krb5 commit [krb5-1.22]: Prevent unsigned integer overflow in IAKERB

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/1386c7bfbfb36b64511311257905b07e6fe7cbe0
commit 1386c7bfbfb36b64511311257905b07e6fe7cbe0
Author: Osvaldo Janeri Filho <janeri at gmail.com>
Date:   Fri Oct 30 08:41:19 2026 -0300

    Prevent unsigned integer overflow in IAKERB
    
    In iakerb_save_token(), check that token->length (size_t) won't
    overflow the accumulated conversation length ctx->conv.length
    (unsigned int).
    
    [ghudson at mit.edu: edited commit message]
    
    (cherry picked from commit 32c1d65f56af1b6c150497a4f9d322a50c2a9f05)
    
    ticket: 9278
    version_fixed: 1.22.3

 src/lib/gssapi/krb5/iakerb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/lib/gssapi/krb5/iakerb.c b/src/lib/gssapi/krb5/iakerb.c
index 7cc4710e2..5f5a41a1e 100644
--- a/src/lib/gssapi/krb5/iakerb.c
+++ b/src/lib/gssapi/krb5/iakerb.c
@@ -188,6 +188,9 @@ iakerb_save_token(iakerb_ctx_id_t ctx, const gss_buffer_t token)
 {
     char *p;
 
+    if (token->length > UINT_MAX - ctx->conv.length)
+        return ENOMEM;
+
     p = realloc(ctx->conv.data, ctx->conv.length + token->length);
     if (p == NULL)
         return ENOMEM;