* libio/fmemopen.c (fmemopen): Free stream memory in case of

	invalid length [Coverity CID 106].

	* nss/nss_files/files-key.c (search): Close stream before
	successful return [Coverity CID 107].

	* io/fts.c (fts_open): Don't allocate parent if *argv==NULL
	[Coverity CID 108].

	* sunrpc/rpc_cout.c (inline_struct): Free sizestr after use
	[Coverity CID 110, 109].

	* sunrpc/rpc_scan.c (docppline): Free file string if it is not
	going to be used [Coverity CID 111].

	* sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 112].

	* nis/nis_clone_dir.c (nis_clone_directory): Free all memory in
	error case [Coverity CID 114].

	* nis/nis_clone_res.c (nis_clone_result): Free all memory in the
	error cases [Coverity CID 115].

	* sunrpc/rpc_parse.c (get_definition): Free defp if tok ==
	TOK_EOF [Coverity CID 116].

	* sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 117].

	* elf/cache.c (save_cache): Initialize pad to avoid writing
	uninitialized data to disk.

	* elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118].

	* intl/finddomain.c (_nl_find_domain): Avoid strdup of expand
	locale name, use strdupa.  Remove free call [Coverity CID 119].

	* sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and
	the resulting leak [Coverity CID 121].

	* sunrpc/rpc_main.c (mkfile_output): Free all allocated memory
	[Coverity CID 122].

	* sunrpc/rpc_main.c (h_output): Free guard after we are done
	[Coverity CID 123].

	* sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation
	fails [Coverity CID 126].

	* sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error
	cases [Coverity CID 127].

	* nis/nis_table.c (__create_ib_request): Free ibreq in case strdup
	fails [Coverity CID 128].

	* nis/nis_getservlist.c (nis_getservlist): Free all memory in case
	of an error [Coverity CID 130, 129].

	* nis/nis_print_group_entry.c (nis_print_group_entry): If
	nis_lookup call failed, return.  Free lookup result in error
	cases [Coverity CID 131].

	* nis/nis_removemember.c (nis_removemember): Free all memory in
	error cases [Coverity CID 132].

	* nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r):
	Always free lookup result [Coverity CID 134].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r):
	Always free lookup result [Coverity CID 135].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r):
	Always free lookup result [Coverity CID 136].

	* nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r):
	Before retrying, free old result [Coverity CID 137].

	* nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user):
	Free res in case UID is zero [Coverity CID 138].

	* nis/ypclnt.c (yp_update): Always free master string
	[Coverity CID 140].

	* nis/nis_creategroup.c (nis_creategroup): Free all memory in
	error cases [Coverity CID 143, 142, 141].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result
	if yp_match call succeeded [Coverity CID 155].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string
	allocated in yp_match at all times [Coverity CID 157, 156].

	* nscd/nscd.c (write_pid): Close stream also if writing failed
	[Coverity CID 165].

	* nis/nis_table.c (nis_add_entry): Move test for NULL parameter
	ahead of first use [Coverity CID 167].

	* nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test
	for NULL parameter ahead of first use [Coverity CID 168].

	* intl/finddomain.c (_nl_find_domain): We never return NULL if we
	found the locale [Coverity CID 169].

	* inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set
	herrno [Coverity CID 178].

	* nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned
	freed object [Coverity CID 182].

2 files changed, 29 insertions, 30 deletions

diff --git a/nis/nss_nis/nis-alias.c b/nis/nss_nis/nis-alias.c
index 3b0887be04..1da999be2f 100644
--- a/nis/nss_nis/nis-alias.c
+++ b/nis/nss_nis/nis-alias.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-2002, 2003 Free Software Foundation, Inc.
+/* Copyright (C) 1996-2002, 2003, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
 
@@ -206,32 +206,29 @@ enum nss_status
 _nss_nis_getaliasbyname_r (const char *name, struct aliasent *alias,
 			   char *buffer, size_t buflen, int *errnop)
 {
-  enum nss_status retval;
-  int parse_res;
-  char *domain;
-  char *result;
-  int len;
-  char *p;
-  size_t namlen = strlen (name);
-  char name2[namlen + 1];
-  size_t i;
-
   if (name == NULL)
     {
       *errnop = EINVAL;
       return NSS_STATUS_UNAVAIL;
     }
 
+  size_t namlen = strlen (name);
+  char name2[namlen + 1];
+
+  char *domain;
   if (yp_get_default_domain (&domain))
     return NSS_STATUS_UNAVAIL;
 
   /* Convert name to lowercase.  */
+  size_t i;
   for (i = 0; i < namlen; ++i)
     name2[i] = _tolower (name[i]);
   name2[i] = '\0';
 
-  retval = yperr2nss (yp_match (domain, "mail.aliases", name2, namlen,
-				&result, &len));
+  char *result;
+  int len;
+  enum nss_status retval = yperr2nss (yp_match (domain, "mail.aliases", name2,
+						namlen, &result, &len));
 
   if (retval != NSS_STATUS_SUCCESS)
     {
@@ -247,14 +244,15 @@ _nss_nis_getaliasbyname_r (const char *name, struct aliasent *alias,
       return NSS_STATUS_TRYAGAIN;
     }
 
-  p = strncpy (buffer, result, len);
+  char *p = strncpy (buffer, result, len);
   buffer[len] = '\0';
   while (isspace (*p))
     ++p;
   free (result);
 
   alias->alias_local = 0;
-  parse_res = _nss_nis_parse_aliasent (name, p, alias, buffer, buflen, errnop);
+  int parse_res = _nss_nis_parse_aliasent (name, p, alias, buffer, buflen,
+					   errnop);
   if (parse_res < 1)
     {
       if (parse_res == -1)
diff --git a/nis/nss_nis/nis-publickey.c b/nis/nss_nis/nis-publickey.c
index 5aa41b8c17..f82db192a6 100644
--- a/nis/nss_nis/nis-publickey.c
+++ b/nis/nss_nis/nis-publickey.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-1999,2001,2002,2005 Free Software Foundation, Inc.
+/* Copyright (C) 1996-1999,2001,2002,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1996.
 
@@ -73,6 +73,7 @@ _nss_nis_getpublickey (const char *netname, char *pkey, int *errnop)
 	*p = 0;
       strncpy (pkey, result, HEXKEYBYTES + 1);
       pkey[HEXKEYBYTES] = '\0';
+      free (result);
     }
   return NSS_STATUS_SUCCESS;
 }
@@ -115,20 +116,20 @@ _nss_nis_getsecretkey (const char *netname, char *skey, char *passwd,
   if (result != NULL)
     {
       char *p = strchr (result, ':');
-      if (p == NULL)
-	return NSS_STATUS_SUCCESS;
-
-      ++p;
-      strncpy (buf, p, 2 * (HEXKEYBYTES + 1));
-      buf[2 * HEXKEYBYTES + 1] = '\0';
-      if (!xdecrypt (buf, passwd))
-	return NSS_STATUS_SUCCESS;
-
-      if (memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) != 0)
-	return NSS_STATUS_SUCCESS;
-
-      buf[HEXKEYBYTES] = '\0';
-      strcpy (skey, buf);
+      if (p != NULL)
+	{
+	  ++p;
+	  strncpy (buf, p, 2 * (HEXKEYBYTES + 1));
+	  buf[2 * HEXKEYBYTES + 1] = '\0';
+	  if (xdecrypt (buf, passwd)
+	      && memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) == 0)
+	    {
+	      buf[HEXKEYBYTES] = '\0';
+	      strcpy (skey, buf);
+	    }
+	}
+
+      free (result);
     }
   return NSS_STATUS_SUCCESS;
 }