luajit*: patch CVE-2019-19391

- upstream argues that this kind of problems can't be called
  vulnerabilities
- the upstream patch is trivial, so why not fix the bug
- nixpkgs master uses git versions already containing that commit
Fixes #90875 (roundup ticket).

pkgs/development/interpreters/luajit/default.nix

@@ -1,4 +1,5 @@
 { stdenv, fetchurl, buildPackages
+, fetchpatch
 , name ? "luajit-${version}"
 , isStable
 , sha256
@@ -20,6 +21,13 @@ stdenv.mkDerivation rec {
 
   luaversion = "5.1";
 
+  patches = [
+    (fetchpatch {
+      name = "cve-2019-19391.patch";
+      url = "https://github.com/LuaJIT/LuaJIT/commit/0cd643d7c.diff";
+      sha256 = "1ya5h6r3mi7mkjy6bj1hjbl43j3lwh4phmi5q792rrz8az64hnjy";
+    })
+  ];
   postPatch = ''
     substituteInPlace Makefile --replace ldconfig :
   '';