1.0000000000000000,    0.00000000000000000,
++      1.0000000000000000,    0.00000000000000000,
++      1.1142366961812986,   -0.48083981203389980,
++      1.1142366961812986,    0.48083981203389980,
++      2.0000000000000000,    0.00000000000000000,
++      2.0000000000000000,    0.00000000000000000 };
+ 
+     int i;
+ 
+-- 
+2.4.3
+
diff --git a/gnu/packages/patches/gsl-poly-test-fix-pt2.patch b/gnu/packages/patches/gsl-poly-test-fix-pt2.patch
new file mode 100644
index 0000000000..0e6fcf1a53
--- /dev/null
+++ b/gnu/packages/patches/gsl-poly-test-fix-pt2.patch
@@ -0,0 +1,27 @@
+From 0466df8660a7b6ddf2e082a1ec38bc6ea25a3c5c Mon Sep 17 00:00:00 2001
+From: Patrick Alken <alken@colorado.edu>
+Date: Mon, 7 Apr 2014 10:59:58 -0600
+Subject: [PATCH] change error test for 15th degree polynomial (bug #39055)
+
+---
+ poly/test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/poly/test.c b/poly/test.c
+index d090802..f6a7e3f 100644
+--- a/poly/test.c
++++ b/poly/test.c
+@@ -579,8 +579,8 @@ main (void)
+ 
+     for (i = 0; i<15; i++)
+       {
+-        gsl_test_abs (z[2*i], expected[2*i], 1e-7, "z%d.real, 15th-order polynomial", i);
+-        gsl_test_abs (z[2*i+1], expected[2*i+1], 1e-7, "z%d.imag, 15th-order polynomial", i);
++        gsl_test_rel (z[2*i], expected[2*i], 1e-7, "z%d.real, 15th-order polynomial", i);
++        gsl_test_rel (z[2*i+1], expected[2*i+1], 1e-7, "z%d.imag, 15th-order polynomial", i);
+       }
+   }
+ 
+-- 
+2.4.3
+
diff --git a/gnu/packages/patches/guile-linux-syscalls.patch b/gnu/packages/patches/guile-linux-syscalls.patch
index 73a062bda1..ac74d021d7 100644
--- a/gnu/packages/patches/guile-linux-syscalls.patch
+++ b/gnu/packages/patches/guile-linux-syscalls.patch
@@ -3,16 +3,15 @@ This patch adds bindings to Linux syscalls for which glibc has symbols.
 Using the FFI would have been nice, but that's not an option when using
 a statically-linked Guile in an initrd that doesn't have libc.so around.
 
-diff --git a/libguile/posix.c b/libguile/posix.c
-index 324f21b..cbee94d 100644
---- a/libguile/posix.c
-+++ b/libguile/posix.c
-@@ -2245,6 +2245,267 @@ scm_init_popen (void)
+--- guile-2.0.11/libguile/posix.c.orig	2014-02-28 15:01:27.000000000 -0500
++++ guile-2.0.11/libguile/posix.c	2015-06-21 14:28:23.624251038 -0400
+@@ -2245,6 +2245,269 @@
  }
  #endif
-
+ 
 +
 +/* Linux! */
++#ifdef __linux__
 +
 +#include <sys/mount.h>
 +#include "libguile/foreign.h"
@@ -271,6 +270,7 @@ index 324f21b..cbee94d 100644
 +  return scm_from_short (ifr.ifr_flags);
 +}
 +#undef FUNC_NAME
++#endif
 +
  void
  scm_init_posix ()
diff --git a/gnu/packages/patches/libtiff-CVE-2012-4564.patch b/gnu/packages/patches/libtiff-CVE-2012-4564.patch
new file mode 100644
index 0000000000..472f9ca35f
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2012-4564.patch
@@ -0,0 +1,33 @@
+Copied from Debian
+
+Index: tiff-4.0.3/tools/ppm2tiff.c
+===================================================================
+--- tiff-4.0.3.orig/tools/ppm2tiff.c	2013-06-23 10:36:50.779629492 -0400
++++ tiff-4.0.3/tools/ppm2tiff.c	2013-06-23 10:36:50.775629494 -0400
+@@ -89,6 +89,7 @@
+ 	int c;
+ 	extern int optind;
+ 	extern char* optarg;
++	tmsize_t scanline_size;
+ 
+ 	if (argc < 2) {
+ 	    fprintf(stderr, "%s: Too few arguments\n", argv[0]);
+@@ -237,8 +238,16 @@
+ 	}
+ 	if (TIFFScanlineSize(out) > linebytes)
+ 		buf = (unsigned char *)_TIFFmalloc(linebytes);
+-	else
+-		buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
++	else {
++		scanline_size = TIFFScanlineSize(out);
++		if (scanline_size != 0)
++			buf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
++		else {
++			fprintf(stderr, "%s: scanline size overflow\n",infile);
++			(void) TIFFClose(out);
++			exit(-2);
++			}
++		}
+ 	if (resolution > 0) {
+ 		TIFFSetField(out, TIFFTAG_XRESOLUTION, resolution);
+ 		TIFFSetField(out, TIFFTAG_YRESOLUTION, resolution);
diff --git a/gnu/packages/patches/libtiff-CVE-2013-1960.patch b/gnu/packages/patches/libtiff-CVE-2013-1960.patch
new file mode 100644
index 0000000000..341063f25d
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-1960.patch
@@ -0,0 +1,148 @@
+Copied from Debian
+
+Index: tiff-4.0.3/tools/tiff2pdf.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-06-23 10:36:50.979629486 -0400
++++ tiff-4.0.3/tools/tiff2pdf.c	2013-06-23 10:36:50.975629486 -0400
+@@ -3341,33 +3341,56 @@
+ 	uint32 height){
+ 
+ 	tsize_t i=0;
+-	uint16 ri =0;
+-	uint16 v_samp=1;
+-	uint16 h_samp=1;
+-	int j=0;
+-	
+-	i++;
+-	
+-	while(i<(*striplength)){
++
++	while (i < *striplength) {
++		tsize_t datalen;
++		uint16 ri;
++		uint16 v_samp;
++		uint16 h_samp;
++		int j;
++		int ncomp;
++
++		/* marker header: one or more FFs */
++		if (strip[i] != 0xff)
++			return(0);
++		i++;
++		while (i < *striplength && strip[i] == 0xff)
++			i++;
++		if (i >= *striplength)
++			return(0);
++		/* SOI is the only pre-SOS marker without a length word */
++		if (strip[i] == 0xd8)
++			datalen = 0;
++		else {
++			if ((*striplength - i) <= 2)
++				return(0);
++			datalen = (strip[i+1] << 8) | strip[i+2];
++			if (datalen < 2 || datalen >= (*striplength - i))
++				return(0);
++		}
+ 		switch( strip[i] ){
+-			case 0xd8:
+-				/* SOI - start of image */
++			case 0xd8:	/* SOI - start of image */
+ 				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), 2);
+ 				*bufferoffset+=2;
+-				i+=2;
+ 				break;
+-			case 0xc0:
+-			case 0xc1:
+-			case 0xc3:
+-			case 0xc9:
+-			case 0xca:
++			case 0xc0:	/* SOF0 */
++			case 0xc1:	/* SOF1 */
++			case 0xc3:	/* SOF3 */
++			case 0xc9:	/* SOF9 */
++			case 0xca:	/* SOF10 */
+ 				if(no==0){
+-					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+-					for(j=0;j<buffer[*bufferoffset+9];j++){
+-						if( (buffer[*bufferoffset+11+(2*j)]>>4) > h_samp) 
+-							h_samp = (buffer[*bufferoffset+11+(2*j)]>>4);
+-						if( (buffer[*bufferoffset+11+(2*j)] & 0x0f) > v_samp) 
+-							v_samp = (buffer[*bufferoffset+11+(2*j)] & 0x0f);
++					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++					ncomp = buffer[*bufferoffset+9];
++					if (ncomp < 1 || ncomp > 4)
++						return(0);
++					v_samp=1;
++					h_samp=1;
++					for(j=0;j<ncomp;j++){
++						uint16 samp = buffer[*bufferoffset+11+(3*j)];
++						if( (samp>>4) > h_samp) 
++							h_samp = (samp>>4);
++						if( (samp & 0x0f) > v_samp) 
++							v_samp = (samp & 0x0f);
+ 					}
+ 					v_samp*=8;
+ 					h_samp*=8;
+@@ -3381,45 +3404,43 @@
+                                           (unsigned char) ((height>>8) & 0xff);
+ 					buffer[*bufferoffset+6]=
+                                             (unsigned char) (height & 0xff);
+-					*bufferoffset+=strip[i+2]+2;
+-					i+=strip[i+2]+2;
+-
++					*bufferoffset+=datalen+2;
++					/* insert a DRI marker */
+ 					buffer[(*bufferoffset)++]=0xff;
+ 					buffer[(*bufferoffset)++]=0xdd;
+ 					buffer[(*bufferoffset)++]=0x00;
+ 					buffer[(*bufferoffset)++]=0x04;
+ 					buffer[(*bufferoffset)++]=(ri >> 8) & 0xff;
+ 					buffer[(*bufferoffset)++]= ri & 0xff;
+-				} else {
+-					i+=strip[i+2]+2;
+ 				}
+ 				break;
+-			case 0xc4:
+-			case 0xdb:
+-				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+-				*bufferoffset+=strip[i+2]+2;
+-				i+=strip[i+2]+2;
++			case 0xc4: /* DHT */
++			case 0xdb: /* DQT */
++				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++				*bufferoffset+=datalen+2;
+ 				break;
+-			case 0xda:
++			case 0xda: /* SOS */
+ 				if(no==0){
+-					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), strip[i+2]+2);
+-					*bufferoffset+=strip[i+2]+2;
+-					i+=strip[i+2]+2;
++					_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), datalen+2);
++					*bufferoffset+=datalen+2;
+ 				} else {
+ 					buffer[(*bufferoffset)++]=0xff;
+ 					buffer[(*bufferoffset)++]=
+                                             (unsigned char)(0xd0 | ((no-1)%8));
+-					i+=strip[i+2]+2;
+ 				}
+-				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i-1]), (*striplength)-i-1);
+-				*bufferoffset+=(*striplength)-i-1;
++				i += datalen + 1;
++				/* copy remainder of strip */
++				_TIFFmemcpy(&(buffer[*bufferoffset]), &(strip[i]), *striplength - i);
++				*bufferoffset+= *striplength - i;
+ 				return(1);
+ 			default:
+-				i+=strip[i+2]+2;
++				/* ignore any other marker */
++				break;
+ 		}
++		i += datalen + 1;
+ 	}
+-	
+ 
++	/* failed to find SOS marker */
+ 	return(0);
+ }
+ #endif
diff --git a/gnu/packages/patches/libtiff-CVE-2013-1961.patch b/gnu/packages/patches/libtiff-CVE-2013-1961.patch
new file mode 100644
index 0000000000..9c2481ce83
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-1961.patch
@@ -0,0 +1,770 @@
+Copied from Debian
+
+Index: tiff-4.0.3/contrib/dbs/xtiff/xtiff.c
+===================================================================
+--- tiff-4.0.3.orig/contrib/dbs/xtiff/xtiff.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/contrib/dbs/xtiff/xtiff.c	2013-06-23 10:36:51.147629484 -0400
+@@ -512,9 +512,9 @@
+     Arg args[1];
+ 
+     if (tfMultiPage)
+-        sprintf(buffer, "%s - page %d", fileName, tfDirectory);
++        snprintf(buffer, sizeof(buffer), "%s - page %d", fileName, tfDirectory);
+     else
+-        strcpy(buffer, fileName);
++        snprintf(buffer, sizeof(buffer), "%s", fileName);
+     XtSetArg(args[0], XtNlabel, buffer);
+     XtSetValues(labelWidget, args, 1);
+ }
+Index: tiff-4.0.3/libtiff/tif_dirinfo.c
+===================================================================
+--- tiff-4.0.3.orig/libtiff/tif_dirinfo.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/libtiff/tif_dirinfo.c	2013-06-23 10:36:51.147629484 -0400
+@@ -711,7 +711,7 @@
+ 	 * note that this name is a special sign to TIFFClose() and
+ 	 * _TIFFSetupFields() to free the field
+ 	 */
+-	sprintf(fld->field_name, "Tag %d", (int) tag);
++	snprintf(fld->field_name, 32, "Tag %d", (int) tag);
+ 
+ 	return fld;    
+ }
+Index: tiff-4.0.3/libtiff/tif_codec.c
+===================================================================
+--- tiff-4.0.3.orig/libtiff/tif_codec.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/libtiff/tif_codec.c	2013-06-23 10:36:51.151629482 -0400
+@@ -108,7 +108,8 @@
+ 	const TIFFCodec* c = TIFFFindCODEC(tif->tif_dir.td_compression);
+         char compression_code[20];
+         
+-        sprintf( compression_code, "%d", tif->tif_dir.td_compression );
++        snprintf(compression_code, sizeof(compression_code), "%d",
++		 tif->tif_dir.td_compression );
+ 	TIFFErrorExt(tif->tif_clientdata, tif->tif_name,
+                      "%s compression support is not configured", 
+                      c ? c->name : compression_code );
+Index: tiff-4.0.3/tools/tiffdither.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiffdither.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/tiffdither.c	2013-06-23 10:36:51.151629482 -0400
+@@ -260,7 +260,7 @@
+ 		TIFFSetField(out, TIFFTAG_FILLORDER, fillorder);
+ 	else
+ 		CopyField(TIFFTAG_FILLORDER, shortv);
+-	sprintf(thing, "Dithered B&W version of %s", argv[optind]);
++	snprintf(thing, sizeof(thing), "Dithered B&W version of %s", argv[optind]);
+ 	TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
+ 	CopyField(TIFFTAG_PHOTOMETRIC, shortv);
+ 	CopyField(TIFFTAG_ORIENTATION, shortv);
+Index: tiff-4.0.3/tools/rgb2ycbcr.c
+===================================================================
+--- tiff-4.0.3.orig/tools/rgb2ycbcr.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/rgb2ycbcr.c	2013-06-23 10:36:51.151629482 -0400
+@@ -332,7 +332,8 @@
+ 	TIFFSetField(out, TIFFTAG_PLANARCONFIG, PLANARCONFIG_CONTIG);
+ 	{ char buf[2048];
+ 	  char *cp = strrchr(TIFFFileName(in), '/');
+-	  sprintf(buf, "YCbCr conversion of %s", cp ? cp+1 : TIFFFileName(in));
++	  snprintf(buf, sizeof(buf), "YCbCr conversion of %s",
++		   cp ? cp+1 : TIFFFileName(in));
+ 	  TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, buf);
