Thu Jun 9 05:11:17 2011 UTC ()
_gr_copy() can get called with fromgrp->gr_mem == NULL.


(sjg)
diff -r1.62 -r1.63 src/lib/libc/gen/getgrent.c
cvs diff -r1.62 -r1.63 src/lib/libc/gen/getgrent.c (expand / switch to unified diff)

--- src/lib/libc/gen/getgrent.c 2008/04/28 20:22:59 1.62
+++ src/lib/libc/gen/getgrent.c 2011/06/09 05:11:17 1.63
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: getgrent.c,v 1.62 2008/04/28 20:22:59 martin Exp $ */ 1/* $NetBSD: getgrent.c,v 1.63 2011/06/09 05:11:17 sjg Exp $ */
2 2
3/*- 3/*-
4 * Copyright (c) 1999-2000, 2004-2005 The NetBSD Foundation, Inc. 4 * Copyright (c) 1999-2000, 2004-2005 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Luke Mewburn. 8 * by Luke Mewburn.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -78,27 +78,27 @@ @@ -78,27 +78,27 @@
78 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR 78 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
79 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 79 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
80 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 80 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
81 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 81 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
82 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 82 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
83 * SUCH DAMAGE. 83 * SUCH DAMAGE.
84 */ 84 */
85 85
86#include <sys/cdefs.h> 86#include <sys/cdefs.h>
87#if defined(LIBC_SCCS) && !defined(lint) 87#if defined(LIBC_SCCS) && !defined(lint)
88#if 0 88#if 0
89static char sccsid[] = "@(#)getgrent.c 8.2 (Berkeley) 3/21/94"; 89static char sccsid[] = "@(#)getgrent.c 8.2 (Berkeley) 3/21/94";
90#else 90#else
91__RCSID("$NetBSD: getgrent.c,v 1.62 2008/04/28 20:22:59 martin Exp $"); 91__RCSID("$NetBSD: getgrent.c,v 1.63 2011/06/09 05:11:17 sjg Exp $");
92#endif 92#endif
93#endif /* LIBC_SCCS and not lint */ 93#endif /* LIBC_SCCS and not lint */
94 94
95#include "namespace.h" 95#include "namespace.h"
96#include "reentrant.h" 96#include "reentrant.h"
97 97
98#include <sys/param.h> 98#include <sys/param.h>
99 99
100#include <assert.h> 100#include <assert.h>
101#include <errno.h> 101#include <errno.h>
102#include <grp.h> 102#include <grp.h>
103#include <limits.h> 103#include <limits.h>
104#include <nsswitch.h> 104#include <nsswitch.h>
@@ -260,26 +260,29 @@ _gr_copy(struct group *fromgrp, struct g @@ -260,26 +260,29 @@ _gr_copy(struct group *fromgrp, struct g
260 do { \ 260 do { \
261 size_t count = strlen((from)); \ 261 size_t count = strlen((from)); \
262 (to) = _gr_memfrombuf(count+1, &buf, &buflen); \ 262 (to) = _gr_memfrombuf(count+1, &buf, &buflen); \
263 if ((to) == NULL) \ 263 if ((to) == NULL) \
264 return 0; \ 264 return 0; \
265 memmove((to), (from), count); \ 265 memmove((to), (from), count); \
266 to[count] = '\0'; \ 266 to[count] = '\0'; \
267 } while (0) /* LINTED */ 267 } while (0) /* LINTED */
268 268
269 COPYSTR(grp->gr_name, fromgrp->gr_name); 269 COPYSTR(grp->gr_name, fromgrp->gr_name);
270 COPYSTR(grp->gr_passwd, fromgrp->gr_passwd); 270 COPYSTR(grp->gr_passwd, fromgrp->gr_passwd);
271 grp->gr_gid = fromgrp->gr_gid; 271 grp->gr_gid = fromgrp->gr_gid;
272 272
 273 if (fromgrp->gr_mem == NULL)
 274 return 0;
 275
273 for (memc = 0; fromgrp->gr_mem[memc]; memc++) 276 for (memc = 0; fromgrp->gr_mem[memc]; memc++)
274 continue; 277 continue;
275 memc++; /* for final NULL */ 278 memc++; /* for final NULL */
276 279
277 /* grab ALIGNed char **gr_mem from buf */ 280 /* grab ALIGNed char **gr_mem from buf */
278 ep = _gr_memfrombuf(memc * sizeof(char *) + ALIGNBYTES, &buf, &buflen); 281 ep = _gr_memfrombuf(memc * sizeof(char *) + ALIGNBYTES, &buf, &buflen);
279 grp->gr_mem = (char **)ALIGN(ep); 282 grp->gr_mem = (char **)ALIGN(ep);
280 if (grp->gr_mem == NULL) 283 if (grp->gr_mem == NULL)
281 return 0; 284 return 0;
282 285
283 for (memc = 0; fromgrp->gr_mem[memc]; memc++) { 286 for (memc = 0; fromgrp->gr_mem[memc]; memc++) {
284 COPYSTR(grp->gr_mem[memc], fromgrp->gr_mem[memc]); 287 COPYSTR(grp->gr_mem[memc], fromgrp->gr_mem[memc]);
285 } 288 }