krb5 commit: Fix null dereference in SPNEGO token processing

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/4ae75cded0fbeb1def4c82e352759089d80d40ab
commit 4ae75cded0fbeb1def4c82e352759089d80d40ab
Author: Jeremy Hitt <jeremy.hitt at isilon.com>
Date:   Fri Feb 13 00:58:14 2026 +0000

    Fix null dereference in SPNEGO token processing
    
    Commit fdceb225f881e2b1337eebcb9a9443fa4a9be3fd erroneously removed a
    check from get_negTokenResp() for successful decoding of the
    mechListMIC field.  Restore the check to prevent a null pointer
    dereference.
    
    [ghudson at mit.edu: rewrote commit message]
    
    ticket: 9213 (new)
    tags: pullup
    target_version: 1.22-next

 src/lib/gssapi/spnego/spnego_mech.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index f0c37c7cd..23f93c240 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -3517,6 +3517,8 @@ get_negTokenResp(OM_uint32 *minor_status, struct k5input *in,
 
 	if (k5_der_get_value(&seq, CONTEXT | 0x03, &field)) {
 		*mechListMIC = get_octet_string(&field);
+		if (*mechListMIC == GSS_C_NO_BUFFER)
+			return GSS_S_DEFECTIVE_TOKEN;
 
                 /* Handle Windows 2000 duplicate response token */
                 if (*responseToken &&