+ 	}
+ 	TIFFSetField(out, TIFFTAG_SOFTWARE, TIFFGetVersion());
+Index: tiff-4.0.3/tools/tiff2pdf.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/tiff2pdf.c	2013-06-23 10:36:51.151629482 -0400
+@@ -3630,7 +3630,9 @@
+ 	char buffer[16];
+ 	int buflen=0;
+ 	
+-	buflen=sprintf(buffer, "%%PDF-%u.%u ", t2p->pdf_majorversion&0xff, t2p->pdf_minorversion&0xff);
++	buflen = snprintf(buffer, sizeof(buffer), "%%PDF-%u.%u ",
++			  t2p->pdf_majorversion&0xff,
++			  t2p->pdf_minorversion&0xff);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t)"\n%\342\343\317\323\n", 7);
+ 
+@@ -3644,10 +3646,10 @@
+ tsize_t t2p_write_pdf_obj_start(uint32 number, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+-	buflen=sprintf(buffer, "%lu", (unsigned long)number);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen );
+ 	written += t2pWriteFile(output, (tdata_t) " 0 obj\n", 7);
+ 
+@@ -3686,13 +3688,13 @@
+ 	written += t2pWriteFile(output, (tdata_t) "/", 1);
+ 	for (i=0;i<namelen;i++){
+ 		if ( ((unsigned char)name[i]) < 0x21){
+-			sprintf(buffer, "#%.2X", name[i]);
++			snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 			buffer[sizeof(buffer) - 1] = '\0';
+ 			written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 			nextchar=1;
+ 		}
+ 		if ( ((unsigned char)name[i]) > 0x7E){
+-			sprintf(buffer, "#%.2X", name[i]);
++			snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 			buffer[sizeof(buffer) - 1] = '\0';
+ 			written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 			nextchar=1;
+@@ -3700,57 +3702,57 @@
+ 		if (nextchar==0){
+ 			switch (name[i]){
+ 				case 0x23:
+-					sprintf(buffer, "#%.2X", name[i]);
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x25:
+-					sprintf(buffer, "#%.2X", name[i]);
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x28:
+-					sprintf(buffer, "#%.2X", name[i]);
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x29:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x2F:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x3C:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x3E:
+-					sprintf(buffer, "#%.2X", name[i]);
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x5B:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x5D:
+-					sprintf(buffer, "#%.2X", name[i]);
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]);
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x7B:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+ 				case 0x7D:
+-					sprintf(buffer, "#%.2X", name[i]); 
++					snprintf(buffer, sizeof(buffer), "#%.2X", name[i]); 
+ 					buffer[sizeof(buffer) - 1] = '\0';
+ 					written += t2pWriteFile(output, (tdata_t) buffer, 3);
+ 					break;
+@@ -3865,14 +3867,14 @@
+ tsize_t t2p_write_pdf_stream_dict(tsize_t len, uint32 number, TIFF* output){
+ 	
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 	
+ 	written += t2pWriteFile(output, (tdata_t) "/Length ", 8);
+ 	if(len!=0){
+ 		written += t2p_write_pdf_stream_length(len, output);
+ 	} else {
+-		buflen=sprintf(buffer, "%lu", (unsigned long)number);
++		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)number);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ 	}
+@@ -3913,10 +3915,10 @@
+ tsize_t t2p_write_pdf_stream_length(tsize_t len, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+-	buflen=sprintf(buffer, "%lu", (unsigned long)len);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)len);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "\n", 1);
+ 
+@@ -3930,7 +3932,7 @@
+ tsize_t t2p_write_pdf_catalog(T2P* t2p, TIFF* output)
+ {
+ 	tsize_t written = 0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen = 0;
+ 
+ 	written += t2pWriteFile(output, 
+@@ -3969,7 +3971,6 @@
+ 		written += t2p_write_pdf_string(t2p->pdf_datetime, output);
+ 	}
+ 	written += t2pWriteFile(output, (tdata_t) "\n/Producer ", 11);
+-	_TIFFmemset((tdata_t)buffer, 0x00, sizeof(buffer));
+ 	snprintf(buffer, sizeof(buffer), "libtiff / tiff2pdf - %d", TIFFLIB_VERSION);
+ 	written += t2p_write_pdf_string(buffer, output);
+ 	written += t2pWriteFile(output, (tdata_t) "\n", 1);
+@@ -4110,7 +4111,7 @@
+ {
+ 	tsize_t written=0;
+ 	tdir_t i=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+ 	int page=0;
+@@ -4118,7 +4119,7 @@
+ 		(tdata_t) "<< \n/Type /Pages \n/Kids [ ", 26);
+ 	page = t2p->pdf_pages+1;
+ 	for (i=0;i<t2p->tiff_pagecount;i++){
+-		buflen=sprintf(buffer, "%d", page);
++		buflen=snprintf(buffer, sizeof(buffer), "%d", page);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+ 		if ( ((i+1)%8)==0 ) {
+@@ -4133,8 +4134,7 @@
+ 		}
+ 	}
+ 	written += t2pWriteFile(output, (tdata_t) "] \n/Count ", 10);
+-	_TIFFmemset(buffer, 0x00, 16);
+-	buflen=sprintf(buffer, "%d", t2p->tiff_pagecount);
++	buflen=snprintf(buffer, sizeof(buffer), "%d", t2p->tiff_pagecount);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " \n>> \n", 6);
+ 
+@@ -4149,28 +4149,28 @@
+ 
+ 	unsigned int i=0;
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[256];
+ 	int buflen=0;
+ 
+ 	written += t2pWriteFile(output, (tdata_t) "<<\n/Type /Page \n/Parent ", 24);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_pages);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_pages);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ 	written += t2pWriteFile(output, (tdata_t) "/MediaBox [", 11); 
+-	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x1);
++	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x1);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
+-	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y1);
++	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y1);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
+-	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.x2);
++	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.x2);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " ", 1); 
+-	buflen=sprintf(buffer, "%.4f",t2p->pdf_mediabox.y2);
++	buflen=snprintf(buffer, sizeof(buffer), "%.4f",t2p->pdf_mediabox.y2);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "] \n", 3); 
+ 	written += t2pWriteFile(output, (tdata_t) "/Contents ", 10);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)(object + 1));
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(object + 1));
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " 0 R \n", 6);
+ 	written += t2pWriteFile(output, (tdata_t) "/Resources << \n", 15);
+@@ -4178,15 +4178,13 @@
+ 		written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
+ 		for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount;i++){
+ 			written += t2pWriteFile(output, (tdata_t) "/Im", 3);
+-			buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
++			buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) "_", 1);
+-			buflen = sprintf(buffer, "%u", i+1);
++			buflen = snprintf(buffer, sizeof(buffer), "%u", i+1);
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) " ", 1);
+-			buflen = sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); 
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4198,12 +4196,10 @@
+ 	} else {
+ 			written += t2pWriteFile(output, (tdata_t) "/XObject <<\n", 12);
+ 			written += t2pWriteFile(output, (tdata_t) "/Im", 3);
+-			buflen = sprintf(buffer, "%u", t2p->pdf_page+1);
++			buflen = snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) " ", 1);
+-			buflen = sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)(object+3+(2*i)+t2p->tiff_pages[t2p->pdf_page].page_extra)); 
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4212,9 +4208,7 @@
+ 	if(t2p->tiff_transferfunctioncount != 0) {
+ 		written += t2pWriteFile(output, (tdata_t) "/ExtGState <<", 13);
+ 		t2pWriteFile(output, (tdata_t) "/GS1 ", 5);
+-		buflen = sprintf(
+-			buffer, 
+-			"%lu", 
++		buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ 			(unsigned long)(object + 3)); 
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4587,7 +4581,7 @@
+ 	if(t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount>0){ 
+ 		for(i=0;i<t2p->tiff_tiles[t2p->pdf_page].tiles_tilecount; i++){
+ 			box=t2p->tiff_tiles[t2p->pdf_page].tiles_tiles[i].tile_box;
+-			buflen=sprintf(buffer, 
++			buflen=snprintf(buffer, sizeof(buffer), 
+ 				"q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d_%ld Do Q\n", 
+ 				t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
+ 				box.mat[0],
+@@ -4602,7 +4596,7 @@
+ 		}
+ 	} else {
+ 		box=t2p->pdf_imagebox;
+-		buflen=sprintf(buffer, 
++		buflen=snprintf(buffer, sizeof(buffer), 
+ 			"q %s %.4f %.4f %.4f %.4f %.4f %.4f cm /Im%d Do Q\n", 
+ 			t2p->tiff_transferfunctioncount?"/GS1 gs ":"",
+ 			box.mat[0],
+@@ -4627,59 +4621,48 @@
+ 												TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+ 	written += t2p_write_pdf_stream_dict(0, t2p->pdf_xrefcount+1, output); 
+ 	written += t2pWriteFile(output, 
+ 		(tdata_t) "/Type /XObject \n/Subtype /Image \n/Name /Im", 
+ 		42);
+-	buflen=sprintf(buffer, "%u", t2p->pdf_page+1);
++	buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_page+1);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	if(tile != 0){
+ 		written += t2pWriteFile(output, (tdata_t) "_", 1);
+-		buflen=sprintf(buffer, "%lu", (unsigned long)tile);
++		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)tile);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	}
+ 	written += t2pWriteFile(output, (tdata_t) "\n/Width ", 8);
+-	_TIFFmemset((tdata_t)buffer, 0x00, 16);
+ 	if(tile==0){
+-		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_width);
++		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_width);
+ 	} else {
+ 		if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
+-			buflen=sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
+ 		} else {
+-			buflen=sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
+ 		}
+ 	}
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "\n/Height ", 9);
+-	_TIFFmemset((tdata_t)buffer, 0x00, 16);
+ 	if(tile==0){
+-		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->tiff_length);
++		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->tiff_length);
+ 	} else {
+ 		if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)!=0){
+-			buflen=sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
+ 		} else {
+-			buflen=sprintf(
+-				buffer, 
+-				"%lu", 
++			buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 				(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
+ 		}
+ 	}
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "\n/BitsPerComponent ", 19);
+-	_TIFFmemset((tdata_t)buffer, 0x00, 16);
+-	buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
++	buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "\n/ColorSpace ", 13);
+ 	written += t2p_write_pdf_xobject_cs(t2p, output);
+@@ -4723,11 +4706,10 @@
+ 		t2p->pdf_colorspace ^= T2P_CS_PALETTE;
+ 		written += t2p_write_pdf_xobject_cs(t2p, output);
+ 		t2p->pdf_colorspace |= T2P_CS_PALETTE;
+-		buflen=sprintf(buffer, "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
++		buflen=snprintf(buffer, sizeof(buffer), "%u", (0x0001 << t2p->tiff_bitspersample)-1 );
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " ", 1);
+-		_TIFFmemset(buffer, 0x00, 16);
+-		buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_palettecs ); 
++		buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_palettecs ); 
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ]\n", 7);
+ 		return(written);
+@@ -4761,10 +4743,10 @@
+ 			X_W /= Y_W;
+ 			Z_W /= Y_W;
+ 			Y_W = 1.0F;
+-			buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++			buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ 			written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			written += t2pWriteFile(output, (tdata_t) "/Range ", 7);
+-			buflen=sprintf(buffer, "[%d %d %d %d] \n", 
++			buflen=snprintf(buffer, sizeof(buffer), "[%d %d %d %d] \n", 
+ 				t2p->pdf_labrange[0], 
+ 				t2p->pdf_labrange[1], 
