Updated to fedora-glibc-20041110T0839

6 files changed, 78 insertions, 34 deletions

diff --git a/nscd/nscd-client.h b/nscd/nscd-client.h
index 2e7f27b8d5..d49cb8136c 100644
--- a/nscd/nscd-client.h
+++ b/nscd/nscd-client.h
@@ -264,7 +264,7 @@ struct locked_map_ptr
   int lock;
   struct mapped_database *mapped;
 };
-#define libc_locked_map_ptr(name) static struct locked_map_ptr name
+#define libc_locked_map_ptr(class, name) class struct locked_map_ptr name
 
 
 /* Open socket connection to nscd server.  */
diff --git a/nscd/nscd_getai.c b/nscd/nscd_getai.c
index a683976d87..f0b2082baa 100644
--- a/nscd/nscd_getai.c
+++ b/nscd/nscd_getai.c
@@ -33,15 +33,8 @@
 extern int __nss_not_use_nscd_hosts;
 
 
-libc_locked_map_ptr (map_handle);
-/* Note that we only free the structure if necessary.  The memory
-   mapping is not removed since it is not visible to the malloc
-   handling.  */
-libc_freeres_fn (ai_map_free)
-{
-  if (map_handle.mapped != NO_MAPPING)
-    free (map_handle.mapped);
-}
+/* We use the mapping from nscd_gethst.  */
+libc_locked_map_ptr (extern, __hst_map_handle);
 
 
 int
@@ -53,7 +46,8 @@ __nscd_getai (const char *key, struct nscd_ai_result **result, int *h_errnop)
   /* If the mapping is available, try to search there instead of
      communicating with the nscd.  */
   struct mapped_database *mapped;
-  mapped = __nscd_get_map_ref (GETFDHST, "hosts", &map_handle, &gc_cycle);
+  mapped = __nscd_get_map_ref (GETFDHST, "hosts", &__hst_map_handle,
+			       &gc_cycle);
 
  retry:;
   const ai_response_header *ai_resp = NULL;
@@ -142,6 +136,12 @@ __nscd_getai (const char *key, struct nscd_ai_result **result, int *h_errnop)
 	  /* Copy the data in the block.  */
 	  memcpy (resultbuf + 1, respdata, datalen);
 
+	  /* Try to detect corrupt databases.  */
+	  if (resultbuf->canon != NULL
+	      && resultbuf->canon[ai_resp->canonlen - 1] != '\0')
+	    /* We cannot use the database.  */
+	    goto out_close;
+
 	  retval = 0;
 	  *result = resultbuf;
 	}
@@ -157,6 +157,7 @@ __nscd_getai (const char *key, struct nscd_ai_result **result, int *h_errnop)
       retval = 0;
     }
 
+ out_close:
   if (sock != -1)
     close_not_cancel_no_status (sock);
  out:
diff --git a/nscd/nscd_getgr_r.c b/nscd/nscd_getgr_r.c
index 1b94bf584f..282912db3e 100644
--- a/nscd/nscd_getgr_r.c
+++ b/nscd/nscd_getgr_r.c
@@ -67,14 +67,18 @@ __nscd_getgrgid_r (gid_t gid, struct group *resultbuf, char *buffer,
 }
 
 
-libc_locked_map_ptr (map_handle);
+libc_locked_map_ptr (,__gr_map_handle);
 /* Note that we only free the structure if necessary.  The memory
    mapping is not removed since it is not visible to the malloc
    handling.  */
 libc_freeres_fn (gr_map_free)
 {
-  if (map_handle.mapped != NO_MAPPING)
-    free (map_handle.mapped);
+  if (__gr_map_handle.mapped != NO_MAPPING)
+    {
+      void *p = __gr_map_handle.mapped;
+      __gr_map_handle.mapped = NO_MAPPING;
+      free (p);
+    }
 }
 
 
@@ -91,7 +95,8 @@ nscd_getgr_r (const char *key, size_t keylen, request_type type,
   /* If the mapping is available, try to search there instead of
      communicating with the nscd.  */
   struct mapped_database *mapped = __nscd_get_map_ref (GETFDGR, "group",
-						       &map_handle, &gc_cycle);
+						       &__gr_map_handle,
+						       &gc_cycle);
  retry:;
   const gr_response_header *gr_resp = NULL;
   const char *gr_name = NULL;
@@ -204,7 +209,8 @@ nscd_getgr_r (const char *key, size_t keylen, request_type type,
       else
 	/* We already have the data.  Just copy the group name and
 	   password.  */
-	memcpy (resultbuf->gr_name, gr_name, gr_name_len);
+	memcpy (resultbuf->gr_name, gr_name,
+		gr_resp->gr_name_len + gr_resp->gr_passwd_len);
 
       /* Clear the terminating entry.  */
       resultbuf->gr_mem[gr_resp->gr_mem_cnt] = NULL;
@@ -242,6 +248,19 @@ nscd_getgr_r (const char *key, size_t keylen, request_type type,
 	  /* Copy the group member names.  */
 	  memcpy (resultbuf->gr_mem[0], gr_name + gr_name_len, total_len);
 
+	  /* Try to detect corrupt databases.  */
+	  if (resultbuf->gr_name[gr_name_len - 1] != '\0'
+	      || resultbuf->gr_passwd[gr_resp->gr_passwd_len - 1] != '\0'
+	      || ({for (cnt = 0; cnt < gr_resp->gr_mem_cnt; ++cnt)
+		     if (resultbuf->gr_mem[cnt][len[cnt] - 1] != '\0')
+		       break;
+	  	   cnt < gr_resp->gr_mem_cnt; }))
+	    {
+	      /* We cannot use the database.  */
+	      retval = -1;
+	      goto out_close;
+	    }
+
 	  *result = resultbuf;
 	}
     }
diff --git a/nscd/nscd_gethst_r.c b/nscd/nscd_gethst_r.c
index 407be1441f..5d9d569107 100644
--- a/nscd/nscd_gethst_r.c
+++ b/nscd/nscd_gethst_r.c
@@ -87,14 +87,18 @@ __nscd_gethostbyaddr_r (const void *addr, socklen_t len, int type,
 }
 
