[ Reason ]
Fix CVE-2026-105840 and CVE-2026-105842 (see #1150240).

[ Impact ]
Users are vulnerable to the two bugs.

[ Tests ]
Just compile-tested.

[ Risks ]
Two more checks and two additional NUL bytes. Pretty trivial, so not
very risky.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

[ Changes ]
Include two upstream patches to address the two CVEs.

[ Other info ]
The maintainer agreed to this stable update request at #1150240.