+ 				t2p->pdf_labrange[2], 
+@@ -4780,26 +4762,26 @@
+ tsize_t t2p_write_pdf_transfer(T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+ 	written += t2pWriteFile(output, (tdata_t) "<< /Type /ExtGState \n/TR ", 25);
+ 	if(t2p->tiff_transferfunctioncount == 1){
+-		buflen=sprintf(buffer, "%lu",
++		buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 			       (unsigned long)(t2p->pdf_xrefcount + 1));
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+ 	} else {
+ 		written += t2pWriteFile(output, (tdata_t) "[ ", 2);
+-		buflen=sprintf(buffer, "%lu",
++		buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 			       (unsigned long)(t2p->pdf_xrefcount + 1));
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+-		buflen=sprintf(buffer, "%lu",
++		buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 			       (unsigned long)(t2p->pdf_xrefcount + 2));
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+-		buflen=sprintf(buffer, "%lu",
++		buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 			       (unsigned long)(t2p->pdf_xrefcount + 3));
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) " 0 R ", 5);
+@@ -4821,7 +4803,7 @@
+ 	written += t2pWriteFile(output, (tdata_t) "/FunctionType 0 \n", 17);
+ 	written += t2pWriteFile(output, (tdata_t) "/Domain [0.0 1.0] \n", 19);
+ 	written += t2pWriteFile(output, (tdata_t) "/Range [0.0 1.0] \n", 18);
+-	buflen=sprintf(buffer, "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
++	buflen=snprintf(buffer, sizeof(buffer), "/Size [%u] \n", (1<<t2p->tiff_bitspersample));
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "/BitsPerSample 16 \n", 19);
+ 	written += t2p_write_pdf_stream_dict(((tsize_t)1)<<(t2p->tiff_bitspersample+1), 0, output);
+@@ -4848,7 +4830,7 @@
+ tsize_t t2p_write_pdf_xobject_calcs(T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[128];
++	char buffer[256];
+ 	int buflen=0;
+ 	
+ 	float X_W=0.0;
+@@ -4916,16 +4898,16 @@
+ 	written += t2pWriteFile(output, (tdata_t) "<< \n", 4);
+ 	if(t2p->pdf_colorspace & T2P_CS_CALGRAY){
+ 		written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
+-		buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) "/Gamma 2.2 \n", 12);
+ 	}
+ 	if(t2p->pdf_colorspace & T2P_CS_CALRGB){
+ 		written += t2pWriteFile(output, (tdata_t) "/WhitePoint ", 12);
+-		buflen=sprintf(buffer, "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
++		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f] \n", X_W, Y_W, Z_W);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 		written += t2pWriteFile(output, (tdata_t) "/Matrix ", 8);
+-		buflen=sprintf(buffer, "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", 
++		buflen=snprintf(buffer, sizeof(buffer), "[%.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f %.4f] \n", 
+ 			X_R, Y_R, Z_R, 
+ 			X_G, Y_G, Z_G, 
+ 			X_B, Y_B, Z_B); 
+@@ -4944,11 +4926,11 @@
+ tsize_t t2p_write_pdf_xobject_icccs(T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 	
+ 	written += t2pWriteFile(output, (tdata_t) "[/ICCBased ", 11);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_icccs);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_icccs);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " 0 R] \n", 7);
+ 
+@@ -4958,11 +4940,11 @@
+ tsize_t t2p_write_pdf_xobject_icccs_dict(T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 	
+ 	written += t2pWriteFile(output, (tdata_t) "/N ", 3);
+-	buflen=sprintf(buffer, "%u \n", t2p->tiff_samplesperpixel);
++	buflen=snprintf(buffer, sizeof(buffer), "%u \n", t2p->tiff_samplesperpixel);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) "/Alternate ", 11);
+ 	t2p->pdf_colorspace ^= T2P_CS_ICCBASED;
+@@ -5027,7 +5009,7 @@
+ tsize_t t2p_write_pdf_xobject_stream_filter(ttile_t tile, T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[16];
++	char buffer[32];
+ 	int buflen=0;
+ 
+ 	if(t2p->pdf_compression==T2P_COMPRESS_NONE){
+@@ -5042,41 +5024,33 @@
+ 			written += t2pWriteFile(output, (tdata_t) "<< /K -1 ", 9);
+ 			if(tile==0){
+ 				written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+-				buflen=sprintf(buffer, "%lu",
++				buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 					       (unsigned long)t2p->tiff_width);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+-				buflen=sprintf(buffer, "%lu",
++				buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 					       (unsigned long)t2p->tiff_length);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 			} else {
+ 				if(t2p_tile_is_right_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
+ 					written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+-					buflen=sprintf(
+-						buffer, 
+-						"%lu", 
++					buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilewidth);
+ 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				} else {
+ 					written += t2pWriteFile(output, (tdata_t) "/Columns ", 9);
+-					buflen=sprintf(
+-						buffer, 
+-						"%lu", 
++					buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilewidth);
+ 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				}
+ 				if(t2p_tile_is_bottom_edge(t2p->tiff_tiles[t2p->pdf_page], tile-1)==0){
+ 					written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+-					buflen=sprintf(
+-						buffer, 
+-						"%lu", 
++					buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_tilelength);
+ 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				} else {
+ 					written += t2pWriteFile(output, (tdata_t) " /Rows ", 7);
+-					buflen=sprintf(
+-						buffer, 
+-						"%lu", 
++					buflen=snprintf(buffer, sizeof(buffer), "%lu",
+ 						(unsigned long)t2p->tiff_tiles[t2p->pdf_page].tiles_edgetilelength);
+ 					written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				}
+@@ -5103,21 +5077,17 @@
+ 			if(t2p->pdf_compressionquality%100){
+ 				written += t2pWriteFile(output, (tdata_t) "/DecodeParms ", 13);
+ 				written += t2pWriteFile(output, (tdata_t) "<< /Predictor ", 14);
+-				_TIFFmemset(buffer, 0x00, 16);
+-				buflen=sprintf(buffer, "%u", t2p->pdf_compressionquality%100);
++				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->pdf_compressionquality%100);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				written += t2pWriteFile(output, (tdata_t) " /Columns ", 10);
+-				_TIFFmemset(buffer, 0x00, 16);
+-				buflen = sprintf(buffer, "%lu",
++				buflen = snprintf(buffer, sizeof(buffer), "%lu",
+ 						 (unsigned long)t2p->tiff_width);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				written += t2pWriteFile(output, (tdata_t) " /Colors ", 9);
+-				_TIFFmemset(buffer, 0x00, 16);
+-				buflen=sprintf(buffer, "%u", t2p->tiff_samplesperpixel);
++				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_samplesperpixel);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				written += t2pWriteFile(output, (tdata_t) " /BitsPerComponent ", 19);
+-				_TIFFmemset(buffer, 0x00, 16);
+-				buflen=sprintf(buffer, "%u", t2p->tiff_bitspersample);
++				buflen=snprintf(buffer, sizeof(buffer), "%u", t2p->tiff_bitspersample);
+ 				written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 				written += t2pWriteFile(output, (tdata_t) ">>\n", 3);
+ 			}
+@@ -5137,16 +5107,16 @@
+ tsize_t t2p_write_pdf_xreftable(T2P* t2p, TIFF* output){
+ 
+ 	tsize_t written=0;
+-	char buffer[21];
++	char buffer[64];
+ 	int buflen=0;
+ 	uint32 i=0;
+ 
+ 	written += t2pWriteFile(output, (tdata_t) "xref\n0 ", 7);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount + 1));
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+ 	written += t2pWriteFile(output, (tdata_t) " \n0000000000 65535 f \n", 22);
+ 	for (i=0;i<t2p->pdf_xrefcount;i++){
+-		sprintf(buffer, "%.10lu 00000 n \n",
++		snprintf(buffer, sizeof(buffer), "%.10lu 00000 n \n",
+ 			(unsigned long)t2p->pdf_xrefoffsets[i]);
+ 		written += t2pWriteFile(output, (tdata_t) buffer, 20);
+ 	}
+@@ -5170,17 +5140,14 @@
+ 		snprintf(t2p->pdf_fileid + i, 9, "%.8X", rand());
+ 
+ 	written += t2pWriteFile(output, (tdata_t) "trailer\n<<\n/Size ", 17);
+-	buflen = sprintf(buffer, "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
++	buflen = snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)(t2p->pdf_xrefcount+1));
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+-	_TIFFmemset(buffer, 0x00, 32);	
+ 	written += t2pWriteFile(output, (tdata_t) "\n/Root ", 7);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_catalog);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_catalog);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+-	_TIFFmemset(buffer, 0x00, 32);	
+ 	written += t2pWriteFile(output, (tdata_t) " 0 R \n/Info ", 12);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_info);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_info);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+-	_TIFFmemset(buffer, 0x00, 32);	
+ 	written += t2pWriteFile(output, (tdata_t) " 0 R \n/ID[<", 11);
+ 	written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
+ 				sizeof(t2p->pdf_fileid) - 1);
+@@ -5188,9 +5155,8 @@
+ 	written += t2pWriteFile(output, (tdata_t) t2p->pdf_fileid,
+ 				sizeof(t2p->pdf_fileid) - 1);
+ 	written += t2pWriteFile(output, (tdata_t) ">]\n>>\nstartxref\n", 16);
+-	buflen=sprintf(buffer, "%lu", (unsigned long)t2p->pdf_startxref);
++	buflen=snprintf(buffer, sizeof(buffer), "%lu", (unsigned long)t2p->pdf_startxref);
+ 	written += t2pWriteFile(output, (tdata_t) buffer, buflen);
+-	_TIFFmemset(buffer, 0x00, 32);	
+ 	written += t2pWriteFile(output, (tdata_t) "\n%%EOF\n", 7);
+ 
+ 	return(written);
+Index: tiff-4.0.3/tools/tiff2ps.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2ps.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/tiff2ps.c	2013-06-23 10:36:51.155629481 -0400
+@@ -1781,8 +1781,8 @@
+ 		imageOp = "imagemask";
+ 
+ 	(void)strcpy(im_x, "0");
+-	(void)sprintf(im_y, "%lu", (long) h);
+-	(void)sprintf(im_h, "%lu", (long) h);
++	(void)snprintf(im_y, sizeof(im_y), "%lu", (long) h);
++	(void)snprintf(im_h, sizeof(im_h), "%lu", (long) h);
+ 	tile_width = w;
+ 	tile_height = h;
+ 	if (TIFFIsTiled(tif)) {
+@@ -1803,7 +1803,7 @@
+ 		}
+ 		if (tile_height < h) {
+ 			fputs("/im_y 0 def\n", fd);
+-			(void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
++			(void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
+ 		}
+ 	} else {
+ 		repeat_count = tf_numberstrips;
+@@ -1815,7 +1815,7 @@
+ 			fprintf(fd, "/im_h %lu def\n",
+ 			    (unsigned long) tile_height);
+ 			(void)strcpy(im_h, "im_h");
+-			(void)sprintf(im_y, "%lu im_y sub", (unsigned long) h);
++			(void)snprintf(im_y, sizeof(im_y), "%lu im_y sub", (unsigned long) h);
+ 		}
+ 	}
+ 
+Index: tiff-4.0.3/tools/tiffcrop.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiffcrop.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/tiffcrop.c	2013-06-23 10:36:51.159629481 -0400
+@@ -2077,7 +2077,7 @@
+         return 1;
+         }
+ 
+-      sprintf (filenum, "-%03d%s", findex, export_ext);
++      snprintf(filenum, sizeof(filenum), "-%03d%s", findex, export_ext);
+       filenum[14] = '\0';
+       strncat (exportname, filenum, 15);
+       }
+@@ -2230,8 +2230,8 @@
+ 
+           /* dump.infilename is guaranteed to be NUL termimated and have 20 bytes 
+              fewer than PATH_MAX */ 
+-          memset (temp_filename, '\0', PATH_MAX + 1);              
+-          sprintf (temp_filename, "%s-read-%03d.%s", dump.infilename, dump_images,
++          snprintf(temp_filename, sizeof(temp_filename), "%s-read-%03d.%s",
++		   dump.infilename, dump_images,
+                   (dump.format == DUMP_TEXT) ? "txt" : "raw");
+           if ((dump.infile = fopen(temp_filename, dump.mode)) == NULL)
+             {
+@@ -2249,8 +2249,8 @@
+ 
+           /* dump.outfilename is guaranteed to be NUL termimated and have 20 bytes 
+              fewer than PATH_MAX */ 
+-          memset (temp_filename, '\0', PATH_MAX + 1);              
