[autobackport: sssd-2-9] nss: guard against length underflow in packet

[sssd-bot]

This is an automatic backport of PR#9463 nss: guard against length underflow in packet to branch sssd-2-9, created by @justin-stephenson.

Please make sure this backport is correct.

Note

The commits were cherry-picked without conflicts.

You can push changes to this pull request

git remote add sssd-bot git@github.com:sssd-bot/sssd.git
git fetch sssd-bot refs/heads/SSSD-sssd-backport-pr9463-to-sssd-2-9
git checkout SSSD-sssd-backport-pr9463-to-sssd-2-9
git push sssd-bot SSSD-sssd-backport-pr9463-to-sssd-2-9 --force

---

Original commits
df91161 - nss: guard against length underflow in packet

Backported commits

• 91d88bc - nss: guard against length underflow in packet

---

Original Pull Request Body

:fixes: CVE-2026-104043

[sssd-bot]

The pull request was accepted by @thalman with the following PR CI status:

---

🟢 rpm-build:centos-stream-9-x86_64:upstream (success)
🟢 testing-farm:centos-stream-9-x86_64:upstream (success)
🟢 Build / make-distcheck (success)
🟢 ci / prepare (success)
🟢 ci / system (centos-9) (success)
🟢 Static code analysis / files-changed (success)
🟢 Static code analysis / pre-commit (success)
➖ Static code analysis / python-system-tests (skipped)

---

There are unsuccessful or unfinished checks. Make sure that the failures are not related to this pull request before merging.