* nis/nis_defaults.c (searchXYX): New functions. Used by both

	searchgroup and searchowner.  Significantly simplified.
	(__nis_default_owner): Remove duplication.  Do not locally copy the
	string before duplicating it.
	(__nis_default_group): Likewise.

	* nis/nis_lookup.c (nis_lookup): After calling nis_free_directory,
	we must clear the variable before calling __nisfind_server.

	* nis/nis_lookup.c (nis_lookup): Always free memory allocated with
	nis_getnames.  [Coverity CID 223]

	* locale/programs/locfile.c (locfile_read): Use alloca instead of
	xmalloc to allocate local repertoire name.  [Coverity CID 222]

	* iconv/iconv_charmap.c (use_to_charmap): No need to dynamically
	allocate memory for the input to add_bytes.  [Coverity CID 221]

	was allocated here.  [Coverity CID 219, 220]

5 files changed, 113 insertions, 102 deletions

diff --git a/ChangeLog b/ChangeLog
index 154caca49d..a04f97b483 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,7 +1,25 @@
 2006-05-09  Ulrich Drepper  <drepper@redhat.com>
 
+	* nis/nis_defaults.c (searchXYX): New functions.  Used by both
+	searchgroup and searchowner.  Significantly simplified.
+	(__nis_default_owner): Remove duplication.  Do not locally copy the
+	string before duplicating it.
+	(__nis_default_group): Likewise.
+
+	* nis/nis_lookup.c (nis_lookup): After calling nis_free_directory,
+	we must clear the variable before calling __nisfind_server.
+
+	* nis/nis_lookup.c (nis_lookup): Always free memory allocated with
+	nis_getnames.  [Coverity CID 223]
+
+	* locale/programs/locfile.c (locfile_read): Use alloca instead of
+	xmalloc to allocate local repertoire name.  [Coverity CID 222]
+
+	* iconv/iconv_charmap.c (use_to_charmap): No need to dynamically
+	allocate memory for the input to add_bytes.  [Coverity CID 221]
+
 	* posix/wordexp.c (w_addword): Free word if realloc fails and it
-	was allocated here.  [Coverity CID 219]
+	was allocated here.  [Coverity CID 219, 220]
 
 	* posix/getconf.c (print_all): Free confstr data after printing.
 	[Coverity CID 218]
diff --git a/iconv/iconv_charmap.c b/iconv/iconv_charmap.c
index 328121edbe..a54d738120 100644
--- a/iconv/iconv_charmap.c
+++ b/iconv/iconv_charmap.c
@@ -365,19 +365,27 @@ use_to_charmap (const char *from_code, struct charmap_t *to_charmap)
 	  if (outptr != (char *) outbuf)
 	    {
 	      /* We got some output.  Good, use it.  */
-	      struct charseq *newp;
+	      union
+	      {
+		struct charseq seq;
+		struct
+		{
+		  const char *name;
+		  uint32_t ucs4;
+		  int nbytes;
+		  unsigned char bytes[outlen];
+		} mem;
+	      } new;
 
 	      outlen = sizeof (outbuf) - outlen;
 	      assert ((char *) outbuf + outlen == outptr);
 
-	      newp = (struct charseq *) xmalloc (sizeof (struct charseq)
-						 + outlen);
-	      newp->name = out->name;
-	      newp->ucs4 = out->ucs4;
-	      newp->nbytes = outlen;
-	      memcpy (newp->bytes, outbuf, outlen);
+	      new.mem.name = out->name;
+	      new.mem.ucs4 = out->ucs4;
+	      new.mem.nbytes = outlen;
+	      memcpy (new.mem.bytes, outbuf, outlen);
 
-	      add_bytes (rettbl, newp, out);
+	      add_bytes (rettbl, &new.seq, out);
 	    }
 
 	  /* Clear any possible state left behind.  */
diff --git a/locale/programs/locfile.c b/locale/programs/locfile.c
index bc12fbb332..ae8ce73ce4 100644
--- a/locale/programs/locfile.c
+++ b/locale/programs/locfile.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-2004, 2005 Free Software Foundation, Inc.
+/* Copyright (C) 1996-2004, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@gnu.org>, 1996.
 