+-          sprintf (temp_filename, "%s-write-%03d.%s", dump.outfilename, dump_images,
++          snprintf(temp_filename, sizeof(temp_filename), "%s-write-%03d.%s",
++		   dump.outfilename, dump_images,
+                   (dump.format == DUMP_TEXT) ? "txt" : "raw");
+           if ((dump.outfile = fopen(temp_filename, dump.mode)) == NULL)
+             {
+Index: tiff-4.0.3/tools/tiff2bw.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2bw.c	2013-06-23 10:36:51.163629483 -0400
++++ tiff-4.0.3/tools/tiff2bw.c	2013-06-23 10:36:51.159629481 -0400
+@@ -205,7 +205,7 @@
+ 		}
+ 	}
+ 	TIFFSetField(out, TIFFTAG_PHOTOMETRIC, PHOTOMETRIC_MINISBLACK);
+-	sprintf(thing, "B&W version of %s", argv[optind]);
++	snprintf(thing, sizeof(thing), "B&W version of %s", argv[optind]);
+ 	TIFFSetField(out, TIFFTAG_IMAGEDESCRIPTION, thing);
+ 	TIFFSetField(out, TIFFTAG_SOFTWARE, "tiff2bw");
+ 	outbuf = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(out));
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4231.patch b/gnu/packages/patches/libtiff-CVE-2013-4231.patch
new file mode 100644
index 0000000000..c71f7dac2e
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-4231.patch
@@ -0,0 +1,19 @@
+Copied from Debian
+
+Description: Buffer overflow in gif2tiff
+Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2450
+Bug-Debian: http://bugs.debian.org/719303
+
+Index: tiff-4.0.3/tools/gif2tiff.c
+===================================================================
+--- tiff-4.0.3.orig/tools/gif2tiff.c	2013-08-22 11:46:11.960846910 -0400
++++ tiff-4.0.3/tools/gif2tiff.c	2013-08-22 11:46:11.956846910 -0400
+@@ -333,6 +333,8 @@
+     int status = 1;
+ 
+     datasize = getc(infile);
++    if (datasize > 12)
++	return 0;
+     clear = 1 << datasize;
+     eoi = clear + 1;
+     avail = clear + 2;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4232.patch b/gnu/packages/patches/libtiff-CVE-2013-4232.patch
new file mode 100644
index 0000000000..3a92f61fef
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-4232.patch
@@ -0,0 +1,20 @@
+Copied from Debian
+
+Description: use after free in tiff2pdf
+Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2449
+Bug-Debian: http://bugs.debian.org/719303
+
+Index: tiff-4.0.3/tools/tiff2pdf.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2pdf.c	2013-08-22 11:46:37.292847242 -0400
++++ tiff-4.0.3/tools/tiff2pdf.c	2013-08-22 11:46:37.292847242 -0400
+@@ -2461,7 +2461,8 @@
+ 					(unsigned long) t2p->tiff_datasize, 
+ 					TIFFFileName(input));
+ 				t2p->t2p_error = T2P_ERR_ERROR;
+-			  _TIFFfree(buffer);
++				_TIFFfree(buffer);
++				return(0);
+ 			} else {
+ 				buffer=samplebuffer;
+ 				t2p->tiff_datasize *= t2p->tiff_samplesperpixel;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4243.patch b/gnu/packages/patches/libtiff-CVE-2013-4243.patch
new file mode 100644
index 0000000000..a10884cd89
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-4243.patch
@@ -0,0 +1,39 @@
+Copied from Debian
+
+Index: tiff/tools/gif2tiff.c
+===================================================================
+--- tiff.orig/tools/gif2tiff.c
++++ tiff/tools/gif2tiff.c
+@@ -280,6 +280,10 @@ readgifimage(char* mode)
+         fprintf(stderr, "no colormap present for image\n");
+         return (0);
+     }
++    if (width == 0 || height == 0) {
++        fprintf(stderr, "Invalid value of width or height\n");
++        return(0);
++    }
+     if ((raster = (unsigned char*) _TIFFmalloc(width*height+EXTRAFUDGE)) == NULL) {
+         fprintf(stderr, "not enough memory for image\n");
+         return (0);
+@@ -404,6 +408,10 @@ process(register int code, unsigned char
+             fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
+             return 0;
+         }
++        if (*fill >= raster + width*height) {
++            fprintf(stderr, "raster full before eoi code\n");
++            return 0;
++        }
+ 	*(*fill)++ = suffix[code];
+ 	firstchar = oldcode = code;
+ 	return 1;
+@@ -434,6 +442,10 @@ process(register int code, unsigned char
+     }
+     oldcode = incode;
+     do {
++        if (*fill >= raster + width*height) {
++            fprintf(stderr, "raster full before eoi code\n");
++            return 0;
++        }
+ 	*(*fill)++ = *--stackp;
+     } while (stackp > stack);
+     return 1;
diff --git a/gnu/packages/patches/libtiff-CVE-2013-4244.patch b/gnu/packages/patches/libtiff-CVE-2013-4244.patch
new file mode 100644
index 0000000000..be9c65c311
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2013-4244.patch
@@ -0,0 +1,20 @@
+Copied from Debian
+
+Description: OOB write in gif2tiff
+Bug-Redhat: https://bugzilla.redhat.com/show_bug.cgi?id=996468
+
+Index: tiff-4.0.3/tools/gif2tiff.c
+===================================================================
+--- tiff-4.0.3.orig/tools/gif2tiff.c	2013-08-24 11:17:13.546447901 -0400
++++ tiff-4.0.3/tools/gif2tiff.c	2013-08-24 11:17:13.546447901 -0400
+@@ -400,6 +400,10 @@
+     }
+ 
+     if (oldcode == -1) {
++        if (code >= clear) {
++            fprintf(stderr, "bad input: code=%d is larger than clear=%d\n",code, clear);
++            return 0;
++        }
+ 	*(*fill)++ = suffix[code];
+ 	firstchar = oldcode = code;
+ 	return 1;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch
new file mode 100644
index 0000000000..7f70edb86f
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8127-pt1.patch
@@ -0,0 +1,30 @@
+Copied from Debian
+
+From 0782c759084daaf9e4de7ee6be7543081823455e Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 20:58:29 +0000
+Subject: [PATCH] * tools/tiff2bw.c: when Photometric=RGB, the utility only
+ works if SamplesPerPixel = 3. Enforce that
+ http://bugzilla.maptools.org/show_bug.cgi?id=2485 (CVE-2014-8127)
+
+---
+ ChangeLog       | 6 ++++++
+ tools/tiff2bw.c | 5 +++++
+ 2 files changed, 11 insertions(+)
+
+diff --git a/tools/tiff2bw.c b/tools/tiff2bw.c
+index 22467cd..94b8e31 100644
+--- a/tools/tiff2bw.c
++++ b/tools/tiff2bw.c
+@@ -171,6 +171,11 @@ main(int argc, char* argv[])
+ 		    argv[optind], samplesperpixel);
+ 		return (-1);
+ 	}
++	if( photometric == PHOTOMETRIC_RGB && samplesperpixel != 3) {
++		fprintf(stderr, "%s: Bad samples/pixel %u for PHOTOMETRIC_RGB.\n",
++		    argv[optind], samplesperpixel);
++		return (-1);
++	}
+ 	TIFFGetField(in, TIFFTAG_BITSPERSAMPLE, &bitspersample);
+ 	if (bitspersample != 8) {
+ 		fprintf(stderr,
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch
new file mode 100644
index 0000000000..a177ebfa21
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8127-pt2.patch
@@ -0,0 +1,42 @@
+Copied from Debian
+
+From 3996fa0f84f4a8b7e65fe4b8f0681711022034ea Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 20:04:31 +0000
+Subject: [PATCH] * tools/pal2rgb.c, tools/thumbnail.c: fix crash by disabling
+ TIFFTAG_INKNAMES copying. The right fix would be to properly copy it, but not
+ worth the burden for those esoteric utilities.
+ http://bugzilla.maptools.org/show_bug.cgi?id=2484 (CVE-2014-8127)
+
+---
+ ChangeLog         | 7 +++++++
+ tools/pal2rgb.c   | 2 +-
+ tools/thumbnail.c | 2 +-
+ 3 files changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/tools/pal2rgb.c b/tools/pal2rgb.c
+index bfe7899..3fc3de3 100644
+--- a/tools/pal2rgb.c
++++ b/tools/pal2rgb.c
+@@ -372,7 +372,7 @@ static struct cpTag {
+     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
+     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
+     { TIFFTAG_INKSET,			1, TIFF_SHORT },
+-    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
++    /*{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },*/ /* Needs much more complicated logic. See tiffcp */
+     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
+     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
+     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
+diff --git a/tools/thumbnail.c b/tools/thumbnail.c
+index c50bbff..73f9c34 100644
+--- a/tools/thumbnail.c
++++ b/tools/thumbnail.c
+@@ -257,7 +257,7 @@ static struct cpTag {
+     { TIFFTAG_CLEANFAXDATA,		1, TIFF_SHORT },
+     { TIFFTAG_CONSECUTIVEBADFAXLINES,	1, TIFF_LONG },
+     { TIFFTAG_INKSET,			1, TIFF_SHORT },
+-    { TIFFTAG_INKNAMES,			1, TIFF_ASCII },
++    /*{ TIFFTAG_INKNAMES,			1, TIFF_ASCII },*/ /* Needs much more complicated logic. See tiffcp */
+     { TIFFTAG_DOTRANGE,			2, TIFF_SHORT },
+     { TIFFTAG_TARGETPRINTER,		1, TIFF_ASCII },
+     { TIFFTAG_SAMPLEFORMAT,		1, TIFF_SHORT },
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch
new file mode 100644
index 0000000000..b8a3703c4c
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8127-pt3.patch
@@ -0,0 +1,45 @@
+Copied from Debian
+
+From 1f7359b00663804d96c3a102bcb6ead9812c1509 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Tue, 23 Dec 2014 10:15:35 +0000
+Subject: [PATCH] * libtiff/tif_read.c: fix several invalid comparisons of a
+ uint64 value with <= 0 by casting it to int64 first. This solves crashing bug
+ on corrupted images generated by afl.
+
+---
+ ChangeLog          | 6 ++++++
+ libtiff/tif_read.c | 6 +++---
+ 2 files changed, 9 insertions(+), 3 deletions(-)
+
+diff --git a/libtiff/tif_read.c b/libtiff/tif_read.c
+index 2ba822a..dfc5b07 100644
+--- a/libtiff/tif_read.c
++++ b/libtiff/tif_read.c
+@@ -458,7 +458,7 @@ TIFFReadRawStrip(TIFF* tif, uint32 strip, void* buf, tmsize_t size)
+ 		return ((tmsize_t)(-1));
+ 	}
+ 	bytecount = td->td_stripbytecount[strip];
+-	if (bytecount <= 0) {
++	if ((int64)bytecount <= 0) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 		TIFFErrorExt(tif->tif_clientdata, module,
+ 			     "%I64u: Invalid strip byte count, strip %lu",
+@@ -498,7 +498,7 @@ TIFFFillStrip(TIFF* tif, uint32 strip)
+ 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
+ 	{
+ 		uint64 bytecount = td->td_stripbytecount[strip];
+-		if (bytecount <= 0) {
++		if ((int64)bytecount <= 0) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+ 				"Invalid strip byte count %I64u, strip %lu",
+@@ -801,7 +801,7 @@ TIFFFillTile(TIFF* tif, uint32 tile)
+ 	if ((tif->tif_flags&TIFF_NOREADRAW)==0)
+ 	{
+ 		uint64 bytecount = td->td_stripbytecount[tile];
+-		if (bytecount <= 0) {
++		if ((int64)bytecount <= 0) {
+ #if defined(__WIN32__) && (defined(_MSC_VER) || defined(__MINGW32__))
+ 			TIFFErrorExt(tif->tif_clientdata, module,
+ 				"%I64u: Invalid tile byte count, tile %lu",
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch b/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch
new file mode 100644
index 0000000000..62d903c650
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8127-pt4.patch
@@ -0,0 +1,295 @@
+Copied from Debian
+
+From 662f74445b2fea2eeb759c6524661118aef567ca Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 15:15:31 +0000
+Subject: [PATCH] Fix various crasher bugs on fuzzed images. *
+ libtiff/tif_dir.c: TIFFSetField(): refuse to set negative values for
+ TIFFTAG_XRESOLUTION and TIFFTAG_YRESOLUTION that cause asserts when writing
+ the directory * libtiff/tif_dirread.c: TIFFReadDirectory(): refuse to read
+ ColorMap or TransferFunction if BitsPerSample has not yet been read,
+ otherwise reading it later will cause user code to crash if BitsPerSample > 1
+ * libtiff/tif_getimage.c: TIFFRGBAImageOK(): return FALSE if LOGLUV with
+ SamplesPerPixel != 3, or if CIELAB with SamplesPerPixel != 3 or BitsPerSample
+ != 8 * libtiff/tif_next.c: in the "run mode", use tilewidth for tiled images
+ instead of imagewidth to avoid crash * tools/bmp2tiff.c: fix crash due to int
+ overflow related to input BMP dimensions * tools/tiff2pdf.c: fix crash due to
+ invalid tile count (should likely be checked by libtiff too). Detect invalid
+ settings of BitsPerSample/SamplesPerPixel for CIELAB / ITULAB *
+ tools/tiffcrop.c: fix crash due to invalid TileWidth/TileHeight *
+ tools/tiffdump.c: fix crash due to overflow of entry count.
