[31438] in CVS-changelog-for-Kerberos-V5
krb5 commit: Fix crash on empty TXT records
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Thu May 22 00:01:10 2025
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20250522040105.4958E102C88@krbdev.mit.edu>
Date: Thu, 22 May 2025 00:01:05 -0400 (EDT)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/6a7877183ef668d3b52df1f2926acc8be6f1c475
commit 6a7877183ef668d3b52df1f2926acc8be6f1c475
Author: David Zhou <david.zhou@dell.com>
Date: Fri May 24 02:40:06 2024 +0000
Fix crash on empty TXT records
In k5_try_realm_txt_rr(), error out if the first text string in a TXT
record is empty or if its length exceeds the record length.
This function is only used when dns_lookup_realm is set to true in
krb5.conf. An alternative implementation is used on Windows.
[ghudson@mit.edu: moved zero-length check and added upper bound check;
rewrote commit message]
ticket: 9174 (new)
src/lib/krb5/os/dnsglue.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e..fd403aa75 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -470,12 +470,10 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
}
ret = krb5int_dns_nextans(ds, &base, &rdlen);
- if (ret < 0 || base == NULL)
+ if (ret < 0 || rdlen < 2 || *base == 0 || *base > rdlen - 1)
goto errout;
p = base;
- if (!INCR_OK(base, rdlen, p, 1))
- goto errout;
len = *p++;
*realm = malloc((size_t)len + 1);
if (*realm == NULL) {
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