 
-libc_locked_map_ptr (map_handle);
+libc_locked_map_ptr (, __hst_map_handle);
 /* Note that we only free the structure if necessary.  The memory
    mapping is not removed since it is not visible to the malloc
    handling.  */
-libc_freeres_fn (gr_map_free)
+libc_freeres_fn (hst_map_free)
 {
-  if (map_handle.mapped != NO_MAPPING)
-    free (map_handle.mapped);
+  if (__hst_map_handle.mapped != NO_MAPPING)
+    {
+      void *p = __hst_map_handle.mapped;
+      __hst_map_handle.mapped = NO_MAPPING;
+      free (p);
+    }
 }
 
 
@@ -110,7 +114,8 @@ nscd_gethst_r (const char *key, size_t keylen, request_type type,
   /* If the mapping is available, try to search there instead of
      communicating with the nscd.  */
   struct mapped_database *mapped;
-  mapped = __nscd_get_map_ref (GETFDHST, "hosts", &map_handle, &gc_cycle);
+  mapped = __nscd_get_map_ref (GETFDHST, "hosts", &__hst_map_handle,
+			       &gc_cycle);
 
  retry:;
   const hst_response_header *hst_resp = NULL;
@@ -336,6 +341,16 @@ nscd_gethst_r (const char *key, size_t keylen, request_type type,
 	  memcpy (resultbuf->h_aliases[0],
 		  (const char *) addr_list + addr_list_len, total_len);
 
+	  /* Try to detect corrupt databases.  */
+	  if (resultbuf->h_name[hst_resp->h_name_len - 1] != '\0'
+	      || ({for (cnt = 0; cnt < hst_resp->h_aliases_cnt; ++cnt)
+		     if (resultbuf->h_aliases[cnt][aliases_len[cnt] - 1]
+			 != '\0')
+		       break;
+		   cnt < hst_resp->h_aliases_cnt; }))
+	    /* We cannot use the database.  */
+	    goto out_close;
+
 	  retval = 0;
 	  *result = resultbuf;
 	}
diff --git a/nscd/nscd_getpw_r.c b/nscd/nscd_getpw_r.c
index b04dcfaa99..fe5fb43ca1 100644
--- a/nscd/nscd_getpw_r.c
+++ b/nscd/nscd_getpw_r.c
@@ -66,14 +66,18 @@ __nscd_getpwuid_r (uid_t uid, struct passwd *resultbuf, char *buffer,
 }
 
 
-libc_locked_map_ptr (map_handle);
+libc_locked_map_ptr (static, map_handle);
 /* Note that we only free the structure if necessary.  The memory
    mapping is not removed since it is not visible to the malloc
    handling.  */
-libc_freeres_fn (gr_map_free)
+libc_freeres_fn (pw_map_free)
 {
   if (map_handle.mapped != NO_MAPPING)
-    free (map_handle.mapped);
+    {
+      void *p = map_handle.mapped;
+      map_handle.mapped = NO_MAPPING;
+      free (p);
+    }
 }
 
 
@@ -184,6 +188,18 @@ nscd_getpw_r (const char *key, size_t keylen, request_type type,
 	  /* Copy the various strings.  */
 	  memcpy (resultbuf->pw_name, pw_name, total);
 
+	  /* Try to detect corrupt databases.  */
+	  if (resultbuf->pw_name[pw_resp->pw_name_len - 1] != '\0'
+	      || resultbuf->pw_passwd[pw_resp->pw_passwd_len - 1] != '\0'
+	      || resultbuf->pw_gecos[pw_resp->pw_gecos_len - 1] != '\0'
+	      || resultbuf->pw_dir[pw_resp->pw_dir_len - 1] != '\0'
+	      || resultbuf->pw_shell[pw_resp->pw_shell_len - 1] != '\0')
+	    {
+	      /* We cannot use the database.  */
+	      retval = -1;
+	      goto out_close;
+	    }
+
 	  *result = resultbuf;
 	}
     }
diff --git a/nscd/nscd_initgroups.c b/nscd/nscd_initgroups.c
index ce44f654d7..2ea9e7f862 100644
--- a/nscd/nscd_initgroups.c
+++ b/nscd/nscd_initgroups.c
@@ -29,15 +29,8 @@
 #include "nscd_proto.h"
 
 
-libc_locked_map_ptr (map_handle);
-/* Note that we only free the structure if necessary.  The memory
-   mapping is not removed since it is not visible to the malloc
-   handling.  */
-libc_freeres_fn (gr_map_free)
-{
-  if (map_handle.mapped != NO_MAPPING)
-    free (map_handle.mapped);
-}
+/* We use the same mapping as in nscd_getgr.   */
+libc_locked_map_ptr (extern, __gr_map_handle);
 
 
 int
@@ -50,7 +43,7 @@ __nscd_getgrouplist (const char *user, gid_t group, long int *size,
   /* If the mapping is available, try to search there instead of
      communicating with the nscd.  */
   struct mapped_database *mapped;
-  mapped = __nscd_get_map_ref (GETFDGR, "group", &map_handle, &gc_cycle);
+  mapped = __nscd_get_map_ref (GETFDGR, "group", &__gr_map_handle, &gc_cycle);
 
  retry:;
   const initgr_response_header *initgr_resp = NULL;