+
+---
+ ChangeLog              | 19 +++++++++++++++++++
+ libtiff/tif_dir.c      | 21 +++++++++++++++++++--
+ libtiff/tif_dirread.c  | 17 +++++++++++++++++
+ libtiff/tif_getimage.c | 15 +++++++++++++++
+ libtiff/tif_next.c     |  2 ++
+ tools/bmp2tiff.c       | 15 +++++++++++++++
+ tools/tiff2pdf.c       | 41 +++++++++++++++++++++++++++++++++++++++++
+ tools/tiffcrop.c       |  7 ++++---
+ tools/tiffdump.c       |  9 ++++++---
+ 9 files changed, 138 insertions(+), 8 deletions(-)
+
+diff --git a/libtiff/tif_dir.c b/libtiff/tif_dir.c
+index 98cf66d..ab43a28 100644
+--- a/libtiff/tif_dir.c
++++ b/libtiff/tif_dir.c
+@@ -160,6 +160,7 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ 	TIFFDirectory* td = &tif->tif_dir;
+ 	int status = 1;
+ 	uint32 v32, i, v;
++    double dblval;
+ 	char* s;
+ 	const TIFFField *fip = TIFFFindField(tif, tag, TIFF_ANY);
+ 	uint32 standard_tag = tag;
+@@ -284,10 +285,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ 			setDoubleArrayOneValue(&td->td_smaxsamplevalue, va_arg(ap, double), td->td_samplesperpixel);
+ 		break;
+ 	case TIFFTAG_XRESOLUTION:
+-		td->td_xresolution = (float) va_arg(ap, double);
++        dblval = va_arg(ap, double);
++        if( dblval < 0 )
++            goto badvaluedouble;
++		td->td_xresolution = (float) dblval;
+ 		break;
+ 	case TIFFTAG_YRESOLUTION:
+-		td->td_yresolution = (float) va_arg(ap, double);
++        dblval = va_arg(ap, double);
++        if( dblval < 0 )
++            goto badvaluedouble;
++		td->td_yresolution = (float) dblval;
+ 		break;
+ 	case TIFFTAG_PLANARCONFIG:
+ 		v = (uint16) va_arg(ap, uint16_vap);
+@@ -694,6 +701,16 @@ _TIFFVSetField(TIFF* tif, uint32 tag, va_list ap)
+ 		va_end(ap);
+         }
+ 	return (0);
++badvaluedouble:
++        {
++        const TIFFField* fip=TIFFFieldWithTag(tif,tag);
++        TIFFErrorExt(tif->tif_clientdata, module,
++             "%s: Bad value %f for \"%s\" tag",
++             tif->tif_name, dblval,
++             fip ? fip->field_name : "Unknown");
++        va_end(ap);
++        }
++    return (0);
+ }
+ 
+ /*
+diff --git a/libtiff/tif_dirread.c b/libtiff/tif_dirread.c
+index 391c823..f66c9a7 100644
+--- a/libtiff/tif_dirread.c
++++ b/libtiff/tif_dirread.c
+@@ -3430,6 +3430,8 @@ TIFFReadDirectory(TIFF* tif)
+ 	const TIFFField* fip;
+ 	uint32 fii=FAILED_FII;
+         toff_t nextdiroff;
++    int bitspersample_read = FALSE;
++
+ 	tif->tif_diroff=tif->tif_nextdiroff;
+ 	if (!TIFFCheckDirOffset(tif,tif->tif_nextdiroff))
+ 		return 0;           /* last offset or bad offset (IFD looping) */
+@@ -3706,6 +3708,8 @@ TIFFReadDirectory(TIFF* tif)
+ 					}
+ 					if (!TIFFSetField(tif,dp->tdir_tag,value))
+ 						goto bad;
++                    if( dp->tdir_tag == TIFFTAG_BITSPERSAMPLE )
++                        bitspersample_read = TRUE;
+ 				}
+ 				break;
+ 			case TIFFTAG_SMINSAMPLEVALUE:
+@@ -3763,6 +3767,19 @@ TIFFReadDirectory(TIFF* tif)
+ 					uint32 countrequired;
+ 					uint32 incrementpersample;
+ 					uint16* value=NULL;
++                    /* It would be dangerous to instanciate those tag values */
++                    /* since if td_bitspersample has not yet been read (due to */
++                    /* unordered tags), it could be read afterwards with a */
++                    /* values greater than the default one (1), which may cause */
++                    /* crashes in user code */
++                    if( !bitspersample_read )
++                    {
++                        fip = TIFFFieldWithTag(tif,dp->tdir_tag);
++                        TIFFWarningExt(tif->tif_clientdata,module,
++                                       "Ignoring %s since BitsPerSample tag not found",
++                                       fip ? fip->field_name : "unknown tagname");
++                        continue;
++                    }
+ 					countpersample=(1L<<tif->tif_dir.td_bitspersample);
+ 					if ((dp->tdir_tag==TIFFTAG_TRANSFERFUNCTION)&&(dp->tdir_count==(uint64)countpersample))
+ 					{
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index 074d32a..396ad08 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -182,8 +182,23 @@ TIFFRGBAImageOK(TIFF* tif, char emsg[1024])
+ 				    "Planarconfiguration", td->td_planarconfig);
+ 				return (0);
+ 			}
++			if( td->td_samplesperpixel != 3 )
++            {
++                sprintf(emsg,
++                        "Sorry, can not handle image with %s=%d",
++                        "Samples/pixel", td->td_samplesperpixel);
++                return 0;
++            }
+ 			break;
+ 		case PHOTOMETRIC_CIELAB:
++            if( td->td_samplesperpixel != 3 || td->td_bitspersample != 8 )
++            {
++                sprintf(emsg,
++                        "Sorry, can not handle image with %s=%d and %s=%d",
++                        "Samples/pixel", td->td_samplesperpixel,
++                        "Bits/sample", td->td_bitspersample);
++                return 0;
++            }
+ 			break;
+ 		default:
+ 			sprintf(emsg, "Sorry, can not handle image with %s=%d",
+diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
+index 55e2537..a53c716 100644
+--- a/libtiff/tif_next.c
++++ b/libtiff/tif_next.c
+@@ -102,6 +102,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
+ 		default: {
+ 			uint32 npixels = 0, grey;
+ 			uint32 imagewidth = tif->tif_dir.td_imagewidth;
++            if( isTiled(tif) )
++                imagewidth = tif->tif_dir.td_tilewidth;
+ 
+ 			/*
+ 			 * The scanline is composed of a sequence of constant
+diff --git a/tools/tiff2pdf.c b/tools/tiff2pdf.c
+index dfda963..f202b41 100644
+--- a/tools/tiff2pdf.c
++++ b/tools/tiff2pdf.c
+@@ -1167,6 +1167,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF* input){
+ 		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
+ 			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
+ 				TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);
++                if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )
++                {
++                    TIFFError(
++                        TIFF2PDF_MODULE, 
++                        "Invalid tile count, %s", 
++                        TIFFFileName(input));
++                    t2p->t2p_error = T2P_ERR_ERROR;
++                    return;
++                }
+ 				t2p->tiff_tiles[i].tiles_tilecount/= xuint16;
+ 		}
+ 		if( t2p->tiff_tiles[i].tiles_tilecount > 0){
+@@ -1552,6 +1561,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
+ #endif
+ 			break;
+ 		case PHOTOMETRIC_CIELAB:
++            if( t2p->tiff_samplesperpixel != 3){
++                TIFFError(
++                    TIFF2PDF_MODULE, 
++                    "Unsupported samplesperpixel = %d for CIELAB", 
++                    t2p->tiff_samplesperpixel);
++                t2p->t2p_error = T2P_ERR_ERROR;
++                return;
++            }
++            if( t2p->tiff_bitspersample != 8){
++                TIFFError(
++                    TIFF2PDF_MODULE, 
++                    "Invalid bitspersample = %d for CIELAB", 
++                    t2p->tiff_bitspersample);
++                t2p->t2p_error = T2P_ERR_ERROR;
++                return;
++            }
+ 			t2p->pdf_labrange[0]= -127;
+ 			t2p->pdf_labrange[1]= 127;
+ 			t2p->pdf_labrange[2]= -127;
+@@ -1567,6 +1592,22 @@ void t2p_read_tiff_data(T2P* t2p, TIFF* input){
+ 			t2p->pdf_colorspace=T2P_CS_LAB;
+ 			break;
+ 		case PHOTOMETRIC_ITULAB:
++            if( t2p->tiff_samplesperpixel != 3){
++                TIFFError(
++                    TIFF2PDF_MODULE, 
++                    "Unsupported samplesperpixel = %d for ITULAB", 
++                    t2p->tiff_samplesperpixel);
++                t2p->t2p_error = T2P_ERR_ERROR;
++                return;
++            }
++            if( t2p->tiff_bitspersample != 8){
++                TIFFError(
++                    TIFF2PDF_MODULE, 
++                    "Invalid bitspersample = %d for ITULAB", 
++                    t2p->tiff_bitspersample);
++                t2p->t2p_error = T2P_ERR_ERROR;
++                return;
++            }
+ 			t2p->pdf_labrange[0]=-85;
+ 			t2p->pdf_labrange[1]=85;
+ 			t2p->pdf_labrange[2]=-75;
+diff --git a/tools/tiffcrop.c b/tools/tiffcrop.c
+index f5530bb..4088463 100644
+--- a/tools/tiffcrop.c
++++ b/tools/tiffcrop.c
+@@ -1205,9 +1205,10 @@ static int writeBufferToContigTiles (TIFF* out, uint8* buf, uint32 imagelength,
+   tsize_t tilesize = TIFFTileSize(out);
+   unsigned char *tilebuf = NULL;
+ 
+-  TIFFGetField(out, TIFFTAG_TILELENGTH, &tl);
+-  TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw);
+-  TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps);
++  if( !TIFFGetField(out, TIFFTAG_TILELENGTH, &tl) ||
++      !TIFFGetField(out, TIFFTAG_TILEWIDTH, &tw) ||
++      !TIFFGetField(out, TIFFTAG_BITSPERSAMPLE, &bps) )
++      return 1;
+ 
+   tile_buffsize = tilesize;
+   if (tilesize < (tsize_t)(tl * tile_rowsize))
+diff --git a/tools/tiffdump.c b/tools/tiffdump.c
+index cf5d62f..8247765 100644
+--- a/tools/tiffdump.c
++++ b/tools/tiffdump.c
+@@ -374,6 +374,8 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
+ 		void* datamem;
+ 		uint64 dataoffset;
+ 		int datatruncated;
++        int datasizeoverflow;
++
+ 		tag = *(uint16*)dp;
+ 		if (swabflag)
+ 			TIFFSwabShort(&tag);
+@@ -412,13 +414,14 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
+ 		else
+ 			typewidth = datawidth[type];
+ 		datasize = count*typewidth;
++        datasizeoverflow = (typewidth > 0 && datasize / typewidth != count);
+ 		datafits = 1;
+ 		datamem = dp;
+ 		dataoffset = 0;
+ 		datatruncated = 0;
+ 		if (!bigtiff)
+ 		{
+-			if (datasize>4)
++			if (datasizeoverflow || datasize>4)
+ 			{
+ 				uint32 dataoffset32;
+ 				datafits = 0;
+@@ -432,7 +435,7 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
+ 		}
+ 		else
+ 		{
+-			if (datasize>8)
++			if (datasizeoverflow || datasize>8)
+ 			{
+ 				datafits = 0;
+ 				datamem = NULL;
+@@ -442,7 +445,7 @@ ReadDirectory(int fd, unsigned int ix, uint64 off)
+ 			}
+ 			dp += sizeof(uint64);
+ 		}
+-		if (datasize>0x10000)
++		if (datasizeoverflow || datasize>0x10000)
+ 		{
+ 			datatruncated = 1;
+ 			count = 0x10000/typewidth;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch
new file mode 100644
index 0000000000..fda018b7bb
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8128-pt1.patch
@@ -0,0 +1,32 @@
+Copied from Debian
+
+From 3206e0c752a62da1ae606867113ed3bf9bf73306 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 19:53:59 +0000
+Subject: [PATCH] * tools/thumbnail.c: fix out-of-buffer write
+ http://bugzilla.maptools.org/show_bug.cgi?id=2489 (CVE-2014-8128)
+
+---
+ ChangeLog         | 5 +++++
+ tools/thumbnail.c | 8 +++++++-
+ 2 files changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/tools/thumbnail.c b/tools/thumbnail.c
+index fab63f6..c50bbff 100644
+--- a/tools/thumbnail.c
++++ b/tools/thumbnail.c
+@@ -568,7 +568,13 @@ setImage1(const uint8* br, uint32 rw, uint32 rh)
+ 	    err -= limit;
+ 	    sy++;
+ 	    if (err >= limit)
+-		rows[nrows++] = br + bpr*sy;
++		{
++			/* We should perhaps error loudly, but I can't make sense of that */
