[PATCH v2 2.39 0/7] Cherry-pick CVE-2026-5435 and CVE-2026-6238 fixes to release/2.39/master

[Jaipaul Cheernam]

Hi,

v2: Backport the full series including the 3 preparatory commits
(type/class formatting fixes) needed for the test case to pass.
All 7 commits cherry-pick cleanly with no conflicts.

v1 only included 4 patches and had a trivial conflict. Florian
pointed out the test would fail without the type formatting changes.

This series cherry-picks the fixes for CVE-2026-5435 (bug 34033) and
CVE-2026-6238 (bug 34069) to the release/2.39/master branch.

Patches 1-3 are preparatory fixes for ns_sprintrrf type/class
formatting (bug 34289), required for the test in patch 7 to pass.
Patches 4-6 are the actual security fixes.
Patch 7 is the regression test.

The same fixes were already cherry-picked to release/2.43/master as
commits e64ae5a591f0, 3a418da6a393, and 8759917de589.

All patches apply cleanly on top of current release/2.39/master HEAD
(be1e627cd7).

glibc 2.39 is actively used in Yocto Project's scarthgap (LTS) release,
so this branch continues to have downstream consumers relying on it for
security fixes.

Testing: All 56 resolv tests pass, including the new tst-ns_sprintrr.
No regressions.

Thanks,
Jaipaul

Florian Weimer (7):
  resolv: Declare __p_class_syms, __p_type_syms for internal use
  resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
  resolv: Improve formatting of unknown records in ns_sprintrrf
  resolv: Check for inet_ntop failure in ns_sprintrrf
  resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
  resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
  resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)

 include/resolv.h         |   5 +
 resolv/Makefile          |   2 +
 resolv/ns_print.c        | 170 +++++++-------------
 resolv/res_debug.c       |   4 -
 resolv/tst-ns_sprintrr.c | 329 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 389 insertions(+), 121 deletions(-)
 create mode 100644 resolv/tst-ns_sprintrr.c

-- 
2.34.1