Update.

1998-03-11  Ulrich Drepper  <drepper@cygnus.com>

	* nss/nss_db/db-XXX.c (lookup): Copy data to safe place before
	parsing it.

diff --git a/ChangeLog b/ChangeLog
index 80619c53b16f23243c70f190bcaf070bf63f044a..9b63b7ca5f85e534c5c58f85210cda421f3d9135 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+1998-03-11  Ulrich Drepper  <drepper@cygnus.com>
+
+       * nss/nss_db/db-XXX.c (lookup): Copy data to safe place before
+       parsing it.
+
 1998-03-11  Andreas Jaeger  <aj@arthur.rhein-neckar.de>
 
        * sysdeps/generic/dl-cache.c (_dl_load_cache_lookup): Use

diff --git a/elf/dl-lookup.c b/elf/dl-lookup.c
index b994ef711be3c7db3b91395a80786652eb299b71..9a2a1052f1cb5db13cd1ec4fc61d0a9edd83af9c 100644 (file)
--- a/elf/dl-lookup.c
+++ b/elf/dl-lookup.c
@@ -402,7 +402,7 @@ _dl_lookup_versioned_symbol_skip (const char *undef_name,
          char buf[sizeof undefined_msg + len];
          __mempcpy (__mempcpy (buf, undefined_msg, sizeof undefined_msg - 1),
                     undef_name, len + 1);
-         _dl_signal_error (0, (reference_namee && reference_name[0]
+         _dl_signal_error (0, (reference_name && reference_name[0]
                                ? reference_name
                                : (_dl_argv[0] ?: "<main program>")), buf);
        }

diff --git a/nss/nss_db/db-XXX.c b/nss/nss_db/db-XXX.c
index 1340b77de0a04f47ee1b1c3dd5fef3ae2a72333c..62c7a251f1166f3dbd7323944c8a0300c43512b0 100644 (file)
--- a/nss/nss_db/db-XXX.c
+++ b/nss/nss_db/db-XXX.c
@@ -1,5 +1,5 @@
 /* Common code for DB-based databases in nss_db module.
-   Copyright (C) 1996, 1997 Free Software Foundation, Inc.
+   Copyright (C) 1996, 1997, 1998 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -176,10 +176,19 @@ lookup (const DBT *key, struct STRUCTURE *result,
       H_ERRNO_SET (HOST_NOT_FOUND);
       status = NSS_STATUS_NOTFOUND;
     }
+  else if (buflen < value.size)
+    {
+      /* No room to copy the data to.  */
+      *errnop = ERANGE;
+      H_ERRNO_SET (NETDB_INTERNAL);
+      status = NSS_STATUS_TRYAGAIN;
+    }
   else
     {
+      /* Copy the result to a safe place.  */
+      p = (char *) memcpy (buffer, value.data, value.size);
+
       /* Skip leading blanks.  */
-      p = (char *) value.data;
       while (isspace (*p))
        ++p;