++			/* code... */
++			if( nrows == 256 )
++				break;
++			rows[nrows++] = br + bpr*sy;
++		}
+ 	}
+ 	setrow(row, nrows, rows);
+ 	row += tnw;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch
new file mode 100644
index 0000000000..6f9ef85d14
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8128-pt2.patch
@@ -0,0 +1,83 @@
+Copied from Debian
+
+From 8b6e80fca434525497e5a31c3309a3bab5b3c1c8 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 18:52:42 +0000
+Subject: [PATCH] * tools/thumbnail.c, tools/tiffcmp.c: only read/write
+ TIFFTAG_GROUP3OPTIONS or TIFFTAG_GROUP4OPTIONS if compression is
+ COMPRESSION_CCITTFAX3 or COMPRESSION_CCITTFAX4
+ http://bugzilla.maptools.org/show_bug.cgi?id=2493 (CVE-2014-8128)
+
+---
+ ChangeLog         |  7 +++++++
+ tools/thumbnail.c | 21 ++++++++++++++++++++-
+ tools/tiffcmp.c   | 17 +++++++++++++++--
+ 3 files changed, 42 insertions(+), 3 deletions(-)
+
+diff --git a/tools/thumbnail.c b/tools/thumbnail.c
+index a98a881..fab63f6 100644
+--- a/tools/thumbnail.c
++++ b/tools/thumbnail.c
+@@ -274,7 +274,26 @@ cpTags(TIFF* in, TIFF* out)
+ {
+     struct cpTag *p;
+     for (p = tags; p < &tags[NTAGS]; p++)
+-	cpTag(in, out, p->tag, p->count, p->type);
++	{
++		/* Horrible: but TIFFGetField() expects 2 arguments to be passed */
++		/* if we request a tag that is defined in a codec, but that codec */
++		/* isn't used */
++		if( p->tag == TIFFTAG_GROUP3OPTIONS )
++		{
++			uint16 compression;
++			if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
++				compression != COMPRESSION_CCITTFAX3 )
++				continue;
++		}
++		if( p->tag == TIFFTAG_GROUP4OPTIONS )
++		{
++			uint16 compression;
++			if( !TIFFGetField(in, TIFFTAG_COMPRESSION, &compression) ||
++				compression != COMPRESSION_CCITTFAX4 )
++				continue;
++		}
++		cpTag(in, out, p->tag, p->count, p->type);
++	}
+ }
+ #undef NTAGS
+ 
+diff --git a/tools/tiffcmp.c b/tools/tiffcmp.c
+index 508a461..d6392af 100644
+--- a/tools/tiffcmp.c
++++ b/tools/tiffcmp.c
+@@ -260,6 +260,7 @@ tiffcmp(TIFF* tif1, TIFF* tif2)
+ static int
+ cmptags(TIFF* tif1, TIFF* tif2)
+ {
++	uint16 compression1, compression2;
+ 	CmpLongField(TIFFTAG_SUBFILETYPE,	"SubFileType");
+ 	CmpLongField(TIFFTAG_IMAGEWIDTH,	"ImageWidth");
+ 	CmpLongField(TIFFTAG_IMAGELENGTH,	"ImageLength");
+@@ -276,8 +277,20 @@ cmptags(TIFF* tif1, TIFF* tif2)
+ 	CmpShortField(TIFFTAG_SAMPLEFORMAT,	"SampleFormat");
+ 	CmpFloatField(TIFFTAG_XRESOLUTION,	"XResolution");
+ 	CmpFloatField(TIFFTAG_YRESOLUTION,	"YResolution");
+-	CmpLongField(TIFFTAG_GROUP3OPTIONS,	"Group3Options");
+-	CmpLongField(TIFFTAG_GROUP4OPTIONS,	"Group4Options");
++	if( TIFFGetField(tif1, TIFFTAG_COMPRESSION, &compression1) &&
++		compression1 == COMPRESSION_CCITTFAX3 &&
++		TIFFGetField(tif2, TIFFTAG_COMPRESSION, &compression2) &&
++		compression2 == COMPRESSION_CCITTFAX3 )
++	{
++		CmpLongField(TIFFTAG_GROUP3OPTIONS,	"Group3Options");
++	}
++	if( TIFFGetField(tif1, TIFFTAG_COMPRESSION, &compression1) &&
++		compression1 == COMPRESSION_CCITTFAX4 &&
++		TIFFGetField(tif2, TIFFTAG_COMPRESSION, &compression2) &&
++		compression2 == COMPRESSION_CCITTFAX4 )
++	{
++		CmpLongField(TIFFTAG_GROUP4OPTIONS,	"Group4Options");
++	}
+ 	CmpShortField(TIFFTAG_RESOLUTIONUNIT,	"ResolutionUnit");
+ 	CmpShortField(TIFFTAG_PLANARCONFIG,	"PlanarConfiguration");
+ 	CmpLongField(TIFFTAG_ROWSPERSTRIP,	"RowsPerStrip");
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch
new file mode 100644
index 0000000000..200af0ef8b
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8128-pt3.patch
@@ -0,0 +1,34 @@
+Copied from Debian
+
+From 266bc48054b018a2f1d74562aa48eb2f509436d5 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 17:36:36 +0000
+Subject: [PATCH] * tools/tiff2pdf.c: check return code of TIFFGetField() when
+ reading TIFFTAG_SAMPLESPERPIXEL
+
+---
+ ChangeLog        |  5 +++++
+ tools/tiff2pdf.c | 10 +++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+Index: tiff-4.0.3/tools/tiff2pdf.c
+===================================================================
+--- tiff-4.0.3.orig/tools/tiff2pdf.c
++++ tiff-4.0.3/tools/tiff2pdf.c
+@@ -1164,7 +1164,15 @@ void t2p_read_tiff_init(T2P* t2p, TIFF*
+ 			t2p->tiff_pages[i].page_tilecount;
+ 		if( (TIFFGetField(input, TIFFTAG_PLANARCONFIG, &xuint16) != 0)
+ 			&& (xuint16 == PLANARCONFIG_SEPARATE ) ){
+-				TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16);
++				if( !TIFFGetField(input, TIFFTAG_SAMPLESPERPIXEL, &xuint16) )
++				{
++					TIFFError(
++                        TIFF2PDF_MODULE, 
++                        "Missing SamplesPerPixel, %s", 
++                        TIFFFileName(input));
++                    t2p->t2p_error = T2P_ERR_ERROR;
++                    return;
++				}
+                 if( (t2p->tiff_tiles[i].tiles_tilecount % xuint16) != 0 )
+                 {
+                     TIFFError(
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch
new file mode 100644
index 0000000000..fda4045504
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8128-pt4.patch
@@ -0,0 +1,77 @@
+Copied from Debian
+
+Picked from CVE: diff -u -r1.14 -r1.15
+http://bugzilla.maptools.org/show_bug.cgi?id=2501
+
+Author: Even Rouault <even.rouault@spatialys.com>
+
+--- tiff-4.0.3.orig/tools/tiffdither.c
++++ tiff-4.0.3/tools/tiffdither.c
+@@ -39,6 +39,7 @@
+ #endif
+ 
+ #include "tiffio.h"
++#include "tiffiop.h"
+ 
+ #define	streq(a,b)	(strcmp(a,b) == 0)
+ #define	strneq(a,b,n)	(strncmp(a,b,n) == 0)
+@@ -56,7 +57,7 @@ static	void usage(void);
+  * Floyd-Steinberg error propragation with threshold.
+  * This code is stolen from tiffmedian.
+  */
+-static void
++static int
+ fsdither(TIFF* in, TIFF* out)
+ {
+ 	unsigned char *outline, *inputline, *inptr;
+@@ -68,14 +69,19 @@ fsdither(TIFF* in, TIFF* out)
+ 	int lastline, lastpixel;
+ 	int bit;
+ 	tsize_t outlinesize;
++	int errcode = 0;
+ 
+ 	imax = imagelength - 1;
+ 	jmax = imagewidth - 1;
+ 	inputline = (unsigned char *)_TIFFmalloc(TIFFScanlineSize(in));
+-	thisline = (short *)_TIFFmalloc(imagewidth * sizeof (short));
+-	nextline = (short *)_TIFFmalloc(imagewidth * sizeof (short));
++	thisline = (short *)_TIFFmalloc(TIFFSafeMultiply(tmsize_t, imagewidth, sizeof (short)));
++	nextline = (short *)_TIFFmalloc(TIFFSafeMultiply(tmsize_t, imagewidth, sizeof (short)));
+ 	outlinesize = TIFFScanlineSize(out);
+ 	outline = (unsigned char *) _TIFFmalloc(outlinesize);
++	if (! (inputline && thisline && nextline && outline)) {
++	    fprintf(stderr, "Out of memory.\n");
++	    goto skip_on_error;
++	}
+ 
+ 	/*
+ 	 * Get first line
+@@ -93,7 +99,7 @@ fsdither(TIFF* in, TIFF* out)
+ 		nextline = tmpptr;
+ 		lastline = (i == imax);
+ 		if (TIFFReadScanline(in, inputline, i, 0) <= 0)
+-			break;
++			goto skip_on_error;
+ 		inptr = inputline;
+ 		nextptr = nextline;
+ 		for (j = 0; j < imagewidth; ++j)
+@@ -131,13 +137,18 @@ fsdither(TIFF* in, TIFF* out)
+ 			}
+ 		}
+ 		if (TIFFWriteScanline(out, outline, i-1, 0) < 0)
+-			break;
++			goto skip_on_error;
+ 	}
++	goto exit_label;
++
+   skip_on_error:
++	errcode = 1;
++  exit_label:
+ 	_TIFFfree(inputline);
+ 	_TIFFfree(thisline);
+ 	_TIFFfree(nextline);
+ 	_TIFFfree(outline);
++	return errcode;
+ }
+ 
+ static	uint16 compression = COMPRESSION_PACKBITS;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch b/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch
new file mode 100644
index 0000000000..a555a18747
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8128-pt5.patch
@@ -0,0 +1,16 @@
+Copied from Debian
+
+Patches by Petr Gajdos (pgajdos@suse.cz) from
+http://bugzilla.maptools.org/show_bug.cgi?id=2499
+
+--- tiff-4.0.3.orig/libtiff/tif_dirinfo.c
++++ tiff-4.0.3/libtiff/tif_dirinfo.c
+@@ -141,6 +141,8 @@ tiffFields[] = {
+ 	{ TIFFTAG_FAXDCS, -1, -1, TIFF_ASCII, 0, TIFF_SETGET_ASCII, TIFF_SETGET_ASCII, FIELD_CUSTOM, TRUE, FALSE, "FaxDcs", NULL },
+ 	{ TIFFTAG_STONITS, 1, 1, TIFF_DOUBLE, 0, TIFF_SETGET_DOUBLE, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "StoNits", NULL },
+ 	{ TIFFTAG_INTEROPERABILITYIFD, 1, 1, TIFF_IFD8, 0, TIFF_SETGET_UNDEFINED, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "InteroperabilityIFDOffset", NULL },
++	{ TIFFTAG_CONSECUTIVEBADFAXLINES, 1, 1, TIFF_LONG, 0, TIFF_SETGET_UINT32, TIFF_SETGET_UINT32, FIELD_CUSTOM, TRUE, FALSE, "ConsecutiveBadFaxLines", NULL },
++        { TIFFTAG_PREDICTOR, 1, 1, TIFF_SHORT, 0, TIFF_SETGET_UINT16, TIFF_SETGET_UINT16, FIELD_CUSTOM, FALSE, FALSE, "Predictor", NULL },
+ 	/* begin DNG tags */
+ 	{ TIFFTAG_DNGVERSION, 4, 4, TIFF_BYTE, 0, TIFF_SETGET_C0_UINT8, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "DNGVersion", NULL },
+ 	{ TIFFTAG_DNGBACKWARDVERSION, 4, 4, TIFF_BYTE, 0, TIFF_SETGET_C0_UINT8, TIFF_SETGET_UNDEFINED, FIELD_CUSTOM, 0, 0, "DNGBackwardVersion", NULL },
diff --git a/gnu/packages/patches/libtiff-CVE-2014-8129.patch b/gnu/packages/patches/libtiff-CVE-2014-8129.patch
new file mode 100644
index 0000000000..091ec8f573
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-8129.patch
@@ -0,0 +1,45 @@
+Copied from Debian
+
+From cd82b5267ad4c10eb91e4ee8a716a81362cf851c Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Sun, 21 Dec 2014 18:07:48 +0000
+Subject: [PATCH] * libtiff/tif_next.c: check that BitsPerSample = 2. Fixes
+ http://bugzilla.maptools.org/show_bug.cgi?id=2487 (CVE-2014-8129)
+
+---
+ ChangeLog          |  5 +++++
+ libtiff/tif_next.c | 17 +++++++++++++++++
+ 2 files changed, 22 insertions(+)
+
+diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
+index a53c716..d834196 100644
+--- a/libtiff/tif_next.c
++++ b/libtiff/tif_next.c
+@@ -141,10 +141,27 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
+ 	return (0);
+ }
+ 
++static int
++NeXTPreDecode(TIFF* tif, uint16 s)
++{
++	static const char module[] = "NeXTPreDecode";
++	TIFFDirectory *td = &tif->tif_dir;
++	(void)s;
++
++	if( td->td_bitspersample != 2 )
++	{
++		TIFFErrorExt(tif->tif_clientdata, module, "Unsupported BitsPerSample = %d",
++					 td->td_bitspersample);
++		return (0);
++	}
++	return (1);
++}
++	
+ int
+ TIFFInitNeXT(TIFF* tif, int scheme)
+ {
+ 	(void) scheme;
++	tif->tif_predecode = NeXTPreDecode;  
+ 	tif->tif_decoderow = NeXTDecode;  
+ 	tif->tif_decodestrip = NeXTDecode;  
+ 	tif->tif_decodetile = NeXTDecode;
diff --git a/gnu/packages/patches/libtiff-CVE-2014-9330.patch b/gnu/packages/patches/libtiff-CVE-2014-9330.patch
new file mode 100644
index 0000000000..c3c5fc0367
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-9330.patch
@@ -0,0 +1,47 @@
+Copied from Debian
+
+Description: CVE-2014-9330
+ Integer overflow in bmp2tiff
+Origin: upstream, http://bugzilla.maptools.org/show_bug.cgi?id=2494
+Bug: http://bugzilla.maptools.org/show_bug.cgi?id=2494
+Bug-Debian: http://bugs.debian.org/773987
+
+Index: tiff/tools/bmp2tiff.c
+===================================================================
+--- tiff.orig/tools/bmp2tiff.c
++++ tiff/tools/bmp2tiff.c
+@@ -1,4 +1,4 @@
+-/* $Id: bmp2tiff.c,v 1.23 2010-03-10 18:56:49 bfriesen Exp $
++/* $Id: bmp2tiff.c,v 1.24 2014-12-21 15:15:32 erouault Exp $
+  *
+  * Project:  libtiff tools
+  * Purpose:  Convert Windows BMP files in TIFF.
