diff options
Diffstat (limited to 'nis/nis_removemember.c')
| -rw-r--r-- | nis/nis_removemember.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/nis/nis_removemember.c b/nis/nis_removemember.c index 930ca4311f..b9e27ab48c 100644 --- a/nis/nis_removemember.c +++ b/nis/nis_removemember.c @@ -1,4 +1,4 @@ -/* Copyright (c) 1997, 1998, 1999 Free Software Foundation, Inc. +/* Copyright (c) 1997, 1998, 1999, 2004 Free Software Foundation, Inc. This file is part of the GNU C Library. Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997. @@ -17,6 +17,7 @@ Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. */ +#include <assert.h> #include <string.h> #include <rpcsvc/nis.h> @@ -87,6 +88,10 @@ nis_removemember (const_nis_name member, const_nis_name group) } } free (NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val); + assert (k <= NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_len); + /* This realloc() call always decreases the size. This cannot + fail. We still have the test but do not recover memory + (i.e., we overwrite the input pointer). */ newmem = realloc (newmem, k * sizeof (char*)); if (newmem == NULL) return NIS_NOMEMORY; |