Fix unbound stack use in NIS NSS module

[thirdparty/glibc.git] / nis / nis_lookup.c

diff --git a/nis/nis_lookup.c b/nis/nis_lookup.c
index 821b9bce73a080b4aaa4023022833f1a674417af..b9096c9ea4fd1836f75a9408d01a1d198fd1e469 100644 (file)
--- a/nis/nis_lookup.c
+++ b/nis/nis_lookup.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1997-1999, 2004, 2005, 2006 Free Software Foundation, Inc.
+/* Copyright (C) 1997-2014 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@uni-paderborn.de>, 1997.
 
@@ -13,14 +13,15 @@
    Lesser General Public License for more details.
 
    You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, write to the Free
-   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-   02111-1307 USA.  */
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
 
 #include <string.h>
 #include <rpcsvc/nis.h>
 #include "nis_xdr.h"
 #include "nis_intern.h"
+#include <libnsl.h>
+
 
 nis_result *
 nis_lookup (const_nis_name name, const unsigned int flags)
@@ -61,32 +62,13 @@ nis_lookup (const_nis_name name, const unsigned int flags)
       req.ns_object.ns_object_len = 0;
       req.ns_object.ns_object_val = NULL;
 
-      status = __nisfind_server (req.ns_name, &dir);
-      if (status != NIS_SUCCESS)
+      status = __prepare_niscall (req.ns_name, &dir, &bptr, flags);
+      if (__glibc_unlikely (status != NIS_SUCCESS))
        {
          NIS_RES_STATUS (res) = status;
          goto out;
        }
 
-      status = __nisbind_create (&bptr, dir->do_servers.do_servers_val,
-                                dir->do_servers.do_servers_len, flags);
-      if (status != NIS_SUCCESS)
-       {
-         NIS_RES_STATUS (res) = status;
-         nis_free_directory (dir);
-         goto out;;
-       }
-
-      while (__nisbind_connect (&bptr) != NIS_SUCCESS)
-       {
-         if (__nisbind_next (&bptr) != NIS_SUCCESS)
-           {
-             nis_free_directory (dir);
-             NIS_RES_STATUS (res) = NIS_NAMEUNREACHABLE;
-             goto out;
-           }
-       }
-
       do
        {
          static const struct timeval RPCTIMEOUT = {10, 0};
@@ -106,11 +88,9 @@ nis_lookup (const_nis_name name, const unsigned int flags)
 
              if (NIS_RES_STATUS (res) == NIS_SUCCESS)
                {
-                   if (__type_of(NIS_RES_OBJECT (res)) == NIS_LINK_OBJ
+                   if (__type_of (NIS_RES_OBJECT (res)) == NIS_LINK_OBJ
                        && (flags & FOLLOW_LINKS)) /* We are following links */
                      {
-                       if (count_links)
-                         free (req.ns_name);
                        /* if we hit the link limit, bail */
                        if (count_links > NIS_MAXLINKS)
                          {
@@ -119,31 +99,15 @@ nis_lookup (const_nis_name name, const unsigned int flags)
                          }
                        ++count_links;
                        req.ns_name =
-                         strdup (NIS_RES_OBJECT (res)->LI_data.li_name);
-                       if (req.ns_name == NULL)
-                         {
-                           nis_free_directory (dir);
-                           res = NULL;
-                           goto out;
-                         }
+                         strdupa (NIS_RES_OBJECT (res)->LI_data.li_name);
 
                        /* The following is a non-obvious optimization.  A
                           nis_freeresult call would call xdr_free as the
                           following code.  But it also would unnecessarily
                           free the result structure.  We avoid this here
                           along with the necessary tests.  */
-#if 1
                        xdr_free ((xdrproc_t) _xdr_nis_result, (char *) res);
                        memset (res, '\0', sizeof (*res));
-#else
-                       nis_freeresult (res);
-                       res = calloc (1, sizeof (nis_result));
-                       if (res == NULL)
-                         {
-                           __nisbind_destroy (&bptr);
-                           return NULL;
-                         }
-#endif
 
                        link_first_try = 1; /* Try at first the old binding */
                        goto again;
@@ -161,22 +125,35 @@ nis_lookup (const_nis_name name, const unsigned int flags)
                        /* Otherwise __nisfind_server will not do anything.  */
                        dir = NULL;
 
-                       if (__nisfind_server (req.ns_name, &dir)
+                       if (__nisfind_server (req.ns_name, 1, &dir, &bptr,
+                                             flags & ~MASTER_ONLY)
                            != NIS_SUCCESS)
                          goto out;
-
-                       if (__nisbind_create (&bptr,
-                                             dir->do_servers.do_servers_val,
-                                             dir->do_servers.do_servers_len,
-                                             flags) != NIS_SUCCESS)
-                         {
-                           nis_free_directory (dir);
-                           goto out;
-                         }
                      }
                    else
                      if (__nisbind_next (&bptr) != NIS_SUCCESS)
-                       break; /* No more servers to search */
+                       {
+                         /* No more servers to search.  Try parent.  */
+                         const char *ndomain = __nis_domain_of (req.ns_name);
+                         req.ns_name = strdupa (ndomain);
+                         if (strcmp (req.ns_name, ".") == 0)
+                           {
+                             NIS_RES_STATUS (res) = NIS_NAMEUNREACHABLE;
+                             goto out;
+                           }
+
+                         __nisbind_destroy (&bptr);
+                         nis_free_directory (dir);
+                         dir = NULL;
+                         status = __prepare_niscall (req.ns_name, &dir,
+                                                     &bptr, flags);
+                         if (__glibc_unlikely (status != NIS_SUCCESS))
+                           {
+                             NIS_RES_STATUS (res) = status;
+                             goto out;
+                           }
+                         goto again;
+                       }
 
                    while (__nisbind_connect (&bptr) != NIS_SUCCESS)
                      {