+@@ -403,6 +403,13 @@ main(int argc, char* argv[])
+ 
+ 		width = info_hdr.iWidth;
+ 		length = (info_hdr.iHeight > 0) ? info_hdr.iHeight : -info_hdr.iHeight;
++        if( width <= 0 || length <= 0 )
++        {
++            TIFFError(infilename,
++                  "Invalid dimensions of BMP file" );
++            close(fd);
++            return -1;
++        }
+ 
+ 		switch (info_hdr.iBitCount)
+ 		{
+@@ -593,6 +600,14 @@ main(int argc, char* argv[])
+ 
+ 			compr_size = file_hdr.iSize - file_hdr.iOffBits;
+ 			uncompr_size = width * length;
++            /* Detect int overflow */
++            if( uncompr_size / width != length )
++            {
++                TIFFError(infilename,
++                    "Invalid dimensions of BMP file" );
++                close(fd);
++                return -1;
++            }
+ 			comprbuf = (unsigned char *) _TIFFmalloc( compr_size );
+ 			if (!comprbuf) {
+ 				TIFFError(infilename,
diff --git a/gnu/packages/patches/libtiff-CVE-2014-9655.patch b/gnu/packages/patches/libtiff-CVE-2014-9655.patch
new file mode 100644
index 0000000000..065804d03a
--- /dev/null
+++ b/gnu/packages/patches/libtiff-CVE-2014-9655.patch
@@ -0,0 +1,88 @@
+Copied from Debian
+
+From 40a5955cbf0df62b1f9e9bd7d9657b0070725d19 Mon Sep 17 00:00:00 2001
+From: erouault <erouault>
+Date: Mon, 29 Dec 2014 12:09:11 +0000
+Subject: [PATCH] * libtiff/tif_next.c: add new tests to check that we don't
+ read outside of the compressed input stream buffer.
+
+* libtiff/tif_getimage.c: in OJPEG case, fix checks on strile width/height
+---
+ ChangeLog              |  9 +++++++++
+ libtiff/tif_getimage.c | 12 +++++++-----
+ libtiff/tif_next.c     |  4 +++-
+ 3 files changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/libtiff/tif_getimage.c b/libtiff/tif_getimage.c
+index a4f46d9..3ad8ee7 100644
+--- a/libtiff/tif_getimage.c
++++ b/libtiff/tif_getimage.c
+@@ -1871,7 +1871,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr42tile)
+ 
+     (void) y;
+     fromskew = (fromskew * 10) / 4;
+-    if ((h & 3) == 0 && (w & 1) == 0) {
++    if ((w & 3) == 0 && (h & 1) == 0) {
+         for (; h >= 2; h -= 2) {
+             x = w>>2;
+             do {
+@@ -1948,7 +1948,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
+     /* XXX adjust fromskew */
+     do {
+ 	x = w>>2;
+-	do {
++	while(x>0) {
+ 	    int32 Cb = pp[4];
+ 	    int32 Cr = pp[5];
+ 
+@@ -1959,7 +1959,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr41tile)
+ 
+ 	    cp += 4;
+ 	    pp += 6;
+-	} while (--x);
++		x--;
++	}
+ 
+         if( (w&3) != 0 )
+         {
+@@ -2050,7 +2051,7 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
+ 	fromskew = (fromskew * 4) / 2;
+ 	do {
+ 		x = w>>1;
+-		do {
++		while(x>0) {
+ 			int32 Cb = pp[2];
+ 			int32 Cr = pp[3];
+ 
+@@ -2059,7 +2060,8 @@ DECLAREContigPutFunc(putcontig8bitYCbCr21tile)
+ 
+ 			cp += 2;
+ 			pp += 4;
+-		} while (--x);
++			x --;
++		}
+ 
+ 		if( (w&1) != 0 )
+ 		{
+diff --git a/libtiff/tif_next.c b/libtiff/tif_next.c
+index d834196..dd669cc 100644
+--- a/libtiff/tif_next.c
++++ b/libtiff/tif_next.c
+@@ -71,7 +71,7 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
+ 		TIFFErrorExt(tif->tif_clientdata, module, "Fractional scanlines cannot be read");
+ 		return (0);
+ 	}
+-	for (row = buf; occ > 0; occ -= scanline, row += scanline) {
++	for (row = buf; cc > 0 && occ > 0; occ -= scanline, row += scanline) {
+ 		n = *bp++, cc--;
+ 		switch (n) {
+ 		case LITERALROW:
+@@ -90,6 +90,8 @@ NeXTDecode(TIFF* tif, uint8* buf, tmsize_t occ, uint16 s)
+ 			 * The scanline has a literal span that begins at some
+ 			 * offset.
+ 			 */
++			if( cc < 4 )
++				goto bad;
+ 			off = (bp[0] * 256) + bp[1];
+ 			n = (bp[2] * 256) + bp[3];
+ 			if (cc < 4+n || off+n > scanline)
diff --git a/gnu/packages/patches/mdadm-gcc-4.9-fix.patch b/gnu/packages/patches/mdadm-gcc-4.9-fix.patch
new file mode 100644
index 0000000000..222fd0ea32
--- /dev/null
+++ b/gnu/packages/patches/mdadm-gcc-4.9-fix.patch
@@ -0,0 +1,38 @@
+From 68641cdb646eaa15099c1d6cfff1eaa5dd2ac841 Mon Sep 17 00:00:00 2001
+From: Jes Sorensen <Jes.Sorensen@redhat.com>
+Date: Tue, 24 Feb 2015 16:00:40 -0500
+Subject: [PATCH] write_super_imsm_spares(): C statements are terminated by ;
+
+Signed-off-by: Jes Sorensen <Jes.Sorensen@redhat.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+---
+ super-intel.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/super-intel.c b/super-intel.c
+index 819e0da..7f75b53 100644
+--- a/super-intel.c
++++ b/super-intel.c
+@@ -5115,13 +5115,13 @@ static int write_super_imsm_spares(struct intel_super *super, int doclose)
+ 	__u32 sum;
+ 	struct dl *d;
+ 
+-	spare->mpb_size = __cpu_to_le32(sizeof(struct imsm_super)),
+-	spare->generation_num = __cpu_to_le32(1UL),
++	spare->mpb_size = __cpu_to_le32(sizeof(struct imsm_super));
++	spare->generation_num = __cpu_to_le32(1UL);
+ 	spare->attributes = MPB_ATTRIB_CHECKSUM_VERIFY;
+-	spare->num_disks = 1,
+-	spare->num_raid_devs = 0,
+-	spare->cache_size = mpb->cache_size,
+-	spare->pwr_cycle_count = __cpu_to_le32(1),
++	spare->num_disks = 1;
++	spare->num_raid_devs = 0;
++	spare->cache_size = mpb->cache_size;
++	spare->pwr_cycle_count = __cpu_to_le32(1);
+ 
+ 	snprintf((char *) spare->sig, MAX_SIGNATURE_LENGTH,
+ 		 MPB_SIGNATURE MPB_VERSION_RAID0);
+-- 
+2.4.3
+
diff --git a/gnu/packages/patches/patch-hurd-path-max.patch b/gnu/packages/patches/patch-hurd-path-max.patch
new file mode 100644
index 0000000000..81e37930c2
--- /dev/null
+++ b/gnu/packages/patches/patch-hurd-path-max.patch
@@ -0,0 +1,48 @@
+See <http://lists.gnu.org/archive/html/bug-patch/2015-06/msg00009.html>
+
+From 0507dfad5f060161f01840067e1bb1615257b636 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= <ludo@gnu.org>
+Date: Mon, 8 Jun 2015 17:27:56 +0200
+Subject: [PATCH] Do not rely on PATH_MAX when reading a symlink target.
+
+* src/util.c (move_file, copy_file): Use 'fromst->st_size + 1' and
+'tost->st_size + 1' for the allocation, and 'fromst->st_size' and
+'tost->st_size' instead of PATH_MAX.  Fixes compilation on GNU/Hurd.
+---
+ src/util.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/util.c b/src/util.c
+index 82a7e37..c4c0f9d 100644
+--- a/src/util.c
++++ b/src/util.c
+@@ -460,12 +460,12 @@ move_file (char const *from, bool *from_needs_removal,
+ 
+ 	  /* FROM contains the contents of the symlink we have patched; need
+ 	     to convert that back into a symlink. */
+-	  char *buffer = xmalloc (PATH_MAX);
++	  char *buffer = xmalloc (fromst->st_size + 1);
+ 	  int fd, size = 0, i;
+ 
+ 	  if ((fd = safe_open (from, O_RDONLY | O_BINARY, 0)) < 0)
+ 	    pfatal ("Can't reopen file %s", quotearg (from));
+-	  while ((i = read (fd, buffer + size, PATH_MAX - size)) > 0)
++	  while ((i = read (fd, buffer + size, fromst->st_size - size)) > 0)
+ 	    size += i;
+ 	  if (i != 0 || close (fd) != 0)
+ 	    read_fatal ();
+@@ -610,9 +610,9 @@ copy_file (char const *from, char const *to, struct stat *tost,
+ 
+   if (S_ISLNK (mode))
+     {
+-      char *buffer = xmalloc (PATH_MAX);
++      char *buffer = xmalloc (tost->st_size + 1);
+ 
+-      if (safe_readlink (from, buffer, PATH_MAX) < 0)
++      if (safe_readlink (from, buffer, tost->st_size) < 0)
+ 	pfatal ("Can't read %s %s", "symbolic link", from);
+       if (safe_symlink (buffer, to) != 0)
+ 	pfatal ("Can't create %s %s", "symbolic link", to);
+-- 
+2.4.2
+
diff --git a/gnu/packages/patches/sed-hurd-path-max.patch b/gnu/packages/patches/sed-hurd-path-max.patch
new file mode 100644
index 0000000000..5226cba4cb
--- /dev/null
+++ b/gnu/packages/patches/sed-hurd-path-max.patch
@@ -0,0 +1,34 @@
+7bb8d35d0330161a5af5341471d0c183a067e8c2
+Author: Jose E. Marchesi <jemarch@gnu.org>
+Date:   Sun Oct 6 14:43:38 2013 +0200
+
+    Set PATH_MAX to some constant in case it is not defined in system
+    headers.
+    
+    2013-10-06  Jose E. Marchesi  <jemarch@gnu.org>
+    
+    	* basicdefs.h (PATH_MAX): Defined to some constant in case it is
+    	not defined by system headers.
+    	* sed/utils.c: Do not include pathmax.h anymore.
+    	* bootstrap.conf (gnulib_modules): Do not use the gnulib module
+    	pathmax.
+
+diff --git a/basicdefs.h b/basicdefs.h
+index 0d28a97..09f5beb 100644
+--- a/basicdefs.h
++++ b/basicdefs.h
+@@ -40,6 +41,13 @@ typedef unsigned long countT;
+ #define obstack_chunk_alloc  ck_malloc
+ #define obstack_chunk_free   free
+ 
++/* MAX_PATH is not defined in some platforms, most notably GNU/Hurd.
++   In that case we define it here to some constant.  Note however that
++   this relies in the fact that sed does reallocation if a buffer
++   needs to be larger than PATH_MAX.  */
++#ifndef PATH_MAX
++# define PATH_MAX 200
++#endif
+ 
+ /* handle misdesigned <ctype.h> macros (snarfed from lib/regex.c) */
+ /* Jim Meyering writes:
+ 
diff --git a/gnu/packages/patches/tar-d_ino_in_dirent-fix.patch b/gnu/packages/patches/tar-d_ino_in_dirent-fix.patch
new file mode 100644
index 0000000000..39d8e2b20a
--- /dev/null
+++ b/gnu/packages/patches/tar-d_ino_in_dirent-fix.patch
@@ -0,0 +1,33 @@
+commit e9ddc08da0982f36581ae5a8c7763453ff41cfe8
+Author: Sergey Poznyakoff <gray@gnu.org>
+Date:   Thu Sep 25 00:22:16 2014 +0300
+
+    Bugfixes.
+    
+    * doc/tar.1: Fix typo in font spec.
+    * src/tar.c (sort_mode_arg, sort_mode_flag): Protect "inode"
+    (SAVEDIR_SORT_INODE) with D_INO_IN_DIRENT
+
+diff --git a/src/tar.c b/src/tar.c
+index 225c624..f8102e0 100644
+--- a/src/tar.c
++++ b/src/tar.c
+@@ -1341,14 +1341,18 @@ static char filename_terminator;
+ static char const *const sort_mode_arg[] = {
+   "none",
+   "name",
++#if D_INO_IN_DIRENT
+   "inode",
++#endif
+   NULL
+ };
+ 
+ static int sort_mode_flag[] = {
+     SAVEDIR_SORT_NONE,
+     SAVEDIR_SORT_NAME,
++#if D_INO_IN_DIRENT
+     SAVEDIR_SORT_INODE
++#endif
+ };
+ 
+ ARGMATCH_VERIFY (sort_mode_arg, sort_mode_flag);
\ No newline at end of file
diff --git a/gnu/packages/patches/tar-skip-unreliable-tests.patch b/gnu/packages/patches/tar-skip-unreliable-tests.patch
new file mode 100644
index 0000000000..27f0d7df11
--- /dev/null
+++ b/gnu/packages/patches/tar-skip-unreliable-tests.patch
@@ -0,0 +1,32 @@
+Skip tests that rely on unlinkat(2) behavior that varies between
+kernel versions and is unspecified.
