krb5 commit: Fix crash on empty TXT records
ghudson at mit.edu
ghudson at mit.edu
Thu May 22 00:01:05 EDT 2025
https://github.com/krb5/krb5/commit/6a7877183ef668d3b52df1f2926acc8be6f1c475
commit 6a7877183ef668d3b52df1f2926acc8be6f1c475
Author: David Zhou <david.zhou at dell.com>
Date: Fri May 24 02:40:06 2024 +0000
Fix crash on empty TXT records
In k5_try_realm_txt_rr(), error out if the first text string in a TXT
record is empty or if its length exceeds the record length.
This function is only used when dns_lookup_realm is set to true in
krb5.conf. An alternative implementation is used on Windows.
[ghudson at mit.edu: moved zero-length check and added upper bound check;
rewrote commit message]
ticket: 9174 (new)
src/lib/krb5/os/dnsglue.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e..fd403aa75 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -470,12 +470,10 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
}
ret = krb5int_dns_nextans(ds, &base, &rdlen);
- if (ret < 0 || base == NULL)
+ if (ret < 0 || rdlen < 2 || *base == 0 || *base > rdlen - 1)
goto errout;
p = base;
- if (!INCR_OK(base, rdlen, p, 1))
- goto errout;
len = *p++;
*realm = malloc((size_t)len + 1);
if (*realm == NULL) {
More information about the cvs-krb5
mailing list