flatcc: patch CVE-2026-90785

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90785

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90785.patch

@@ -0,0 +1,29 @@
+From d44946b10f4da3c2c7b46e0a58bb86f9b5e9f342 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen?= <mikkel@dvide.com>
+Date: Tue, 4 Aug 2026 20:01:22 +0200
+Subject: [PATCH] Avoid processing structs recursively if recursion already
+ detected (closes #388)
+
+(cherry picked from commit f705032346ee39efd7d3848c50b73d455d28d06d)
+
+CVE: CVE-2026-90785
+Upstream-Status: Backport [https://github.com/dvidelabs/flatcc/commit/f705032346ee39efd7d3848c50b73d455d28d06d]
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/compiler/semantics.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/src/compiler/semantics.c b/src/compiler/semantics.c
+index 21ff948..2b49eee 100644
+--- a/src/compiler/semantics.c
++++ b/src/compiler/semantics.c
+@@ -505,6 +505,9 @@ static int analyze_struct(fb_parser_t *P, fb_compound_type_t *ct)
+     uint16_t align;
+     fb_token_t *t;
+ 
++    /* Avoid triggering assertions on already detected circular references. */
++    if (P->failed) return P->failed;
++
+     assert(ct->symbol.kind == fb_is_struct);
+ 
+     assert(!(ct->symbol.flags & fb_circular_open));

meta-oe/recipes-devtools/flatcc/flatcc_git.bb

@@ -13,6 +13,7 @@ SRC_URI = " \
            file://0001-Check-for-C-standard-version-23-for-__fallthrough__.patch \
            file://0002-allow-build-with-cmake-4.patch \
            file://CVE-2026-90786.patch \
+           file://CVE-2026-90785.patch \
 "
 SRCREV = "1653ec964730ec7d9892a08a1695ada6d20f5196"