The following reply was made to PR bin/83340; it has been noted by GNATS. From: dfil...@freebsd.org (dfilter service) To: bug-follo...@freebsd.org Cc: Subject: Re: bin/83340: commit references a PR Date: Mon, 21 May 2012 21:10:55 +0000 (UTC)
Author: ghelmer Date: Mon May 21 21:10:00 2012 New Revision: 235740 URL: http://svn.freebsd.org/changeset/base/235740 Log: Add checks for memory allocation failures in appropriate places, and avoid creating bad entries in the grp list as a result of memory allocation failures while building new entries. PR: bin/83340 Reviewed by: delphij (prior version of patch) Modified: head/lib/libc/gen/getnetgrent.c Modified: head/lib/libc/gen/getnetgrent.c ============================================================================== --- head/lib/libc/gen/getnetgrent.c Mon May 21 21:04:29 2012 (r235739) +++ head/lib/libc/gen/getnetgrent.c Mon May 21 21:10:00 2012 (r235740) @@ -203,9 +203,7 @@ setnetgrent(const char *group) if (parse_netgrp(group)) endnetgrent(); else { - grouphead.grname = (char *) - malloc(strlen(group) + 1); - strcpy(grouphead.grname, group); + grouphead.grname = strdup(group); } if (netf) fclose(netf); @@ -457,9 +455,9 @@ parse_netgrp(const char *group) while (pos != NULL && *pos != '\0') { if (*pos == '(') { grp = (struct netgrp *)malloc(sizeof (struct netgrp)); + if (grp == NULL) + return (1); bzero((char *)grp, sizeof (struct netgrp)); - grp->ng_next = grouphead.gr; - grouphead.gr = grp; pos++; gpos = strsep(&pos, ")"); #ifdef DEBUG @@ -480,6 +478,13 @@ parse_netgrp(const char *group) if (len > 0) { grp->ng_str[strpos] = (char *) malloc(len + 1); + if (grp->ng_str[strpos] == NULL) { + int freepos; + for (freepos = 0; freepos < strpos; freepos++) + free(grp->ng_str[freepos]); + free(grp); + return (1); + } bcopy(spos, grp->ng_str[strpos], len + 1); } @@ -493,6 +498,8 @@ parse_netgrp(const char *group) grp->ng_str[strpos] = NULL; } } + grp->ng_next = grouphead.gr; + grouphead.gr = grp; #ifdef DEBUG /* * Note: on other platforms, malformed netgroup @@ -529,7 +536,7 @@ parse_netgrp(const char *group) static struct linelist * read_for_group(const char *group) { - char *pos, *spos, *linep, *olinep; + char *pos, *spos, *linep; int len, olen; int cont; struct linelist *lp; @@ -537,6 +544,7 @@ read_for_group(const char *group) #ifdef YP char *result; int resultlen; + linep = NULL; while (_netgr_yp_enabled || fgets(line, LINSIZ, netf) != NULL) { if (_netgr_yp_enabled) { @@ -557,6 +565,7 @@ read_for_group(const char *group) free(result); } #else + linep = NULL; while (fgets(line, LINSIZ, netf) != NULL) { #endif pos = (char *)&line; @@ -579,8 +588,14 @@ read_for_group(const char *group) pos++; if (*pos != '\n' && *pos != '\0') { lp = (struct linelist *)malloc(sizeof (*lp)); + if (lp == NULL) + return (NULL); lp->l_parsed = 0; lp->l_groupname = (char *)malloc(len + 1); + if (lp->l_groupname == NULL) { + free(lp); + return (NULL); + } bcopy(spos, lp->l_groupname, len); *(lp->l_groupname + len) = '\0'; len = strlen(pos); @@ -598,15 +613,15 @@ read_for_group(const char *group) } else cont = 0; if (len > 0) { - linep = (char *)malloc(olen + len + 1); - if (olen > 0) { - bcopy(olinep, linep, olen); - free(olinep); + linep = (char *)reallocf(linep, olen + len + 1); + if (linep == NULL) { + free(lp->l_groupname); + free(lp); + return (NULL); } bcopy(pos, linep + olen, len); olen += len; *(linep + olen) = '\0'; - olinep = linep; } if (cont) { if (fgets(line, LINSIZ, netf)) { @@ -637,5 +652,5 @@ read_for_group(const char *group) */ rewind(netf); #endif - return ((struct linelist *)0); + return (NULL); } _______________________________________________ svn-src-...@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org" _______________________________________________ freebsd-bugs@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-bugs To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"
