about summary refs log tree commit diff
path: root/nis/nss_compat/compat-spwd.c
diff options
context:
space:
mode:
Diffstat (limited to 'nis/nss_compat/compat-spwd.c')
-rw-r--r--nis/nss_compat/compat-spwd.c33
1 files changed, 30 insertions, 3 deletions
diff --git a/nis/nss_compat/compat-spwd.c b/nis/nss_compat/compat-spwd.c
index 816e9c1f0a..1d4216393a 100644
--- a/nis/nss_compat/compat-spwd.c
+++ b/nis/nss_compat/compat-spwd.c
@@ -359,11 +359,18 @@ getspent_next_nis_netgr (const char *name, struct spwd *result, ent_t *ent,
       p2len = spwd_need_buflen (&ent->pwd);
       if (p2len > buflen)
 	{
+	  free (outval);
 	  *errnop = ERANGE;
 	  return NSS_STATUS_TRYAGAIN;
 	}
       p2 = buffer + (buflen - p2len);
       buflen -= p2len;
+      if (buflen < ((size_t) outval + 1))
+	{
+	  free (outval);
+	  *errnop = ERANGE;
+	  return NSS_STATUS_TRYAGAIN;
+	}
       p = strncpy (buffer, outval, buflen);
       while (isspace (*p))
 	p++;
@@ -601,6 +608,14 @@ getspent_next_nis (struct spwd *result, ent_t *ent,
 	      give_spwd_free (&ent->pwd);
 	      return NSS_STATUS_UNAVAIL;
 	    }
+
+	  if (buflen < ((size_t) outvallen + 1))
+	    {
+	      free (outval);
+	      *errnop = ERANGE;
+	      return NSS_STATUS_TRYAGAIN;
+	    }
+
 	  saved_first = TRUE;
 	  saved_oldkey = ent->oldkey;
 	  saved_oldlen = ent->oldkeylen;
@@ -619,6 +634,13 @@ getspent_next_nis (struct spwd *result, ent_t *ent,
 	      return NSS_STATUS_NOTFOUND;
 	    }
 
+	  if (buflen < ((size_t) outvallen + 1))
+	    {
+	      free (outval);
+	      *errnop = ERANGE;
+	      return NSS_STATUS_TRYAGAIN;
+	    }
+
 	  saved_first = FALSE;
 	  saved_oldkey = ent->oldkey;
 	  saved_oldlen = ent->oldkeylen;
@@ -720,9 +742,14 @@ getspnam_plususer (const char *name, struct spwd *result, char *buffer,
 		    &outval, &outvallen)  != YPERR_SUCCESS)
 	return NSS_STATUS_NOTFOUND;
 
-      ptr = strncpy (buffer, outval, buflen < (size_t) outvallen ?
-		     buflen : (size_t) outvallen);
-      buffer[buflen < (size_t) outvallen ? buflen : (size_t) outvallen] = '\0';
+      if (buflen < ((size_t) outvallen + 1))
+	{
+	  free (outval);
+	  *errnop = ERANGE;
+	  return NSS_STATUS_TRYAGAIN;
+	}
+
+      ptr = strncpy (buffer, outval, buflen);
       free (outval);
       while (isspace (*ptr))
         ptr++;