dash: add patch to prevent code execution when noexec is set

Dashs noexec flag `-n` did not work as documented, which could result in
code being inadvertently executed.

pkgs/shells/dash/default.nix

@@ -1,17 +1,25 @@
 { stdenv, buildPackages, autoreconfHook, fetchurl }:
 
 stdenv.mkDerivation rec {
-  name = "dash-0.5.11.2";
+  pname = "dash";
+  version = "0.5.11.2";
 
   src = fetchurl {
-    url = "http://gondor.apana.org.au/~herbert/dash/files/${name}.tar.gz";
+    url = "http://gondor.apana.org.au/~herbert/dash/files/${pname}-${version}.tar.gz";
     sha256 = "0pvdpm1cgfbc25ramn4305a0158yq031q1ain4dc972rnxl7vyq0";
   };
 
   hardeningDisable = [ "format" ];
 
   # Temporary fix until a proper one is accepted upstream
-  patches = stdenv.lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch;
+  patches = [
+    (fetchurl {
+      # Dash executes code when noexec ("-n") is specified
+      # https://www.openwall.com/lists/oss-security/2020/11/11/3
+      url = "https://git.kernel.org/pub/scm/utils/dash/dash.git/patch/?id=29d6f2148f10213de4e904d515e792d2cf8c968e";
+      sha256 = "08q90bx36ixwlcj331dh7420qyj8i0qh1cc1gljrhd83fhl9w0y5";
+    })
+  ] ++ stdenv.lib.optional stdenv.isDarwin ./0001-fix-dirent64-et-al-on-darwin.patch;
   depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = stdenv.lib.optional stdenv.isDarwin autoreconfHook;