fix(glibc): CVE-2026-5928 - fix ungetwc operating on byte stream

debian/changelog

@@ -1,3 +1,17 @@
+glibc (2.38-6deepin26) unstable; urgency=high
+
+  * Fix CVE-2026-5928: ungetwc operates on byte stream instead of wide stream
+    (Closes: CVE-2026-5928)
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 10 Jul 2026 04:11:26 +0800
+
+glibc (CVE-2026-5450+fix1) unstable; urgency=high
+
+  * Fix CVE-2026-5450: backport upstream fix
+    (Closes: CVE-2026-5450)
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 10 Jul 2026 03:56:05 +0800
+
 glibc (2.38-6deepin25) unstable; urgency=medium
 
   * Fix mark cpuinfo feature tests xfail in pbuilder.

debian/patches/CVE-2026-5450.patch

@@ -0,0 +1,54 @@
+Index: glibc-fix/stdio-common/Makefile
+===================================================================
+--- glibc-fix.orig/stdio-common/Makefile
++++ glibc-fix/stdio-common/Makefile
+@@ -261,6 +261,7 @@ tests := \
+   tst-vfprintf-width-i18n \
+   tst-vfprintf-width-prec \
+   tst-vfprintf-width-prec-alloc \
++  tst-vfscanf-bz34008 \
+   tst-wc-printf \
+   tstdiomisc \
+   tstgetln \
+@@ -389,6 +390,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(
+ tst-vfprintf-width-prec-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
++tst-vfscanf-bz34008-ENV = \
++  MALLOC_CHECK_=3 \
++  LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+ tst-printf-bz25691-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+Index: glibc-fix/stdio-common/vfscanf-internal.c
+===================================================================
+--- glibc-fix.orig/stdio-common/vfscanf-internal.c
++++ glibc-fix/stdio-common/vfscanf-internal.c
+@@ -805,8 +805,7 @@ __vfscanf_internal (FILE *s, const char
+ 			{
+ 			  /* Enlarge the buffer.  */
+ 			  size_t newsize
+-			    = strsize
+-			      + (strsize >= width ? width - 1 : strsize);
++			    = strsize + (strsize >= width ? width : strsize);
+
+ 			  str = (char *) realloc (*strptr, newsize);
+ 			  if (str == NULL)
+@@ -877,7 +876,7 @@ __vfscanf_internal (FILE *s, const char
+ 		      && wstr == (wchar_t *) *strptr + strsize)
+ 		    {
+ 		      size_t newsize
+-			= strsize + (strsize > width ? width - 1 : strsize);
++			= strsize + (strsize >= width ? width : strsize);
+ 		      /* Enlarge the buffer.  */
+ 		      wstr = (wchar_t *) realloc (*strptr,
+ 						  newsize * sizeof (wchar_t));
+@@ -932,7 +931,7 @@ __vfscanf_internal (FILE *s, const char
+ 		    && wstr == (wchar_t *) *strptr + strsize)
+ 		  {
+ 		    size_t newsize
+-		      = strsize + (strsize > width ? width - 1 : strsize);
++		      = strsize + (strsize >= width ? width : strsize);
+ 		    /* Enlarge the buffer.  */
+ 		    wstr = (wchar_t *) realloc (*strptr,
+ 						newsize * sizeof (wchar_t));

debian/patches/series

@@ -1,3 +1,5 @@
+CVE-2026-5928.patch
+CVE-2026-5450.patch
 git-updates.diff
 
 locale/check-unknown-symbols.diff