krb5 commit [krb5-1.22]: Check TXT lookup results on Windows

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/30b952314aa335db4399227d521a4d2a44207a86
commit 30b952314aa335db4399227d521a4d2a44207a86
Author: Greg Hudson <ghudson at mit.edu>
Date:   Sun Sep 20 03:48:12 2026 -0400

    Check TXT lookup results on Windows
    
    In the Windows implementation of k5_try_realm_txt_rr(), iterate
    through the received records and pick one that is a non-empty TXT
    record.  Otherwise the function could dereference an invalid pointer
    and crash (depending on the behavior of DnsQuery_UTF8(), which is not
    fully known).  Discovered by Aisle Research.
    
    (cherry picked from commit adce9735b119b75387e64016280faa1320a71ec6)
    
    ticket: 9242
    version_fixed: 1.22.3

 src/lib/krb5/os/dnsglue.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e..6151f363e 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -409,7 +409,7 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
 {
     krb5_error_code ret = 0;
     char *txtname = NULL;
-    PDNS_RECORD rr = NULL;
+    PDNS_RECORD records = NULL, rr;
     DNS_STATUS st;
 
     *realm = NULL;
@@ -419,13 +419,21 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
         return ENOMEM;
 
     st = DnsQuery_UTF8(txtname, DNS_TYPE_TEXT, DNS_QUERY_STANDARD, NULL,
-                       &rr, NULL);
-    if (st != ERROR_SUCCESS || rr == NULL) {
+                       &records, NULL);
+    if (st != ERROR_SUCCESS || records == NULL) {
         TRACE_TXT_LOOKUP_NOTFOUND(context, txtname);
         ret = KRB5_ERR_HOST_REALM_UNKNOWN;
         goto cleanup;
     }
 
+    for (rr = records; rr != NULL; rr = rr->pNext) {
+        if (rr->wType == DNS_TYPE_TEXT && rr->Data.TXT.dwStringCount >= 1)
+            break;
+    }
+    if (rr == NULL) {
+        ret = KRB5_ERR_HOST_REALM_UNKNOWN;
+        goto cleanup;
+    }
     *realm = strdup(rr->Data.TXT.pStringArray[0]);
     if (*realm == NULL)
         ret = ENOMEM;
@@ -433,8 +441,8 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
 
 cleanup:
     free(txtname);
-    if (rr != NULL)
-        DnsRecordListFree(rr, DnsFreeRecordList);
+    if (records != NULL)
+        DnsRecordListFree(records, DnsFreeRecordList);
     return ret;
 }