REDHAT-BUG-2453813: Medium severity corosync corosync vulnerability

Wrong return value vulnerability in the Corosync membership commit token sanity check in exec/totemsrp.c. The flaw occurs in checkmembcommittokensanity() where truncated messages (msglen < sizeof(struct membcommittoken)) incorrectly return 0 (success) instead of -1 (failure). As a result, messagehandlermembcommittoken() continues processing attacker-controlled, undersized input, performs an allocation based on the short length, and then accesses struct membcommittoken fields beyond the allocated region, triggering an out-of-bounds read (ASAN-confirmed). This can be exploited remotely without authentication in totemudp/totemudpu mode by sending a single crafted UDP packet to the Corosync port (default 5405), causing a denial of service and potentially leaking limited memory contents.