expat: apply CVE-2016-0718 patch

Closes #1347.

Signed-off-by: Dominyk Tiller <dominyktiller@gmail.com>

Formula/expat.rb

@@ -4,6 +4,7 @@ class Expat < Formula
   url "https://downloads.sourceforge.net/project/expat/expat/2.1.1/expat-2.1.1.tar.bz2"
   mirror "https://fossies.org/linux/www/expat-2.1.1.tar.bz2"
   sha256 "aff584e5a2f759dcfc6d48671e9529f6afe1e30b0cd6a4cec200cbe3f793de67"
+  revision 1
 
   head ":pserver:anonymous:@expat.cvs.sourceforge.net:/cvsroot/expat", :using => :cvs
 
@@ -18,6 +19,12 @@ class Expat < Formula
 
   option :universal
 
+  # http://seclists.org/oss-sec/2016/q2/360
+  patch do
+    url "https://raw.githubusercontent.com/Homebrew/patches/1c9ee45548b75/expat/CVE-2016-0718-v2-2-1.patch"
+    sha256 "575f8d45835b917da833106ee4cb92efd98c5c1284f6f437aaf65bbc63edd767"
+  end
+
   def install
     ENV.universal_binary if build.universal?
     system "./configure", "--prefix=#{prefix}",
@@ -60,7 +67,7 @@ class Expat < Formula
         return result;
       }
     EOS
-    system ENV.cc, "test.c", "-lexpat", "-o", "test"
+    system ENV.cc, "test.c", "-I#{include}", "-L#{lib}", "-lexpat", "-o", "test"
     assert_equal "tag:str|data:Hello, world!|", shell_output("./test")
   end
 end