krb5 commit [krb5-1.22]: Prevent null deref in KDC dispatch corner case

[ghudson at mit.edu]

https://github.com/krb5/krb5/commit/e86ffb1de73ede86e48add92786dbdc08bb1b850
commit e86ffb1de73ede86e48add92786dbdc08bb1b850
Author: Greg Hudson <ghudson at mit.edu>
Date:   Thu Sep 17 11:07:52 2026 -0400

    Prevent null deref in KDC dispatch corner case
    
    If a KDC request matches an entry in the lookaside cache, we transmit
    the reply without decoding the request, and therefore without looking
    up the applicable realm.  But if the cached reply is longer than
    kdc_max_dgram_reply_size, we need the applicable realm's TGS server
    principal to construct a KRB_ERR_RESPONSE_TOO_BIG KRB-ERROR message.
    Currently this results in a null derefernce.  This case is unlikely to
    happen with the default kdc_max_dgram_reply_size value of 65536, but
    may be triggerable by an unauthenticated attacker if the value is
    lowered.  Prevent a null dereference in this scenario by setting an
    initial guess at the realm before checking the lookaside cache.
    Reported by AWS Security.
    
    (cherry picked from commit 47d220edc71c8229e5fd7a36f3231273c8f06595)
    
    ticket: 9238
    version_fixed: 1.22.3

 src/kdc/dispatch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/kdc/dispatch.c b/src/kdc/dispatch.c
index 46b1c8b44..6f03e1724 100644
--- a/src/kdc/dispatch.c
+++ b/src/kdc/dispatch.c
@@ -109,6 +109,10 @@ dispatch(void *cb, const struct sockaddr *local_addr,
     state->is_tcp = is_tcp;
     state->kdc_err_context = kdc_err_context;
 
+    /* Start with a guess at the applicable realm, in case we need one to
+     * produce an error message without having decoded the request. */
+    state->active_realm = handle->kdc_realmlist[0];
+
     /* decode incoming packet, and dispatch */
 
 #ifndef NOCACHE