krb5 commit: Prevent buffer overrun in old leashdll functions

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/3e5cb96070fbd83f09098a14e220efc85056c572
commit 3e5cb96070fbd83f09098a14e220efc85056c572
Author: Greg Hudson <ghudson at mit.edu>
Date:   Wed Sep 2 15:54:33 2026 -0400

    Prevent buffer overrun in old leashdll functions
    
    Leash_kinit_dlg() and Leash_changepwd_dlg() use a dialog callback
    function PasswordProc().  If the caller supplies a principal name
    longer than 254 bytes via lpdlginfo->principal, PasswordProc() writes
    beyond the bounds of a stack-allocated array.  Reported by Rahul
    Hoysala.
    
    These functions are both deprecated in favor of _ex variants (which
    use a different dialog callback) and are not used by Leash.
    
    ticket: 9233 (new)
    tags: pullup
    target_version: 1.22-next

 src/windows/leashdll/lsh_pwd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/windows/leashdll/lsh_pwd.c b/src/windows/leashdll/lsh_pwd.c
index f94481109..f06bd73d8 100644
--- a/src/windows/leashdll/lsh_pwd.c
+++ b/src/windows/leashdll/lsh_pwd.c
@@ -550,7 +550,7 @@ PasswordProc(
 
         SetProp(hDialog, "HANDLES_HELP", (HANDLE)1);
 
-        if (lpdi->principal)
+        if (lpdi->principal && lstrlen(lpdi->principal) < sizeof(principal))
             lstrcpy(principal, lpdi->principal);
         else
 	{