Import upstream patches to fix 5 CVEs

Lukas Märdianrequested to merge
debian/buster-deb10u4 into debian/buster

Backport the DLA-4625-1 fix set from the bullseye branch to buster 2.80:

  • CVE-2026-2291: buffer overflow in struct bigname
  • CVE-2026-4890: NSEC bitmap parsing infinite loop
  • CVE-2026-4891: verify rdlen field in RRSIG packets
  • CVE-2026-4892: buffer overflow in helper.c with large CLIDs
  • CVE-2026-4893: broken client subnet validation

The patches are the same files shipped in 2.85-1+deb11u2; all apply to 2.80 with only line offsets (no fuzz).

Debusine workflow: https://debusine.freexian.com/freexian/elts-staging/work-request/255606/

Note: CVE-2026-5172 is a 6th dnsmasq CVE from the same 2026-05-11 batch, which is not fixed by DLA-4625-1. 2.80's extract_addresses() lacks the vulnerable generic-RR/rrblock path, so 2.80 is not affected.

Edited by Lukas Märdian

Merge request reports