libarchive: patch CVE-2026-5745

Pick patch per [1].

[1] https://security-tracker.debian.org/tracker/CVE-2026-5745

(From OE-Core rev: f35b64a303e5c3641a76576e69fe921a4b6166f9)

Signed-off-by: Peter Marko <peter.marko@siemens.com>
Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>

meta/recipes-extended/libarchive/libarchive/CVE-2026-5745.patch

@@ -0,0 +1,39 @@
+From 5f7025543205106d64081cbafd8c345bf859b86f Mon Sep 17 00:00:00 2001
+From: Tim Kientzle <kientzle@acm.org>
+Date: Sat, 18 Apr 2026 21:04:59 -0700
+Subject: [PATCH] Merge pull request #2905 from Patsakas/Patsakas-fix-acl-bug
+
+Fix NULL pointer increment in archive_acl_from_text_nl
+
+(Not a security issue, and arguably not really even a bug, but easy to fix regardless.)
+
+(cherry picked from commit 0b0b888f86b46e3b279f5f7c6eef0479f35978ee)
+
+CVE: CVE-2026-5745
+Upstream-Status: Backport [https://github.com/libarchive/libarchive/commit/5f7025543205106d64081cbafd8c345bf859b86f]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ libarchive/archive_acl.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/libarchive/archive_acl.c b/libarchive/archive_acl.c
+index ab601833..14a107a4 100644
+--- a/libarchive/archive_acl.c
++++ b/libarchive/archive_acl.c
+@@ -1718,7 +1718,6 @@ archive_acl_from_text_nl(struct archive_acl *acl, const char *text,
+ 
+ 			tag = 0;
+ 			s = field[n].start;
+-			st = field[n].start + 1;
+ 			len = field[n].end - field[n].start;
+ 
+ 			if (len == 0) {
+@@ -1726,6 +1725,8 @@ archive_acl_from_text_nl(struct archive_acl *acl, const char *text,
+ 				continue;
+ 			}
+ 
++			st = s + 1; 
++
+ 			switch (*s) {
+ 			case 'u':
+ 				if (len == 1 || (len == 4

meta/recipes-extended/libarchive/libarchive_3.7.9.bb

@@ -50,6 +50,7 @@ SRC_URI = "http://libarchive.org/downloads/libarchive-${PV}.tar.gz \
            file://CVE-2026-4424-1.patch \
            file://CVE-2026-4424-2.patch \
            file://CVE-2026-5121-02.patch \
+           file://CVE-2026-5745.patch \
            "
 UPSTREAM_CHECK_URI = "http://libarchive.org/"