pcre: patch CVE-2016-1283

This fixes CVE-2016-1283, which allows remote attackers to cause
a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted regular expression.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283

pkgs/development/libraries/pcre/default.nix

@@ -22,8 +22,9 @@ in stdenv.mkDerivation rec {
     sha256 = "1pvra19ljkr5ky35y2iywjnsckrs9ch2anrf5b0dc91hw8v2vq5r";
   };
 
-  patches =
-    [ ];
+  patches = [
+    ./CVE-2016-1283.patch
+  ];
 
   outputs = [ "out" "doc" "man" ];