@@ -155,10 +155,11 @@ argument to `%s' must be a single character"),
 
 	  if (repertoire_name == NULL)
 	    {
-	      repertoire_name = memcpy (xmalloc (arg->val.str.lenmb + 1),
-					arg->val.str.startmb,
-					arg->val.str.lenmb);
-	      ((char *) repertoire_name)[arg->val.str.lenmb] = '\0';
+	      char *newp = alloca (arg->val.str.lenmb + 1);
+
+	      *((char *) mempcpy (newp, arg->val.str.startmb,
+				  arg->val.str.lenmb)) = '\0';
+	      repertoire_name = newp;
 	    }
 	  break;
 
diff --git a/nis/nis_defaults.c b/nis/nis_defaults.c
index f13578635a..59fbbe4b26 100644
--- a/nis/nis_defaults.c
+++ b/nis/nis_defaults.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 2004 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -17,6 +17,7 @@
    Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
    02111-1307 USA.  */
 
+#include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -30,45 +31,36 @@
 ** Some functions for parsing the -D param and NIS_DEFAULTS Environ
 */
 static nis_name
-searchgroup (char *str)
+searchXYX (char *str, const char *what)
 {
-  char *cptr;
-  int i;
+  assert (strlen (what) == 6);
+  assert (strncmp (str, what, 6) == 0);
+  str += 6;			/* Points to the begin of the parameters.  */
+
+  int i = 0;
+  while (str[i] != '\0' && str[i] != ':')
+    ++i;
+  if (i == 0)			/* only "<WHAT>=" ? */
+    return strdup ("");
 
-  cptr = strstr (str, "group=");
-  if (cptr == NULL)
-    return NULL;
+  return strndup (str, i);
+}
 
-  cptr += 6;			/* points to the begin of the group string */
-  i = 0;
-  while (cptr[i] != '\0' && cptr[i] != ':')
-    i++;
-  if (i == 0)			/* only "group=" ? */
-    return (nis_name) "";
 
-  return strndup (cptr, i);
+static nis_name
+searchgroup (char *str)
+{
+  return searchXYX (str, "group=");
 }
 
+
 static nis_name
 searchowner (char *str)
 {
-  char *cptr;
-  int i;
-
-  cptr = strstr (str, "owner=");
-  if (cptr == NULL)
-    return NULL;
-
-  cptr += 6;			/* points to the begin of the owner string */
-  i = 0;
-  while (cptr[i] != '\0' && cptr[i] != ':')
-    i++;
-  if (i == 0)			/* only "owner=" ? */
-    return strdup ("");
-
-  return strndup (cptr, i);
+  return searchXYX (str, "owner=");
 }
 
+
 static uint32_t
 searchttl (char *str)
 {
@@ -358,86 +350,61 @@ searchaccess (char *str, unsigned int access)
   return result;
 }
 
+
 nis_name
 __nis_default_owner (char *defaults)
 {
-  char default_owner[NIS_MAXNAMELEN + 1];
-  char *cptr, *dptr;
+  char *default_owner = NULL;
 
-  strcpy (default_owner, nis_local_principal ());
+  char *cptr = defaults;
+  if (cptr == NULL)
+    cptr = getenv ("NIS_DEFAULTS");
 
-  if (defaults != NULL)
+  if (cptr != NULL)
     {
-      dptr = strstr (defaults, "owner=");
+      char *dptr = strstr (cptr, "owner=");
       if (dptr != NULL)
 	{
-	  char *p = searchowner (defaults);
-	  if (strlen (p) <= NIS_MAXNAMELEN)
-	    strcpy (default_owner, p);
+	  char *p = searchowner (dptr);
+	  if (p == NULL)
+	    return NULL;
+	  default_owner = strdupa (p);
 	  free (p);
 	}
     }
-  else
-    {
-      cptr = getenv ("NIS_DEFAULTS");
-      if (cptr != NULL)
-	{
-	  dptr = strstr (cptr, "owner=");
-	  if (dptr != NULL)
-	    {
-	      char *p = searchowner (cptr);
-	      if (strlen (p) <= NIS_MAXNAMELEN)
-		strcpy (default_owner, p);
-	      free (p);
-	    }
-	}
-    }
 
-  return strdup (default_owner);
+  return strdup (default_owner ?: nis_local_principal ());
 }
 libnsl_hidden_def (__nis_default_owner)
 
+
 nis_name
 __nis_default_group (char *defaults)
 {
-  char default_group[NIS_MAXNAMELEN + 1];
-  char *cptr, *dptr;
+  char *default_group = NULL;
 
-  strcpy (default_group, nis_local_group ());
+  char *cptr = defaults;
+  if (cptr == NULL)
+    cptr = getenv ("NIS_DEFAULTS");
 
