git: 2b22e05b1747 - stable/15 - libc: Don't use uninitialised string for getnetbyaddr[_r](0) DNS lookup

The branch stable/15 has been updated by jrtc27:

URL: https://cgit.FreeBSD.org/src/commit/?id=2b22e05b1747c9499f38264c15eccf2818a9dbc1

commit 2b22e05b1747c9499f38264c15eccf2818a9dbc1
Author:     Jessica Clarke <jrtc27@FreeBSD.org>
AuthorDate: 2026-01-27 21:44:39 +0000
Commit:     Jessica Clarke <jrtc27@FreeBSD.org>
CommitDate: 2026-01-30 01:20:25 +0000

    libc: Don't use uninitialised string for getnetbyaddr[_r](0) DNS lookup
    
    If net is all-zero, the loop to extract all leading non-zero octets will
    iterate zero times and leave nn with the value 4, which the following
    switch statement to initialise qbuf does not handle. As a result,
    _dns_getnetbyaddr will look up the PTR record for this uninitialised
    string, which will leak the pre-existing contents of that stack memory
    to the DNS resolver and, if remote and not otherwise protected, network.
    
    Note that _dns_getnetbyaddr is only used if nsswitch.conf is configured
    to enable the "dns" source for the "networks" database, which is not the
    default configuration in FreeBSD.
    
    For glibc this same bug, in code also derived from BIND's, was issued
    CVE-2026-0915. This commit adopts the same behaviour as glibc's fix,
    which is to regard a net of 0 as being for 0.0.0.0. Apparently NetBSD
    will return NS_UNAVAIL instead, which may or may not make more sense,
    but in general glibc compatibility tends to cause less friction when
    there's not a good reason to avoid it.
    
    Reviewed by:    markj (secteam)
    Fixes:          1363f04ce1b8 ("get* rework and new bind code")
    MFC after:      1 day
    Security:       Same bug as glibc's CVE-2026-0915
    
    (cherry picked from commit 331316b073505e4794754af1cd0c5ccc578a2bde)
---
 lib/libc/net/getnetbydns.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/lib/libc/net/getnetbydns.c b/lib/libc/net/getnetbydns.c
index deca8c58fca5..b9cc29d5bfdb 100644
--- a/lib/libc/net/getnetbydns.c
+++ b/lib/libc/net/getnetbydns.c
@@ -304,6 +304,9 @@ _dns_getnetbyaddr(void *rval, void *cb_data, va_list ap)
 	for (nn = 4, net2 = net; net2; net2 >>= 8)
 		netbr[--nn] = net2 & 0xff;
 	switch (nn) {
+	case 4: 	/* net was all-zero i.e. 0.0.0.0 */
+		sprintf(qbuf, "0.0.0.0.in-addr.arpa");
+		break;
 	case 3: 	/* Class A */
 		sprintf(qbuf, "0.0.0.%u.in-addr.arpa", netbr[3]);
 		break;