Out-of-bounds read via empty ipset name

Out-of-bounds read in Keepalived through 2.3.1 allows local users to trigger an invalid memory read through an empty ipset name. The vrrp_ipsets_handler in keepalived/core/global_parser.c subtracts one from a zero-length second ipset name, wrapping size_t and indexing set_name one byte before its stack buffer. Reachability requires control of the local configuration and an explicitly empty second vrrp_ipsets argument; the public report demonstrates a sanitizer-detected read, not data disclosure or service interruption.