Small yet significant tweaks/cleanups:

- getpwent:
  o adjunctbuf should be NUL terminated after copying
  o _pw_breakout_yp() needs to know the length of the buffer returned
    from YP so it can properly NUL terminate its local buffer.

- getgrent:
  o YP buffers should be YPMAXRECORD + 2 bytes long and NUL terminated.
    (Previously they were hardcoded to 1024 bytes.)

- getnetgrent:
  o YP data should be copied with snprintf(), not sprintf()

These are 2.2 candidates. I will wait a few days to make sure these don't
break anything and then, if there are no objections, move them to the 2.2
branch.

1 files changed, 7 insertions, 5 deletions

diff --git a/lib/libc/gen/getpwent.c b/lib/libc/gen/getpwent.c
index 20f1d2c..4ec5bfc 100644
--- a/lib/libc/gen/getpwent.c
+++ b/lib/libc/gen/getpwent.c
@@ -568,7 +568,8 @@ static char * _get_adjunct_pw(name)
 		    &result, &resultlen)))
 		return(NULL);
 
-	strncpy((char *)&adjunctbuf, result, YPMAXRECORD);
+	strncpy(adjunctbuf, result, resultlen);
+	adjunctbuf[resultlen] = '\0';
 	free(result);
 	result = (char *)&adjunctbuf;
 
@@ -582,7 +583,7 @@ static char * _get_adjunct_pw(name)
 }
 
 static int
-_pw_breakout_yp(struct passwd *pw, char *res, int master)
+_pw_breakout_yp(struct passwd *pw, char *res, int resultlen, int master)
 {
 	char *s, *result;
 	static char resbuf[YPMAXRECORD+2];
@@ -602,7 +603,8 @@ _pw_breakout_yp(struct passwd *pw, char *res, int master)
 	 * a static buffer here since the memory pointed to by
 	 * res will be free()ed when this function returns.
 	 */
-	strncpy((char *)&resbuf, res, YPMAXRECORD);
+	strncpy((char *)&resbuf, res, resultlen);
+	resbuf[resultlen] = '\0';
 	result = (char *)&resbuf;
 
 	/*
@@ -756,7 +758,7 @@ _getyppass(struct passwd *pw, const char *name, const char *map)
 		*s = ':'; /* Put back the colon we previously replaced with a NUL. */
 	}
 
-	rv = _pw_breakout_yp(pw, result, _gotmaster);
+	rv = _pw_breakout_yp(pw, result, resultlen, _gotmaster);
 	free(result);
 	return(rv);
 }
@@ -816,7 +818,7 @@ unpack:
 		}
 
 		*s = ':'; /* Put back the colon we previously replaced with a NUL. */
-		if (_pw_breakout_yp(pw, result, _gotmaster)) {
+		if (_pw_breakout_yp(pw, result, resultlen, _gotmaster)) {
 			free(result);
 			return(1);
 		} else {