[31678] in CVS-changelog-for-Kerberos-V5
krb5 commit [krb5-1.22]: Check TXT lookup results on Windows
daemon@ATHENA.MIT.EDU (ghudson@mit.edu)
Mon Nov 9 12:02:23 2026
From: ghudson@mit.edu
To: cvs-krb5@mit.edu
Message-Id: <20261109170220.08D8F105839@krbdev.mit.edu>
Date: Mon, 9 Nov 2026 12:02:20 -0500 (EST)
MIME-Version: 1.0
Reply-To: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: cvs-krb5-bounces@mit.edu
https://github.com/krb5/krb5/commit/30b952314aa335db4399227d521a4d2a44207a86
commit 30b952314aa335db4399227d521a4d2a44207a86
Author: Greg Hudson <ghudson@mit.edu>
Date: Sun Sep 20 03:48:12 2026 -0400
Check TXT lookup results on Windows
In the Windows implementation of k5_try_realm_txt_rr(), iterate
through the received records and pick one that is a non-empty TXT
record. Otherwise the function could dereference an invalid pointer
and crash (depending on the behavior of DnsQuery_UTF8(), which is not
fully known). Discovered by Aisle Research.
(cherry picked from commit adce9735b119b75387e64016280faa1320a71ec6)
ticket: 9242
version_fixed: 1.22.3
src/lib/krb5/os/dnsglue.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/src/lib/krb5/os/dnsglue.c b/src/lib/krb5/os/dnsglue.c
index 5da550c1e..6151f363e 100644
--- a/src/lib/krb5/os/dnsglue.c
+++ b/src/lib/krb5/os/dnsglue.c
@@ -409,7 +409,7 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
{
krb5_error_code ret = 0;
char *txtname = NULL;
- PDNS_RECORD rr = NULL;
+ PDNS_RECORD records = NULL, rr;
DNS_STATUS st;
*realm = NULL;
@@ -419,13 +419,21 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
return ENOMEM;
st = DnsQuery_UTF8(txtname, DNS_TYPE_TEXT, DNS_QUERY_STANDARD, NULL,
- &rr, NULL);
- if (st != ERROR_SUCCESS || rr == NULL) {
+ &records, NULL);
+ if (st != ERROR_SUCCESS || records == NULL) {
TRACE_TXT_LOOKUP_NOTFOUND(context, txtname);
ret = KRB5_ERR_HOST_REALM_UNKNOWN;
goto cleanup;
}
+ for (rr = records; rr != NULL; rr = rr->pNext) {
+ if (rr->wType == DNS_TYPE_TEXT && rr->Data.TXT.dwStringCount >= 1)
+ break;
+ }
+ if (rr == NULL) {
+ ret = KRB5_ERR_HOST_REALM_UNKNOWN;
+ goto cleanup;
+ }
*realm = strdup(rr->Data.TXT.pStringArray[0]);
if (*realm == NULL)
ret = ENOMEM;
@@ -433,8 +441,8 @@ k5_try_realm_txt_rr(krb5_context context, const char *prefix, const char *name,
cleanup:
free(txtname);
- if (rr != NULL)
- DnsRecordListFree(rr, DnsFreeRecordList);
+ if (records != NULL)
+ DnsRecordListFree(records, DnsFreeRecordList);
return ret;
}
_______________________________________________
cvs-krb5 mailing list
cvs-krb5@mit.edu
https://mailman.mit.edu/mailman/listinfo/cvs-krb5
