libconfuse: add patch for CVE-2022-40320

pkgs/development/libraries/libconfuse/default.nix

@@ -1,4 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, flex }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, autoreconfHook
+, flex
+}:
 
 stdenv.mkDerivation rec {
   pname = "libconfuse";
@@ -11,6 +17,18 @@ stdenv.mkDerivation rec {
     owner = "martinh";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2022-40320.patch";
+      urls = [
+        "https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+        # files on sources.debian.org can disappear
+        "https://web.archive.org/web/20230107133212/https://sources.debian.org/data/main/libc/libconfuse/3.3-3/debian/patches/CVE-2022-40320.patch"
+      ];
+      sha256 = "sha256-ftfE9JFz4nyRSOb2xHb9BAtgWn5Yv2WLm4RegDLtiBw=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace tests/Makefile.am \
       --replace 'TESTS            += empty_string' "" \