flatcc: patch CVE-2026-90786

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-90786

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>

meta-oe/recipes-devtools/flatcc/flatcc/CVE-2026-90786.patch

@@ -0,0 +1,40 @@
+From bb5238cd959e88c590b413d3b105562e6d1c5114 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Mikkel=20Fahn=C3=B8e=20J=C3=B8rgensen?= <mikkel@dvide.com>
+Date: Tue, 4 Aug 2026 19:53:26 +0200
+Subject: [PATCH] Fail early on duplicate symbols to aovid triggering unhandled
+ assertions in release build (closes #387)
+
+(cherry picked from commit 8b19ba4e992ebcad7f5970704d1afc5507fa5205)
+
+CVE: CVE-2026-90786
+Upstream-Status: Backport [https://github.com/dvidelabs/flatcc/commit/8b19ba4e992ebcad7f5970704d1afc5507fa5205]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ src/compiler/semantics.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/compiler/semantics.c b/src/compiler/semantics.c
+index 6c56c37..21ff948 100644
+--- a/src/compiler/semantics.c
++++ b/src/compiler/semantics.c
+@@ -1351,6 +1351,8 @@ static int process_table(fb_parser_t *P, fb_compound_type_t *ct)
+             id_failed = 1;
+         }
+     }
++    // Ordering assumes there are no duplicates so conservatively abort on error.
++    if (P->failed) return P->failed;
+     /* Order in which data is ordered in binary buffer. */
+     if (ct->metadata_flags & fb_f_original_order) {
+         ct->ordered_members = original_order_members(P, (fb_member_t *)ct->members);
+@@ -1821,6 +1823,10 @@ int fb_build_schema(fb_parser_t *P)
+ #endif
+         }
+     }
++
++    /* Semantic analysis assumes no duplicates so conservatibely abort on error. */
++    if (P->failed) return P->failed;
++
+     install_known_attributes(P);
+ 
+     if (!P->opts.hide_later_enum) {

meta-oe/recipes-devtools/flatcc/flatcc_git.bb

@@ -12,6 +12,7 @@ SRC_URI = " \
            git://github.com/dvidelabs/flatcc.git;protocol=https;branch=master \
            file://0001-Check-for-C-standard-version-23-for-__fallthrough__.patch \
            file://0002-allow-build-with-cmake-4.patch \
+           file://CVE-2026-90786.patch \
 "
 SRCREV = "1653ec964730ec7d9892a08a1695ada6d20f5196"