From 0292b0dd6c85436fb10df5a77bde53ad4c298a6b Mon Sep 17 00:00:00 2001 From: Ulrich Drepper Date: Fri, 7 Apr 2006 04:29:25 +0000 Subject: * libio/fmemopen.c (fmemopen): Free stream memory in case of invalid length [Coverity CID 106]. * nss/nss_files/files-key.c (search): Close stream before successful return [Coverity CID 107]. * io/fts.c (fts_open): Don't allocate parent if *argv==NULL [Coverity CID 108]. * sunrpc/rpc_cout.c (inline_struct): Free sizestr after use [Coverity CID 110, 109]. * sunrpc/rpc_scan.c (docppline): Free file string if it is not going to be used [Coverity CID 111]. * sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free memory if socket level value cannot be retrieved [Coverity CID 112]. * nis/nis_clone_dir.c (nis_clone_directory): Free all memory in error case [Coverity CID 114]. * nis/nis_clone_res.c (nis_clone_result): Free all memory in the error cases [Coverity CID 115]. * sunrpc/rpc_parse.c (get_definition): Free defp if tok == TOK_EOF [Coverity CID 116]. * sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free memory if socket level value cannot be retrieved [Coverity CID 117]. * elf/cache.c (save_cache): Initialize pad to avoid writing uninitialized data to disk. * elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118]. * intl/finddomain.c (_nl_find_domain): Avoid strdup of expand locale name, use strdupa. Remove free call [Coverity CID 119]. * sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and the resulting leak [Coverity CID 121]. * sunrpc/rpc_main.c (mkfile_output): Free all allocated memory [Coverity CID 122]. * sunrpc/rpc_main.c (h_output): Free guard after we are done [Coverity CID 123]. * sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation fails [Coverity CID 126]. * sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error cases [Coverity CID 127]. * nis/nis_table.c (__create_ib_request): Free ibreq in case strdup fails [Coverity CID 128]. * nis/nis_getservlist.c (nis_getservlist): Free all memory in case of an error [Coverity CID 130, 129]. * nis/nis_print_group_entry.c (nis_print_group_entry): If nis_lookup call failed, return. Free lookup result in error cases [Coverity CID 131]. * nis/nis_removemember.c (nis_removemember): Free all memory in error cases [Coverity CID 132]. * nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r): Always free lookup result [Coverity CID 134]. * nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r): Always free lookup result [Coverity CID 135]. * nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r): Always free lookup result [Coverity CID 136]. * nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r): Before retrying, free old result [Coverity CID 137]. * nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user): Free res in case UID is zero [Coverity CID 138]. * nis/ypclnt.c (yp_update): Always free master string [Coverity CID 140]. * nis/nis_creategroup.c (nis_creategroup): Free all memory in error cases [Coverity CID 143, 142, 141]. * nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result if yp_match call succeeded [Coverity CID 155]. * nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string allocated in yp_match at all times [Coverity CID 157, 156]. * nscd/nscd.c (write_pid): Close stream also if writing failed [Coverity CID 165]. * nis/nis_table.c (nis_add_entry): Move test for NULL parameter ahead of first use [Coverity CID 167]. * nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test for NULL parameter ahead of first use [Coverity CID 168]. * intl/finddomain.c (_nl_find_domain): We never return NULL if we found the locale [Coverity CID 169]. * inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set herrno [Coverity CID 178]. * nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned freed object [Coverity CID 182]. --- nis/nis_getservlist.c | 50 ++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 40 insertions(+), 10 deletions(-) (limited to 'nis/nis_getservlist.c') diff --git a/nis/nis_getservlist.c b/nis/nis_getservlist.c index 315960c8e8..bea9d4dbc0 100644 --- a/nis/nis_getservlist.c +++ b/nis/nis_getservlist.c @@ -1,4 +1,4 @@ -/* Copyright (c) 1997, 1998, 1999, 2000 Free Software Foundation, Inc. +/* Copyright (c) 1997, 1998, 1999, 2000, 2006 Free Software Foundation, Inc. This file is part of the GNU C Library. Contributed by Thorsten Kukuk , 1997. @@ -40,7 +40,10 @@ nis_getservlist (const_nis_name dir) malloc (sizeof (nis_server *) * (NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len + 1)); if (__builtin_expect (serv == NULL, 0)) - return NULL; + { + nis_freeresult (res); + return NULL; + } for (i = 0; i < NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len; ++i) @@ -49,13 +52,37 @@ nis_getservlist (const_nis_name dir) &NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_val[i]; serv[i] = calloc (1, sizeof (nis_server)); if (__builtin_expect (serv[i] == NULL, 0)) - return NULL; + { + free_all: + while (i-- > 0) + { + free (serv[i]->pkey.n_bytes); + if (serv[i]->ep.ep_val != NULL) + { + unsigned long int j; + for (j = 0; j < serv[i]->ep.ep_len; ++j) + { + free (serv[i]->ep.ep_val[j].proto); + free (serv[i]->ep.ep_val[j].family); + free (serv[i]->ep.ep_val[j].uaddr); + } + free (serv[i]->ep.ep_val); + } + free (serv[i]->name); + free (serv[i]); + } + + return NULL; + } if (server->name != NULL) { serv[i]->name = strdup (server->name); if (__builtin_expect (serv[i]->name == NULL, 0)) - return NULL; + { + ++i; + goto free_all; + } } serv[i]->ep.ep_len = server->ep.ep_len; @@ -66,7 +93,10 @@ nis_getservlist (const_nis_name dir) serv[i]->ep.ep_val = malloc (server->ep.ep_len * sizeof (endpoint)); if (__builtin_expect (serv[i]->ep.ep_val == NULL, 0)) - return NULL; + { + ++i; + goto free_all; + } for (j = 0; j < serv[i]->ep.ep_len; ++j) { @@ -87,20 +117,20 @@ nis_getservlist (const_nis_name dir) serv[i]->ep.ep_val[j].proto = NULL; } } - else - serv[i]->ep.ep_val = NULL; + serv[i]->key_type = server->key_type; serv[i]->pkey.n_len = server->pkey.n_len; if (server->pkey.n_len > 0) { serv[i]->pkey.n_bytes = malloc (server->pkey.n_len); if (__builtin_expect (serv[i]->pkey.n_bytes == NULL, 0)) - return NULL; + { + ++i; + goto free_all; + } memcpy (serv[i]->pkey.n_bytes, server->pkey.n_bytes, server->pkey.n_len); } - else - serv[i]->pkey.n_bytes = NULL; } serv[i] = NULL; } -- cgit 1.4.1