fix glibc CVE-2026-4437 and 4438

[Xi Ruoyao]

See ​https://sourceware.org/pipermail/libc-alpha/2026-March/176091.html.

[Bruce Dubbs]

The link above is interesting. It changes 4 files:

 resolv/Makefile                 |   7 +
 resolv/nss_dns/dns-host.c       |   4 +-
 resolv/tst-resolv-dns-section.c | 161 ++++++++++++++++++++
 resolv/tst-resolv-invalid-ptr.c | 258 ++++++++++++++++++++++++++++++++

Three of those are for tests. The only real change is to two lines in one file: resolv/nss_dns/dns-host.c

-  while (ancount > 0)
+  for (; ancount > 0; --ancount)
...
-	      || !__res_binary_hnok (expected_name)
+	      || !__res_binary_hnok (name_buffer)

This is the essential fix:

sed -e '/while..ancount/c\  for (; ancount > 0; --ancount)'  \
    -e '/binary_hnok..expected/s/expected_name/name_buffer/' \
    -i resolv/nss_dns/dns-host.c

I did not rebuild glibc, but I did check that the sed above does the same as the patch to the affected file.

[zeckma]

I'd go with the sed approach.

[Douglas R. Reno]

I wanted to report in real quick that I tried the sed here and it's working perfectly on my laptop, which I just rebuilt glibc on about 30 minutes ago. Tests look normal as well :)

[Bruce Dubbs]

Fixed at commits

f3d6527e8 Add a sed to glibc-2.43 (Security update).
7df48f36f Update to XML-Parser-2.53 (Security update).

Leaving both open for security updates.

[Bruce Dubbs]

Reassigning for security advisories.

[Douglas R. Reno]

SA-13.0-021 issued.

Added a note in the advisory regarding updating or rebuilding glibc, reminding users to follow the instructions strictly in the Updating section to prevent a broken system.

Also brought this note back to SA-12.4-079 for glibc-2.43 to prevent 12.4 users from getting in trouble.