diff options
author | ghelmer <ghelmer@FreeBSD.org> | 2012-05-21 21:10:00 +0000 |
---|---|---|
committer | ghelmer <ghelmer@FreeBSD.org> | 2012-05-21 21:10:00 +0000 |
commit | 707a97650988798151dc4cbaae0d3576fb7a4879 (patch) | |
tree | 130a4da099d50dd08c26baa95035f51a4e677439 /lib | |
parent | 34a5029ece102bff8ead64df3a673aa566b9c6fe (diff) | |
download | FreeBSD-src-707a97650988798151dc4cbaae0d3576fb7a4879.zip FreeBSD-src-707a97650988798151dc4cbaae0d3576fb7a4879.tar.gz |
Add checks for memory allocation failures in appropriate places, and
avoid creating bad entries in the grp list as a result of memory allocation
failures while building new entries.
PR: bin/83340
Reviewed by: delphij (prior version of patch)
Diffstat (limited to 'lib')
-rw-r--r-- | lib/libc/gen/getnetgrent.c | 39 |
1 files changed, 27 insertions, 12 deletions
diff --git a/lib/libc/gen/getnetgrent.c b/lib/libc/gen/getnetgrent.c index ea8ccae..1ad0957 100644 --- a/lib/libc/gen/getnetgrent.c +++ b/lib/libc/gen/getnetgrent.c @@ -203,9 +203,7 @@ setnetgrent(const char *group) if (parse_netgrp(group)) endnetgrent(); else { - grouphead.grname = (char *) - malloc(strlen(group) + 1); - strcpy(grouphead.grname, group); + grouphead.grname = strdup(group); } if (netf) fclose(netf); @@ -457,9 +455,9 @@ parse_netgrp(const char *group) while (pos != NULL && *pos != '\0') { if (*pos == '(') { grp = (struct netgrp *)malloc(sizeof (struct netgrp)); + if (grp == NULL) + return (1); bzero((char *)grp, sizeof (struct netgrp)); - grp->ng_next = grouphead.gr; - grouphead.gr = grp; pos++; gpos = strsep(&pos, ")"); #ifdef DEBUG @@ -480,6 +478,13 @@ parse_netgrp(const char *group) if (len > 0) { grp->ng_str[strpos] = (char *) malloc(len + 1); + if (grp->ng_str[strpos] == NULL) { + int freepos; + for (freepos = 0; freepos < strpos; freepos++) + free(grp->ng_str[freepos]); + free(grp); + return (1); + } bcopy(spos, grp->ng_str[strpos], len + 1); } @@ -493,6 +498,8 @@ parse_netgrp(const char *group) grp->ng_str[strpos] = NULL; } } + grp->ng_next = grouphead.gr; + grouphead.gr = grp; #ifdef DEBUG /* * Note: on other platforms, malformed netgroup @@ -529,7 +536,7 @@ parse_netgrp(const char *group) static struct linelist * read_for_group(const char *group) { - char *pos, *spos, *linep, *olinep; + char *pos, *spos, *linep; int len, olen; int cont; struct linelist *lp; @@ -537,6 +544,7 @@ read_for_group(const char *group) #ifdef YP char *result; int resultlen; + linep = NULL; while (_netgr_yp_enabled || fgets(line, LINSIZ, netf) != NULL) { if (_netgr_yp_enabled) { @@ -557,6 +565,7 @@ read_for_group(const char *group) free(result); } #else + linep = NULL; while (fgets(line, LINSIZ, netf) != NULL) { #endif pos = (char *)&line; @@ -579,8 +588,14 @@ read_for_group(const char *group) pos++; if (*pos != '\n' && *pos != '\0') { lp = (struct linelist *)malloc(sizeof (*lp)); + if (lp == NULL) + return (NULL); lp->l_parsed = 0; lp->l_groupname = (char *)malloc(len + 1); + if (lp->l_groupname == NULL) { + free(lp); + return (NULL); + } bcopy(spos, lp->l_groupname, len); *(lp->l_groupname + len) = '\0'; len = strlen(pos); @@ -598,15 +613,15 @@ read_for_group(const char *group) } else cont = 0; if (len > 0) { - linep = (char *)malloc(olen + len + 1); - if (olen > 0) { - bcopy(olinep, linep, olen); - free(olinep); + linep = (char *)reallocf(linep, olen + len + 1); + if (linep == NULL) { + free(lp->l_groupname); + free(lp); + return (NULL); } bcopy(pos, linep + olen, len); olen += len; *(linep + olen) = '\0'; - olinep = linep; } if (cont) { if (fgets(line, LINSIZ, netf)) { @@ -637,5 +652,5 @@ read_for_group(const char *group) */ rewind(netf); #endif - return ((struct linelist *)0); + return (NULL); } |