+
+See <http://bugs.gnu.org/20597>
+and <http://lists.gnu.org/archive/html/bug-tar/2015-06/msg00000.html>.
+
+--- tar-1.28/tests/testsuite	2014-07-27 22:35:27.000000000 +0200
++++ tar-1.28/tests/testsuite	2015-06-16 00:21:16.906380739 +0200
+@@ -34680,6 +34680,7 @@ find .
+ )"
+ at_fn_check_prepare_notrace 'an embedded newline' "remfiles08a.at:31"
+ ( $at_check_trace;
++exit 77
+ mkdir gnu
+ (cd gnu
+ TEST_TAR_FORMAT=gnu
+@@ -34762,6 +34763,7 @@ find .
+ )"
+ at_fn_check_prepare_notrace 'an embedded newline' "remfiles08b.at:36"
+ ( $at_check_trace;
++exit 77
+ mkdir gnu
+ (cd gnu
+ TEST_TAR_FORMAT=gnu
+@@ -34850,6 +34852,7 @@ find .
+ )"
+ at_fn_check_prepare_notrace 'a `...` command substitution' "remfiles08c.at:31"
+ ( $at_check_trace;
++exit 77
+ mkdir gnu
+ (cd gnu
+ TEST_TAR_FORMAT=gnu
diff --git a/gnu/packages/perl.scm b/gnu/packages/perl.scm
index ec6f89a626..3d28455405 100644
--- a/gnu/packages/perl.scm
+++ b/gnu/packages/perl.scm
@@ -51,28 +51,39 @@
     (arguments
      '(#:tests? #f
        #:phases
-       (alist-replace
-        'configure
-        (lambda* (#:key inputs outputs #:allow-other-keys)
-          (let ((out  (assoc-ref outputs "out"))
-                (libc (assoc-ref inputs "libc")))
-            ;; Use the right path for `pwd'.
-            (substitute* "dist/Cwd/Cwd.pm"
-              (("/bin/pwd")
-               (which "pwd")))
-
-            (zero?
-             (system* "./Configure"
-                      (string-append "-Dprefix=" out)
-                      (string-append "-Dman1dir=" out "/share/man/man1")
-                      (string-append "-Dman3dir=" out "/share/man/man3")
-                      "-de" "-Dcc=gcc"
-                      "-Uinstallusrbinperl"
-                      "-Dinstallstyle=lib/perl5"
-                      "-Duseshrplib"
-                      (string-append "-Dlocincpth=" libc "/include")
-                      (string-append "-Dloclibpth=" libc "/lib")))))
-        %standard-phases)))
+       (modify-phases %standard-phases
+         (replace
+          'configure
+          (lambda* (#:key inputs outputs #:allow-other-keys)
+            (let ((out  (assoc-ref outputs "out"))
+                  (libc (assoc-ref inputs "libc")))
+              ;; Use the right path for `pwd'.
+              (substitute* "dist/Cwd/Cwd.pm"
+                (("/bin/pwd")
+                 (which "pwd")))
+
+              (zero?
+               (system* "./Configure"
+                        (string-append "-Dprefix=" out)
+                        (string-append "-Dman1dir=" out "/share/man/man1")
+                        (string-append "-Dman3dir=" out "/share/man/man3")
+                        "-de" "-Dcc=gcc"
+                        "-Uinstallusrbinperl"
+                        "-Dinstallstyle=lib/perl5"
+                        "-Duseshrplib"
+                        (string-append "-Dlocincpth=" libc "/include")
+                        (string-append "-Dloclibpth=" libc "/lib"))))))
+
+         (add-before
+          'strip 'make-shared-objects-writable
+          (lambda* (#:key outputs #:allow-other-keys)
+            ;; The 'lib/perl5' directory contains ~50 MiB of .so.  Make them
+            ;; writable so that 'strip' actually strips them.
+            (let* ((out (assoc-ref outputs "out"))
+                   (lib (string-append out "/lib")))
+              (for-each (lambda (dso)
+                          (chmod dso #o755))
+                        (find-files lib "\\.so$"))))))))
     (native-search-paths (list (search-path-specification
                                 (variable "PERL5LIB")
                                 (files '("lib/perl5/site_perl")))))
diff --git a/gnu/packages/unrtf.scm b/gnu/packages/unrtf.scm
index 6fafef1df4..60267d5a9c 100644
--- a/gnu/packages/unrtf.scm
+++ b/gnu/packages/unrtf.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2013 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2013, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -20,32 +20,46 @@
   #:use-module (guix licenses)
   #:use-module (guix packages)
   #:use-module (guix download)
-  #:use-module (guix build-system gnu))
+  #:use-module (guix build-system gnu)
+  #:use-module (guix gexp)
+  #:use-module (gnu packages autotools)
+  #:use-module (gnu packages m4)
+  #:use-module (gnu packages base))
 
 (define-public unrtf
   (package
     (name "unrtf")
-    (version "0.19.7")
+    (version "0.21.9")
     (source (origin
              (method url-fetch)
              (uri (string-append "mirror://gnu/unrtf/" version
                                  "/unrtf-" version ".tar.gz"))
              (sha256
               (base32
-               "1c15miv4ni395wix6qxiqgjfspd6ssdk1ly6mm8srh0jgpidgjzf"))))
-    (build-system gnu-build-system)
-    (arguments
-     '(#:phases (alist-replace
-                 'configure
-                 (lambda* (#:key outputs #:allow-other-keys)
-                   ;; No `configure' script; do it by hand.
-                   (let ((out (assoc-ref outputs "out")))
-                     (substitute* "Makefile"
-                       (("/usr/local") out))))
-                 %standard-phases)
+               "1pcdzf2h1prn393dkvg93v80vh38q0v817xnbwrlwxbdz4k7i8r2"))
+             (modules '((guix build utils)))
+             (snippet
+              #~(begin
+                  ;; The tarball includes site-specific generated files.
+                  ;; Remove them.
+                  (for-each delete-file '("config.log" "config.h"))
+                  (for-each delete-file
+                            (find-files "." "^Makefile$"))
+
+                  ;; The config/ directory contains dangling symlinks to
+                  ;; /usr/share/automake.
+                  (for-each delete-file (find-files "config"))
 
-       ;; There are test files, but apparently no automated test suite.
-       #:tests? #f))
+                  ;; Regenerate the whole thing.
+                  (setenv "PATH"
+                          (string-append #$autoconf "/bin:"
+                                         #$automake "/bin:"
+                                         #$m4 "/bin:"
+                                         #$grep "/bin:" #$sed "/bin:"
+                                         #$coreutils "/bin:"
+                                         (getenv "PATH")))
+                  (zero? (system* "autoreconf" "-vfi"))))))
+    (build-system gnu-build-system)
     (home-page "http://www.gnu.org/software/unrtf")
     (synopsis "Convert Rich Text Format documents to other formats")
     (description
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index a7925d9aa6..c4ec33e2d7 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -2,6 +2,7 @@
 ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013, 2015 Andreas Enge <andreas@enge.fr>
 ;;; Copyright © 2015 Eric Bavier <bavier@member.fsf.org>
+;;; Copyright © 2015 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Ricardo Wurmus <rekado@elephly.net>
 ;;;
 ;;; This file is part of GNU Guix.
@@ -34,6 +35,7 @@
   #:use-module (guix build-system cmake)
   #:use-module (guix build-system gnu)
   #:use-module (guix build-system perl)
+  #:use-module (guix build-system python)
   #:use-module (gnu packages linux))
 
 (define-public expat
@@ -59,22 +61,19 @@ things the parser might find in the XML document (like start tags).")
 (define-public libxml2
   (package
     (name "libxml2")
-    (version "2.9.0")
+    (version "2.9.2")
     (source (origin
              (method url-fetch)
              (uri (string-append "ftp://xmlsoft.org/libxml2/libxml2-"
                                  version ".tar.gz"))
              (sha256
               (base32
-               "10ib8bpar2pl68aqksfinvfmqknwnk7i35ibq6yjl8dpb0cxj9dd"))))
+               "1g6mf03xcabmk5ing1lwqmasr803616gb2xhn7pll10x2l5w6y2i"))))
     (build-system gnu-build-system)
     (home-page "http://www.xmlsoft.org/")
     (synopsis "C parser for XML")
     (propagated-inputs `(("zlib" ,zlib))) ; libxml2.la says '-lz'.
-    (native-inputs `(("perl" ,perl)
-                     ("python" ,python-2))) ; incompatible with Python 3 (print syntax)
-
-
+    (native-inputs `(("perl" ,perl)))
     ;; $XML_CATALOG_FILES lists 'catalog.xml' files found in under the 'xml'
     ;; sub-directory of any given package.
     (native-search-paths (list (search-path-specification
@@ -84,29 +83,40 @@ things the parser might find in the XML document (like start tags).")
                                 (file-pattern "^catalog\\.xml$")
                                 (file-type 'regular))))
     (search-paths native-search-paths)
-
-    (arguments
-     `(#:phases
-        (alist-replace
-         'install
-         (lambda* (#:key inputs outputs #:allow-other-keys #:rest args)
-          (let ((install (assoc-ref %standard-phases 'install))
-                (glibc (assoc-ref inputs ,(if (%current-target-system)
-                                              "cross-libc" "libc")))
-                (out (assoc-ref outputs "out")))
-            (apply install args)
-            (chdir "python")
-            (substitute* "setup.py"
-              (("/opt/include")
-               (string-append glibc "/include")))
-            (system* "python" "setup.py" "install"
-                     (string-append "--prefix=" out))))
-        %standard-phases)))
     (description
      "Libxml2 is the XML C parser and toolkit developed for the Gnome project
 (but it is usable outside of the Gnome platform).")
     (license license:x11)))
 
+(define-public python-libxml2
+  (package (inherit libxml2)
+    (name "python-libxml2")
+    (build-system python-build-system)
+    (arguments
+     `(;; XXX: Tests are specified in 'Makefile.am', but not in 'setup.py'.
+       #:tests? #f
+       #:phases
+       (modify-phases %standard-phases
+         (add-before
+          'build 'configure
+          (lambda* (#:key inputs #:allow-other-keys)
+            (chdir "python")
+            (let ((glibc   (assoc-ref inputs ,(if (%current-target-system)
+                                                  "cross-libc" "libc")))
+                  (libxml2 (assoc-ref inputs "libxml2")))
+              (substitute* "setup.py"
+                ;; For 'libxml2/libxml/tree.h'.
+                (("ROOT = r'/usr'")
+                 (format #f "ROOT = r'~a'" libxml2))
+                ;; For 'iconv.h'.
+                (("/opt/include")
+                 (string-append glibc "/include")))))))))
+    (inputs `(("libxml2" ,libxml2)))
+    (synopsis "Python bindings for the libxml2 library")))
+
+(define-public python2-libxml2
+  (package-with-python2 python-libxml2))
+
 (define-public libxslt
   (package
     (name "libxslt")
diff --git a/guix/packages.scm b/guix/packages.scm
index c900541e53..5a280857ea 100644
--- a/guix/packages.scm
+++ b/guix/packages.scm
@@ -316,8 +316,11 @@ representation."
   (string-append (package-name package) "-" (package-version package)))
 
 (define (%standard-patch-inputs)
-  (let ((ref (lambda (module var)
-               (module-ref (resolve-interface module) var))))
+  (let* ((canonical (module-ref (resolve-interface '(gnu packages base))
+                                'canonical-package))
+         (ref       (lambda (module var)
+                      (canonical
+                       (module-ref (resolve-interface module) var)))))
     `(("tar"   ,(ref '(gnu packages base) 'tar))
       ("xz"    ,(ref '(gnu packages compression) 'xz))
       ("bzip2" ,(ref '(gnu packages compression) 'bzip2))
@@ -325,8 +328,7 @@ representation."
       ("lzip"  ,(ref '(gnu packages compression) 'lzip))
       ("unzip" ,(ref '(gnu packages zip) 'unzip))
       ("patch" ,(ref '(gnu packages base) 'patch))
-      ("locales" ,(ref '(gnu packages commencement)
-                       'glibc-utf8-locales-final)))))
+      ("locales" ,(ref '(gnu packages base) 'glibc-utf8-locales)))))
 
 (define (default-guile)
   "Return the default Guile package used to run the build code of
@@ -446,7 +448,7 @@ IMPORTED-MODULES specify modules to use/import for use by SNIPPET."
 
           ;; SOURCE may be either a directory or a tarball.
           (and (if (file-is-directory? #+source)
-                   (let* ((store     (or (getenv "NIX_STORE") "/gnu/store"))
+                   (let* ((store     (%store-directory))
                           (len       (+ 1 (string-length store)))
                           (base      (string-drop #+source len))
                           (dash      (string-index base #\-))