Import Debian changes 2.31-13

debian/changelog

+glibc (2.31-13) unstable; urgency=medium
+
+  [ Colin Watson ]
+  * debian/debhelper.in/libc.postinst, script.in/nsscheck.sh: Look for
+    openssh-server package rather than ssh.  Closes: #990069
+
+  [ Aurelien Jarno ]
+  * debian/patches/git-updates.diff: update from upstream stable branch:
+    - Fix an arbitrary read in wordexp() (CVE-2021-35942).  Closes:
+      #990542.
+
+ -- Aurelien Jarno <aurel32@debian.org>  Tue, 06 Jul 2021 21:16:59 +0200
+
 glibc (2.31-12) unstable; urgency=medium
   * debian/po/de.po: fix encoding declaration.  Closes: #986450.

debian/debhelper.in/libc.postinst

@@ -33,9 +33,10 @@ then
 	    check="$check boa cucipop courier-authdaemon cron cups exim"
 	    check="$check exim4-base dovecot-common cucipop incron lprng lpr"
 	    check="$check lpr-ppd mysql-server nis openbsd-inetd"
-	    check="$check openldapd postgresql-common proftpd postfix postfix-tls"
-	    check="$check rsync samba sasl2-bin slapd smail sendmail snmpd ssh"
-	    check="$check spamassassin vsftpd wu-ftpd wu-ftpd-academ wwwoffle"
+	    check="$check openldapd openssh-server postgresql-common proftpd"
+	    check="$check postfix postfix-tls rsync samba sasl2-bin slapd"
+	    check="$check smail sendmail snmpd spamassassin vsftpd"
+	    check="$check wu-ftpd wu-ftpd-academ wwwoffle"
 	    check="$check webmin dropbear gdm"
 	    # NSS services check: 
 	    __NSS_CHECK__

debian/patches/git-updates.diff

@@ -3647,6 +3647,31 @@ index cba9cd1819..4580cefb9f 100644
  		dirlen = home_len + rest_len;
  		dirname_modified = 1;
  	      }
+diff --git a/posix/wordexp-test.c b/posix/wordexp-test.c
+index ed1b22308e..cb3f989cba 100644
+--- a/posix/wordexp-test.c
++++ b/posix/wordexp-test.c
+@@ -183,6 +183,7 @@ struct test_case_struct
+     { 0, NULL, "$var", 0, 0, { NULL, }, IFS },
+     { 0, NULL, "\"\\n\"", 0, 1, { "\\n", }, IFS },
+     { 0, NULL, "", 0, 0, { NULL, }, IFS },
++    { 0, NULL, "${1234567890123456789012}", 0, 0, { NULL, }, IFS },
+ 
+     /* Flags not already covered (testit() has special handling for these) */
+     { 0, NULL, "one two", WRDE_DOOFFS, 2, { "one", "two", }, IFS },
+diff --git a/posix/wordexp.c b/posix/wordexp.c
+index e082d94895..56289503a1 100644
+--- a/posix/wordexp.c
++++ b/posix/wordexp.c
+@@ -1399,7 +1399,7 @@ envsubst:
+   /* Is it a numeric parameter? */
+   else if (isdigit (env[0]))
+     {
+-      int n = atoi (env);
++      unsigned long n = strtoul (env, NULL, 10);
+ 
+       if (n >= __libc_argc)
+ 	/* Substitute NULL. */
 diff --git a/stdlib/Makefile b/stdlib/Makefile
 index 45214b59e4..4615f6dfe7 100644
 --- a/stdlib/Makefile

debian/script.in/nsscheck.sh

@@ -12,6 +12,7 @@
 			-e's/\blpr\b/lpd/g' \
 			-e's/\blpr-ppd\b/lpd-ppd/g' \
 			-e's/\bmysql-server\b/mysql/g' \
+			-e's/\bopenssh-server\b/ssh/g' \
 			-e's/\bsasl2-bin\b/saslauthd/g' \
 			-e's/\bsamba\b/smbd/g' \
 			-e's/\bpostgresql-common\b/postgresql/g' \