CVE-2013-1417: Input Validation

From the upstream commit [1]:

An authenticated remote client can cause a KDC to crash by making a valid TGS-REQ to a KDC serving a realm with a single-component name. The processtgsreq() function dereferences a null pointer because an unusual failure condition causes a helper function to return success.

While attempting to provide cross-realm referrals for host-based service principals, the findreferraltgs() function could return a TGS principal for a zero-length realm name (indicating that the hostname in the service principal has no known realm associated with it).

Subsequently, the findalternatetgs() function would attempt to construct a path to this empty-string realm, and return success along with a null pointer in its output parameter. This happens because krb5walkrealmtree() returns a list of length one when it attempts to construct a transit path between a single-component realm and the empty-string realm. This list causes a loop in findalternatetgs() to iterate over zero elements, resulting in the unexpected output of a null pointer, which processtgsreq() proceeds to dereference because there is no error condition.

Add an error condition to findreferraltgs() when krb5gethostrealm() returns an empty realm name. Also add an error condition to findalternatetgs() to handle the length-one output from krb5walkrealmtree().

The vulnerable configuration is not likely to arise in practice. (Realm names that have a single component are likely to be test realms.) Releases prior to krb5-1.11 are not vulnerable.

[1] https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc