From: David Zhou <david.zhou@dell.com>
Date: Fri, 24 May 2024 02:40:06 +0000 (+0000)
Subject: Fix crash on empty TXT records
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F1432%2Fhead;p=thirdparty%2Fkrb5.git

Fix crash on empty TXT records

In k5_try_realm_txt_rr(), error out if the first text string in a TXT
record is empty or if its length exceeds the record length.

This function is only used when dns_lookup_realm is set to true in
krb5.conf.  An alternative implementation is used on Windows.

[ghudson@mit.edu: moved zero-length check and added upper bound check;
rewrote commit message]

ticket: 9174 (new)
---

diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e8..fd403aa752 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -470,12 +470,10 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
     }
 
     ret = krb5int_dns_nextans(ds, &base, &rdlen);
-    if (ret < 0 || base == NULL)
+    if (ret < 0 || rdlen < 2 || *base == 0 || *base > rdlen - 1)
         goto errout;
 
     p = base;
-    if (!INCR_OK(base, rdlen, p, 1))
-        goto errout;
     len = *p++;
     *realm = malloc((size_t)len + 1);
     if (*realm == NULL) {