2007-05-29 Ulrich Drepper <drepper@redhat.com>

	* nscd/nscd_helper.c (get_mapping): Handle short replies instead
	of crashing.  When this is the case or if the reply is malformed,
	don't try to close the new file descriptor since it does not
	exist.
	Patch in part by Guillaume Chazarain <guichaz@yahoo.fr>.

diff --git a/ChangeLog b/ChangeLog
index a9f72390a21cf9ba8ea51040164b2442232b3137..47c98b6603d37cbd8cff85cfa5d50be7269bc1b3 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2007-05-29  Ulrich Drepper  <drepper@redhat.com>
+
+       * nscd/nscd_helper.c (get_mapping): Handle short replies instead
+       of crashing.  When this is the case or if the reply is malformed,
+       don't try to close the new file descriptor since it does not
+       exist.
+       Patch in part by Guillaume Chazarain <guichaz@yahoo.fr>.
+
 2007-05-21  Jakub Jelinek  <jakub@redhat.com>
 
        [BZ #4514]

diff --git a/nscd/nscd_helper.c b/nscd/nscd_helper.c
index af685a590bdaf0665869aeb9cee7cd4c0a5ee17a..ccbe576bedd45c63dd5c1b7e8aa44cc524e0b292 100644 (file)
--- a/nscd/nscd_helper.c
+++ b/nscd/nscd_helper.c
@@ -242,11 +242,12 @@ get_mapping (request_type type, const char *key,
                        != keylen, 0))
     goto out_close2;
 
-  mapfd = *(int *) CMSG_DATA (cmsg);
+  if (__builtin_expect (CMSG_FIRSTHDR (&msg) == NULL
+                       || (CMSG_FIRSTHDR (&msg)->cmsg_len
+                           != CMSG_LEN (sizeof (int))), 0))
+    goto out_close2;
 
-  if (__builtin_expect (CMSG_FIRSTHDR (&msg)->cmsg_len
-                       != CMSG_LEN (sizeof (int)), 0))
-    goto out_close;
+  mapfd = *(int *) CMSG_DATA (cmsg);
 
   struct stat64 st;
   if (__builtin_expect (strcmp (resdata, key) != 0, 0)