krb5 commit: Fix crash on empty TXT records

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/6a7877183ef668d3b52df1f2926acc8be6f1c475
commit 6a7877183ef668d3b52df1f2926acc8be6f1c475
Author: David Zhou <david.zhou at dell.com>
Date:   Fri May 24 02:40:06 2024 +0000

    Fix crash on empty TXT records
    
    In k5_try_realm_txt_rr(), error out if the first text string in a TXT
    record is empty or if its length exceeds the record length.
    
    This function is only used when dns_lookup_realm is set to true in
    krb5.conf.  An alternative implementation is used on Windows.
    
    [ghudson at mit.edu: moved zero-length check and added upper bound check;
    rewrote commit message]
    
    ticket: 9174 (new)

 src/lib/krb5/os/dnsglue.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e..fd403aa75 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -470,12 +470,10 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
     }
 
     ret = krb5int_dns_nextans(ds, &base, &rdlen);
-    if (ret < 0 || base == NULL)
+    if (ret < 0 || rdlen < 2 || *base == 0 || *base > rdlen - 1)
         goto errout;
 
     p = base;
-    if (!INCR_OK(base, rdlen, p, 1))
-        goto errout;
     len = *p++;
     *realm = malloc((size_t)len + 1);
     if (*realm == NULL) {