[PATCH 2.42 0/7] Cherry-pick CVE-2026-5435 and CVE-2026-6238 fixes to release/2.42/master

Jaipaul Cheernam <[email protected]> Mon, 3 Aug 2026 16:23:20 +0200
Newsgroups gmane.comp.lib.glibc.alpha
Message-ID <[email protected]>
Hi,

This series cherry-picks the fixes for CVE-2026-5435 (bug 34033) and
CVE-2026-6238 (bug 34069) to the release/2.42/master branch.

All 7 commits cherry-pick cleanly with no conflicts.

Patches 1-3 are preparatory fixes for ns_sprintrrf type/class
formatting (bug 34289), required for the test in patch 7 to pass.
Patches 4-6 are the actual security fixes.
Patch 7 is the regression test.

The same fixes were already cherry-picked to release/2.43/master.
An identical series for release/2.39/master was sent as [PATCH v2 2.39 0/7].

Thanks,
Jaipaul

Florian Weimer (7):
  resolv: Declare __p_class_syms, __p_type_syms for internal use
  resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
  resolv: Improve formatting of unknown records in ns_sprintrrf
  resolv: Check for inet_ntop failure in ns_sprintrrf
  resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
  resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
  resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)

-- 
2.34.1