krb5 commit [krb5-1.22]: Validate lengths when deserializing profiles

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/070b895b8b5237c9d264956cfc0b4a3ac1311e1f
commit 070b895b8b5237c9d264956cfc0b4a3ac1311e1f
Author: Bogdan Boguslavskij <bogdanb at altlinux.org>
Date:   Mon Aug 31 18:23:28 2026 +0300

    Validate lengths when deserializing profiles
    
    Add bounds checks to profile_ser_internalize(), in a similar fashion
    to commit 63ae6a8d99ce89258d732f7561233f60df533fa9 for other
    deserialization functions.
    
    [ghudson at mit.edu: added a bounds check for fcount; rewrote commit
    message]
    
    (cherry picked from commit 5281e51e2421d9379f8f2ac654e401d305fac6e7)
    
    ticket: 9248
    version_fixed: 1.22.3

 src/util/profile/prof_init.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/util/profile/prof_init.c b/src/util/profile/prof_init.c
index 783efbde2..26456acc6 100644
--- a/src/util/profile/prof_init.c
+++ b/src/util/profile/prof_init.c
@@ -631,6 +631,8 @@ errcode_t profile_ser_internalize(profile_t *profilep,
     (void) unpack_int32(&fcount, &bp, &remain);
     retval = ENOMEM;
 
+    if (fcount < 0 || (size_t)fcount > remain)
+        goto cleanup;
     flist = (profile_filespec_t *) malloc(sizeof(profile_filespec_t) * (size_t) (fcount + 1));
     if (!flist)
         goto cleanup;
@@ -638,6 +640,8 @@ errcode_t profile_ser_internalize(profile_t *profilep,
     memset(flist, 0, sizeof(char *) * (size_t) (fcount+1));
     for (i=0; i<fcount; i++) {
         if (!unpack_int32(&tmp, &bp, &remain)) {
+            if (tmp < 0 || (size_t)tmp > remain)
+                goto cleanup;
             flist[i] = (char *) malloc((size_t) (tmp+1));
             if (!flist[i])
                 goto cleanup;