fix(cve): CVE-2026-5435 - resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)

debian/changelog

@@ -1,3 +1,21 @@
+glibc (2.38-6deepin30) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-6791
+
+ -- deepin-ci-robot <packages@deepin.org>  Tue, 11 Aug 2026 10:34:43 +0800
+
+glibc (2.38-6deepin29) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-6238
+
+ -- deepin-ci-robot <packages@deepin.org>  Tue, 11 Aug 2026 10:20:50 +0800
+
+glibc (2.38-6deepin28) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-5435
+
+ -- deepin-ci-robot <packages@deepin.org>  Tue, 11 Aug 2026 10:08:15 +0800
+
 glibc (2.38-6deepin27) unstable; urgency=medium
 
   * fix(cve): CVE-2026-5450

debian/patches/CVE-2026-5435.patch

@@ -0,0 +1,120 @@
+Description: CVE-2026-5435 - 安全修复
+Author: Florian Weimer <fweimer@redhat.com>
+Origin: https://sourceware.org/git/?p=glibc.git;a=commit;h=ca44a6609c29a683b03575fa035c6d17aa591e72
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-5435
+Last-Update: 2026-06-19
+---
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index cef2212f..882a86e5 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -434,96 +434,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+
+-	case ns_t_cert: {
+-		u_int c_type, key_tag, alg;
+-		int n;
+-		unsigned int siz;
+-		char base64_cert[8192], tmp[40];
+-		const char *leader;
+-
+-		c_type  = ns_get16(rdata); rdata += NS_INT16SZ;
+-		key_tag = ns_get16(rdata); rdata += NS_INT16SZ;
+-		alg = (u_int) *rdata++;
+-
+-		len = SPRINTF((tmp, "%d %d %d ", c_type, key_tag, alg));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		siz = (edata-rdata)*4/3 + 4; /* "+4" accounts for trailing \0 */
+-		if (siz > sizeof(base64_cert) * 3/4) {
+-			const char *str = "record too long to print";
+-			T(addstr(str, strlen(str), &buf, &buflen));
+-		}
+-		else {
+-			len = b64_ntop(rdata, edata-rdata, base64_cert, siz);
+-
+-			if (len < 0)
+-				goto formerr;
+-			else if (len > 15) {
+-				T(addstr(" (", 2, &buf, &buflen));
+-				leader = "\n\t\t";
+-				spaced = 0;
+-			}
+-			else
+-				leader = " ";
+-
+-			for (n = 0; n < len; n += 48) {
+-				T(addstr(leader, strlen(leader),
+-					 &buf, &buflen));
+-				T(addstr(base64_cert + n, MIN(len - n, 48),
+-					 &buf, &buflen));
+-			}
+-			if (len > 15)
+-				T(addstr(" )", 2, &buf, &buflen));
+-		}
+-		break;
+-	    }
+-
+-	case ns_t_tkey: {
+-		/* KJD - need to complete this */
+-		u_long t;
+-		int mode, err, keysize;
+-
+-		/* Algorithm name. */
+-		T(addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-
+-		/* Inception. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Expiration. */
+-		t = ns_get32(rdata);  rdata += NS_INT32SZ;
+-		len = SPRINTF((tmp, "%lu ", t));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* Mode , Error, Key Size. */
+-		/* Priority, Weight, Port. */
+-		mode = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		err  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		keysize  = ns_get16(rdata);  rdata += NS_INT16SZ;
+-		len = SPRINTF((tmp, "%u %u %u ", mode, err, keysize));
+-		T(addstr(tmp, len, &buf, &buflen));
+-
+-		/* XXX need to dump key, print otherdata length & other data */
+-		break;
+-	    }
+-
+-	case ns_t_tsig: {
+-		/* BEW - need to complete this */
+-		int n;
+-
+-		T(len = addname(msg, msglen, &rdata, origin, &buf, &buflen));
+-		T(addstr(" ", 1, &buf, &buflen));
+-		rdata += 8; /*%< time */
+-		n = ns_get16(rdata); rdata += INT16SZ;
+-		rdata += n; /*%< sig */
+-		n = ns_get16(rdata); rdata += INT16SZ; /*%< original id */
+-		sprintf(buf, "%d", ns_get16(rdata));
+-		rdata += INT16SZ;
+-		addlen(strlen(buf), &buf, &buflen);
+-		break;
+-	    }
+-
+ 	case ns_t_a6: {
+ 		struct in6_addr a;
+ 		int pbyte, pbit;
+@@ -557,12 +467,6 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 		break;
+ 	    }
+
+-	case ns_t_opt: {
+-		len = SPRINTF((tmp, "%u bytes", class));
+-		T(addstr(tmp, len, &buf, &buflen));
+-		break;
+-	    }
+-
+ 	default:
+ 		snprintf (errbuf, sizeof (errbuf), "unknown RR type %d", type);
+ 		comment = errbuf;

debian/patches/CVE-2026-6238.patch

@@ -0,0 +1,37 @@
+Description: CVE-2026-6238 - 安全修复
+Author: Florian Weimer <fweimer@redhat.com>
+Origin: https://sourceware.org/git/?p=glibc.git;a=commit;h=a7b60d23bbb56eaef59f4962e4140062e552600a
+Bug: https://security-tracker.debian.org/tracker/CVE-2026-6238
+Last-Update: 2026-08-11
+---
+diff --git a/resolv/ns_print.c b/resolv/ns_print.c
+index 882a86e5..85d32592 100644
+--- a/resolv/ns_print.c
++++ b/resolv/ns_print.c
+@@ -316,7 +316,8 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+ 	case ns_t_loc: {
+ 		char t[255];
+
+-		/* XXX protocol format checking? */
++		if (rdlen != 16)
++		  goto formerr;
+ 		(void) loc_ntoa(rdata, t);
+ 		T(addstr(t, strlen(t), &buf, &buflen));
+ 		break;
+@@ -449,12 +450,13 @@ ns_sprintrrf(const u_char *msg, size_t msglen,
+
+ 		/* address suffix: provided only when prefix len != 128 */
+ 		if (pbit < 128) {
+-			if (rdata + pbyte >= edata) goto formerr;
++			unsigned int bytelen = sizeof(a) - pbyte;
++			if (edata - rdata < bytelen) goto formerr;
+ 			memset(&a, 0, sizeof(a));
+-			memcpy(&a.s6_addr[pbyte], rdata, sizeof(a) - pbyte);
++			memcpy(&a.s6_addr[pbyte], rdata, bytelen);
+ 			(void) inet_ntop(AF_INET6, &a, buf, buflen);
+ 			addlen(strlen(buf), &buf, &buflen);
+-			rdata += sizeof(a) - pbyte;
++			rdata += bytelen;
+ 		}
+
+ 		/* prefix name: provided only when prefix len > 0 */