1 files changed, 40 insertions, 10 deletions

diff --git a/nis/nis_getservlist.c b/nis/nis_getservlist.c
index 315960c8e8..bea9d4dbc0 100644
--- a/nis/nis_getservlist.c
+++ b/nis/nis_getservlist.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2000, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -40,7 +40,10 @@ nis_getservlist (const_nis_name dir)
 	malloc (sizeof (nis_server *) *
 		(NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len + 1));
       if (__builtin_expect (serv == NULL, 0))
-	return NULL;
+	{
+	  nis_freeresult (res);
+	  return NULL;
+	}
 
       for (i = 0; i < NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len;
 	   ++i)
@@ -49,13 +52,37 @@ nis_getservlist (const_nis_name dir)
 	    &NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_val[i];
 	  serv[i] = calloc (1, sizeof (nis_server));
 	  if (__builtin_expect (serv[i] == NULL, 0))
-	    return NULL;
+	    {
+	    free_all:
+	      while (i-- > 0)
+		{
+		  free (serv[i]->pkey.n_bytes);
+		  if (serv[i]->ep.ep_val != NULL)
+		    {
+		      unsigned long int j;
+		      for (j = 0; j < serv[i]->ep.ep_len; ++j)
+			{
+			  free (serv[i]->ep.ep_val[j].proto);
+			  free (serv[i]->ep.ep_val[j].family);
+			  free (serv[i]->ep.ep_val[j].uaddr);
+			}
+		      free (serv[i]->ep.ep_val);
+		    }
+		  free (serv[i]->name);
+		  free (serv[i]);
+		}
+
+	      return NULL;
+	    }
 
 	  if (server->name != NULL)
 	    {
 	      serv[i]->name = strdup (server->name);
 	      if (__builtin_expect (serv[i]->name == NULL, 0))
-		return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
 	    }
 
           serv[i]->ep.ep_len = server->ep.ep_len;
@@ -66,7 +93,10 @@ nis_getservlist (const_nis_name dir)
               serv[i]->ep.ep_val =
 		malloc (server->ep.ep_len * sizeof (endpoint));
 	      if (__builtin_expect (serv[i]->ep.ep_val == NULL, 0))
-		return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
 
               for (j = 0; j < serv[i]->ep.ep_len; ++j)
                 {
@@ -87,20 +117,20 @@ nis_getservlist (const_nis_name dir)
 		    serv[i]->ep.ep_val[j].proto = NULL;
                 }
             }
-          else
-	    serv[i]->ep.ep_val = NULL;
+
           serv[i]->key_type = server->key_type;
           serv[i]->pkey.n_len = server->pkey.n_len;
           if (server->pkey.n_len > 0)
             {
               serv[i]->pkey.n_bytes = malloc (server->pkey.n_len);
               if (__builtin_expect (serv[i]->pkey.n_bytes == NULL, 0))
-                return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
               memcpy (serv[i]->pkey.n_bytes, server->pkey.n_bytes,
                       server->pkey.n_len);
             }
-          else
-            serv[i]->pkey.n_bytes = NULL;
         }
       serv[i] = NULL;
     }