-  if (defaults != NULL)
+  if (cptr != NULL)
     {
-      dptr = strstr (defaults, "group=");
+      char *dptr = strstr (cptr, "group=");
       if (dptr != NULL)
 	{
-	  char *p = searchgroup (defaults);
-
-	  if (strlen (p) <= NIS_MAXNAMELEN)
-	    strcpy (default_group, p);
+	  char *p = searchgroup (dptr);
+	  if (p == NULL)
+	    return NULL;
+	  default_group = strdupa (p);
 	  free (p);
 	}
     }
-  else
-    {
-      cptr = getenv ("NIS_DEFAULTS");
-      if (cptr != NULL)
-	{
-	  dptr = strstr (cptr, "group=");
-	  if (dptr != NULL)
-	    {
-	      char *p = searchgroup (cptr);
-
-	      if (strlen (p) <= NIS_MAXNAMELEN)
-		strcpy (default_group, p);
-	      free (p);
-	    }
-	}
-    }
 
-  return strdup (default_group);
+  return strdup (default_group ?: nis_local_group ());
 }
 libnsl_hidden_def (__nis_default_group)
 
+
 uint32_t
 __nis_default_ttl (char *defaults)
 {
diff --git a/nis/nis_lookup.c b/nis/nis_lookup.c
index 4cb34dd1a8..821b9bce73 100644
--- a/nis/nis_lookup.c
+++ b/nis/nis_lookup.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1997, 1998, 1999, 2004, 2005 Free Software Foundation, Inc.
+/* Copyright (C) 1997-1999, 2004, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1997.
 
@@ -65,7 +65,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
       if (status != NIS_SUCCESS)
 	{
 	  NIS_RES_STATUS (res) = status;
-	  return res;
+	  goto out;
 	}
 
       status = __nisbind_create (&bptr, dir->do_servers.do_servers_val,
@@ -74,7 +74,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 	{
 	  NIS_RES_STATUS (res) = status;
 	  nis_free_directory (dir);
-	  return res;
+	  goto out;;
 	}
 
       while (__nisbind_connect (&bptr) != NIS_SUCCESS)
@@ -83,7 +83,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 	    {
 	      nis_free_directory (dir);
 	      NIS_RES_STATUS (res) = NIS_NAMEUNREACHABLE;
-	      return res;
+	      goto out;
 	    }
 	}
 
@@ -121,8 +121,21 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 			req.ns_name =
 			  strdup (NIS_RES_OBJECT (res)->LI_data.li_name);
 			if (req.ns_name == NULL)
-			  return NULL;
+			  {
+			    nis_free_directory (dir);
+			    res = NULL;
+			    goto out;
+			  }
 
+			/* The following is a non-obvious optimization.  A
+			   nis_freeresult call would call xdr_free as the
+			   following code.  But it also would unnecessarily
+			   free the result structure.  We avoid this here
+			   along with the necessary tests.  */
+#if 1
+			xdr_free ((xdrproc_t) _xdr_nis_result, (char *) res);
+			memset (res, '\0', sizeof (*res));
+#else
 			nis_freeresult (res);
 			res = calloc (1, sizeof (nis_result));
 			if (res == NULL)
@@ -130,6 +143,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 			    __nisbind_destroy (&bptr);
 			    return NULL;
 			  }
+#endif
 
 			link_first_try = 1; /* Try at first the old binding */
 			goto again;
@@ -144,10 +158,12 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 		      {
 			__nisbind_destroy (&bptr);
 			nis_free_directory (dir);
+			/* Otherwise __nisfind_server will not do anything.  */
+			dir = NULL;
 
 			if (__nisfind_server (req.ns_name, &dir)
 			    != NIS_SUCCESS)
-			  return res;
+			  goto out;
 
 			if (__nisbind_create (&bptr,
 					      dir->do_servers.do_servers_val,
@@ -155,7 +171,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 					      flags) != NIS_SUCCESS)
 			  {
 			    nis_free_directory (dir);
-			    return res;
+			    goto out;
 			  }
 		      }
 		    else
@@ -167,7 +183,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 			if (__nisbind_next (&bptr) != NIS_SUCCESS)
 			  {
 			    nis_free_directory (dir);
-			    return res;
+			    goto out;
 			  }
 		      }
 		    goto again;
@@ -184,7 +200,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
       if (status != NIS_SUCCESS)
 	{
 	  NIS_RES_STATUS (res) = status;
-	  return res;
+	  goto out;
 	}
 
       switch (NIS_RES_STATUS (res))
@@ -216,6 +232,7 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 	}
     }
 
+ out:
   if (names != namebuf)
     nis_freenames (names);