about summary refs log tree commit diff
path: root/nis/nss_compat/compat-initgroups.c
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2004-09-12 20:38:38 +0000
committerUlrich Drepper <drepper@redhat.com>2004-09-12 20:38:38 +0000
commit20f8e6663accb3d318630e8ec4a08ed37521fce6 (patch)
treea780fced9cb6d492f91e89edbefa791a383e8572 /nis/nss_compat/compat-initgroups.c
parentccc63b07082c257ffc6fe0b0bbf770283bb44e98 (diff)
downloadglibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.tar.gz
glibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.tar.xz
glibc-20f8e6663accb3d318630e8ec4a08ed37521fce6.zip
Update.
2004-09-11  Thorsten Kukuk  <kukuk@suse.de>

	* nis/nss_compat/compat-grp.c: Check that buflen is greater zero
	before writing data into the buffer with negative offset.
	* nis/nss_compat/compat-initgroups.c: Likewise.
	* nis/nss_compat/compat-pwd.c: Likewise.
	* nis/nss_compat/compat-spwd.c Likewise.
Diffstat (limited to 'nis/nss_compat/compat-initgroups.c')
-rw-r--r--nis/nss_compat/compat-initgroups.c24
1 files changed, 14 insertions, 10 deletions
diff --git a/nis/nss_compat/compat-initgroups.c b/nis/nss_compat/compat-initgroups.c
index 100febc672..9574ea7c0b 100644
--- a/nis/nss_compat/compat-initgroups.c
+++ b/nis/nss_compat/compat-initgroups.c
@@ -327,17 +327,25 @@ internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user,
 
       do
 	{
+	  /* We need at least 3 characters for one line.  */
+	  if (__builtin_expect (buflen < 3, 0))
+	    {
+	    erange:
+	      *errnop = ERANGE;
+	      return NSS_STATUS_TRYAGAIN;
+	    }
+
 	  fgetpos (ent->stream, &pos);
 	  buffer[buflen - 1] = '\xff';
 	  p = fgets_unlocked (buffer, buflen, ent->stream);
 	  if (p == NULL && feof_unlocked (ent->stream))
 	    return NSS_STATUS_NOTFOUND;
 
-	  if (p == NULL || buffer[buflen - 1] != '\xff')
+	  if (p == NULL || __builtin_expect (buffer[buflen - 1] != '\xff', 0))
 	    {
+	    erange_reset:
 	      fsetpos (ent->stream, &pos);
-	      *errnop = ERANGE;
-	      return NSS_STATUS_TRYAGAIN;
+	      goto erange;
 	    }
 
 	  /* Terminate the line for any case.  */
@@ -353,13 +361,9 @@ internal_getgrent_r (ent_t *ent, char *buffer, size_t buflen, const char *user,
 	     !(parse_res = _nss_files_parse_grent (p, &grpbuf, data, buflen,
 						   errnop)));
 
-      if (parse_res == -1)
-	{
-	  /* The parser ran out of space.  */
-	  fsetpos (ent->stream, &pos);
-	  *errnop = ERANGE;
-	  return NSS_STATUS_TRYAGAIN;
-	}
+      if (__builtin_expect (parse_res == -1, 0))
+	/* The parser ran out of space.  */
+	goto erange_reset;
 
       if (grpbuf.gr_name[0] != '+' && grpbuf.gr_name[0] != '-')
 	/* This is a real entry.  */