Merge branch 'master' into bug13658-branch

[thirdparty/glibc.git] / nis / nis_addmember.c

diff --git a/nis/nis_addmember.c b/nis/nis_addmember.c
index 2eee9cc8bf018c78647171dcd125b511b00117ce..270a7a02b0503d240fd54824ea6cb6b3a254d551 100644 (file)
--- a/nis/nis_addmember.c
+++ b/nis/nis_addmember.c
@@ -1,64 +1,87 @@
-/* Copyright (c) 1997 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
    The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Library General Public License as
-   published by the Free Software Foundation; either version 2 of the
-   License, or (at your option) any later version.
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
 
    The GNU C Library is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Library General Public License for more details.
+   Lesser General Public License for more details.
 
-   You should have received a copy of the GNU Library General Public
-   License along with the GNU C Library; see the file COPYING.LIB.  If not,
-   write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
-   Boston, MA 02111-1307, USA. */
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
 
+#include <assert.h>
 #include <string.h>
 #include <rpcsvc/nis.h>
-#include <rpcsvc/nislib.h>
 
 nis_error
 nis_addmember (const_nis_name member, const_nis_name group)
 {
-  if (group != NULL && strlen (group) > 0)
+  if (group != NULL && group[0] != '\0')
     {
-      char buf[strlen (group) + 50];
-      char leafbuf[strlen (group) + 2];
-      char domainbuf[strlen (group) + 2];
+      size_t grouplen = strlen (group);
+      char buf[grouplen + 14 + NIS_MAXNAMELEN];
+      char domainbuf[grouplen + 2];
       nis_result *res, *res2;
       nis_error status;
       char *cp, *cp2;
 
-      cp = stpcpy (buf, nis_leaf_of_r (group, leafbuf, sizeof (leafbuf) - 1));
+      cp = rawmemchr (nis_leaf_of_r (group, buf, sizeof (buf) - 1), '\0');
       cp = stpcpy (cp, ".groups_dir");
       cp2 = nis_domain_of_r (group, domainbuf, sizeof (domainbuf) - 1);
-      if (cp2 != NULL && strlen (cp2) > 0)
+      if (cp2 != NULL && cp2[0] != '\0')
         {
-          cp = stpcpy (cp, ".");
-          strcpy (cp, cp2);
+         *cp++ = '.';
+          stpcpy (cp, cp2);
         }
-      res = nis_lookup (buf, FOLLOW_LINKS|EXPAND_NAME);
-      if (res->status != NIS_SUCCESS)
+      res = nis_lookup (buf, FOLLOW_LINKS | EXPAND_NAME);
+      if (NIS_RES_STATUS (res) != NIS_SUCCESS)
        {
-         status = res->status;
+         status = NIS_RES_STATUS (res);
          nis_freeresult (res);
          return status;
        }
-      if ((res->objects.objects_len != 1) ||
-          (res->objects.objects_val[0].zo_data.zo_type != GROUP_OBJ))
-        return NIS_INVALIDOBJ;
+      if (NIS_RES_NUMOBJ (res) != 1
+         || __type_of (NIS_RES_OBJECT (res)) != NIS_GROUP_OBJ)
+       {
+         nis_freeresult (res);
+         return NIS_INVALIDOBJ;
+       }
+
+      u_int gr_members_len
+       = NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_len;
+
+      nis_name *new_gr_members_val
+       = realloc (NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val,
+                  (gr_members_len + 1) * sizeof (nis_name));
+      if (new_gr_members_val == NULL)
+       goto nomem_out;
 
-      res->objects.objects_val[0].GR_data.gr_members.gr_members_val
-       = realloc (res->objects.objects_val[0].GR_data.gr_members.gr_members_val, res->objects.objects_val[0].GR_data.gr_members.gr_members_len + 1);
-      ++res->objects.objects_val[0].GR_data.gr_members.gr_members_len;
-      res->objects.objects_val[0].GR_data.gr_members.gr_members_val[res->objects.objects_val[0].GR_data.gr_members.gr_members_len] = strdup (member);
+      NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val
+       = new_gr_members_val;
+
+      new_gr_members_val[gr_members_len] = strdup (member);
+      if (new_gr_members_val[gr_members_len] == NULL)
+       {
+       nomem_out:
+         nis_freeresult (res);
+         return NIS_NOMEMORY;
+       }
+      ++NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_len;
 
-      res2 = nis_modify (buf, res->objects.objects_val);
-      status = res2->status;
+      /* Check the buffer bounds are not exceeded.  */
+      assert (strlen (NIS_RES_OBJECT(res)->zo_name) + 1 < grouplen + 14);
+      cp = stpcpy (buf, NIS_RES_OBJECT(res)->zo_name);
+      *cp++ = '.';
+      strncpy (cp, NIS_RES_OBJECT (res)->zo_domain, NIS_MAXNAMELEN);
+      res2 = nis_modify (buf, NIS_RES_OBJECT (res));
+      status = NIS_RES_STATUS (res2);
       nis_freeresult (res);
       nis_freeresult (res2);