T8135: backport the fix for CVE-2025-68615 (DoS in snmptrapd)

[dmbaturin]

Change summary

This is a manual backport of the fix to net-snmp 5.9.4.

The history of that fix is:

• In net-snmp/net-snmp@375984f , the author added a condition to ensure the OID length was no less than zero (insufficient because zero length triggers the bug).
• In net-snmp/net-snmp@5bf2e55 , the condition was corrected to >= to avoid handling zero-length OIDs.
• Both changes were later reverted: net-snmp/net-snmp@3a58bc7
• They were reverted in favor of a different check for OID length before attempting to manipulate it in any way: net-snmp/net-snmp@4a201ac

The relevant section in net-snmp's master branch is: https://github.com/net-snmp/net-snmp/blob/master/apps/snmptrapd_handlers.c#L1118-L1131

This PR includes a recreation of 4a201ac that applies to the older net-snmp version we use.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

Related PR(s)

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[sever-sever]

Clean fails, but this was and before, the binaries exist after build:

libtool: clean: rmdir .libs >/dev/null 2>&1
libtool: clean: rmdir transports/.libs >/dev/null 2>&1
make[2]: Leaving directory '/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp/net-snmp/snmplib'
making clean in /vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp/net-snmp/agent
make[2]: Entering directory '/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp/net-snmp/agent'
make[2]: *** No rule to make target 'clean'.  Stop.
make[2]: Leaving directory '/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp/net-snmp/agent'
make[1]: *** [Makefile:1020: cleansubdirs] Error 1
make[1]: Leaving directory '/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp/net-snmp'
dh_auto_clean: error: make -j4 distclean returned exit code 2
make: *** [debian/rules:36: clean] Error 2
dpkg-buildpackage: error: fakeroot debian/rules clean subprocess returned exit status 2
I: Cleaned up build dependency packages
vyos_bld@04e6bd29d3dc:/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp$ 
vyos_bld@04e6bd29d3dc:/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp$ 
vyos_bld@04e6bd29d3dc:/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp$ 
vyos_bld@04e6bd29d3dc:/vyos/work/tmp/T8135-snmptrapd-dos/vyos-build/scripts/package-build/net-snmp$ ls -l *.deb
-rw-r--r-- 1 vyos_bld vyos_bld   21512 Jan 21 10:43 libnetsnmptrapd40_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld   58696 Jan 21 10:43 libnetsnmptrapd40-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld 2489000 Jan 21 10:43 libsnmp40_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld 2157968 Jan 21 10:43 libsnmp40-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld 1769588 Jan 21 10:43 libsnmp-base_5.9.4+dfsg-1_all.deb
-rw-r--r-- 1 vyos_bld vyos_bld  201316 Jan 21 10:43 libsnmp-dev_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld 1744064 Jan 21 10:43 libsnmp-perl_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld  227056 Jan 21 10:43 libsnmp-perl-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld  173572 Jan 21 10:43 snmp_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld   57068 Jan 21 10:43 snmpd_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld  278292 Jan 21 10:43 snmp-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld   21428 Jan 21 10:43 snmpd-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld   24280 Jan 21 10:43 snmptrapd_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld   24580 Jan 21 10:43 snmptrapd-dbgsym_5.9.4+dfsg-1_arm64.deb
-rw-r--r-- 1 vyos_bld vyos_bld 1668872 Jan 21 10:43 tkmib_5.9.4+dfsg-1_all.deb

[ritika0313]

Looks fine.

[dmbaturin]

@sever-sever Yes, I've seen that. I'm not sure what's going on with the clean step.