Small yet significant tweaks/cleanups:

- getpwent:
  o adjunctbuf should be NUL terminated after copying
  o _pw_breakout_yp() needs to know the length of the buffer returned
    from YP so it can properly NUL terminate its local buffer.

- getgrent:
  o YP buffers should be YPMAXRECORD + 2 bytes long and NUL terminated.
    (Previously they were hardcoded to 1024 bytes.)

- getnetgrent:
  o YP data should be copied with snprintf(), not sprintf()

These are 2.2 candidates. I will wait a few days to make sure these don't
break anything and then, if there are no objections, move them to the 2.2
branch.

1 files changed, 5 insertions, 3 deletions

diff --git a/lib/libc/gen/getgrent.c b/lib/libc/gen/getgrent.c
index e2cefb9..47d229e 100644
--- a/lib/libc/gen/getgrent.c
+++ b/lib/libc/gen/getgrent.c
@@ -473,7 +473,7 @@ static int
 _getypgroup(struct group *gr, const char *name, char *map)
 {
 	char *result, *s;
-	static char resultbuf[1024];
+	static char resultbuf[YPMAXRECORD + 2];
 	int resultlen;
 
 	if(!_gr_yp_domain) {
@@ -490,6 +490,7 @@ _getypgroup(struct group *gr, const char *name, char *map)
 
 	if(resultlen >= sizeof resultbuf) return 0;
 	strncpy(resultbuf, result, resultlen);
+	resultbuf[resultlen] = '\0';
 	free(result);
 	return(_gr_breakout_yp(gr, resultbuf));
 
@@ -502,7 +503,7 @@ _nextypgroup(struct group *gr)
 	static char *key;
 	static int keylen;
 	char *lastkey, *result;
-	static char resultbuf[1024];
+	static char resultbuf[YPMAXRECORD + 2];
 	int resultlen;
 	int rv;
 
@@ -537,7 +538,8 @@ unpack:
 			goto tryagain;
 		}
 
-		strcpy(resultbuf, result);
+		strncpy(resultbuf, result, resultlen);
+		resultbuf[resultlen] = '\0';
 		free(result);
 		if((result = strchr(resultbuf, '\n')) != NULL)
 			*result = '\0';