2005-04-29 Ulrich Drepper <drepper@redhat.com>

	[BZ #1093]
	* nis/nis_table.c: Fix realloc handling.
	* nis/nis_removemember.c: Likewise.

diff --git a/nis/nis_removemember.c b/nis/nis_removemember.c
index b9e27ab48c9b156367dd6c3e9ce007867fa38793..0ad221338781e3f5c359d3d55339242debadff75 100644 (file)
--- a/nis/nis_removemember.c
+++ b/nis/nis_removemember.c
@@ -92,9 +92,13 @@ nis_removemember (const_nis_name member, const_nis_name group)
       /* This realloc() call always decreases the size.  This cannot
         fail.  We still have the test but do not recover memory
         (i.e., we overwrite the input pointer).  */
-      newmem = realloc (newmem, k * sizeof (char*));
-      if (newmem == NULL)
-       return NIS_NOMEMORY;
+      nis_name *newp = realloc (newmem, k * sizeof (char*));
+      if (newp == NULL)
+       {
+         free (newmem);
+         return NIS_NOMEMORY;
+       }
+      newmem = newp;
 
       NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val = newmem;
       NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_len = k;

diff --git a/nis/nis_table.c b/nis/nis_table.c
index 13acdfdf503db7a5577505cc464691fda8eb5f5e..f746b7c629f936f0f7a120a4e4216725379d32ee 100644 (file)
--- a/nis/nis_table.c
+++ b/nis/nis_table.c
@@ -94,9 +94,10 @@ __create_ib_request (const_nis_name name, unsigned int flags)
       if ((search_len + 1) >= size)
         {
           size += 1;
-          search_val = realloc (search_val, size * sizeof (nis_attr));
-         if (search_val == NULL)
+         nis_attr *newp = realloc (search_val, size * sizeof (nis_attr));
+         if (newp == NULL)
            goto free_null;
+         search_val = newp;
        }
       search_val[search_len].zattr_ndx = strdup (key);
       if ((search_val[search_len].zattr_ndx) == NULL)