From e34fccc883e1fb6e7c0e1663e11ff9f96191971f Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Mon, 27 Jan 2014 17:04:32 +0100
Subject: [PATCH 1/2] Fix use after free in read_hostent and read_netent.
if NSS_STATUS_TRYAGAIN is returned from read_one_hostent or
read_one_netent function tio_skipall will be called with NULL pointer
It could happend in functions:
_nss_ldap_getnetbyname_r
_nss_ldap_getnetbyaddr_r
_nss_ldap_gethostbyname2_r
_nss_ldap_gethostbyaddr_r
---
nss/hosts.c | 2 --
nss/networks.c | 2 --
2 files changed, 4 deletions(-)
diff --git a/nss/hosts.c b/nss/hosts.c
index 86b6a77..0e7027e 100644
--- a/nss/hosts.c
+++ b/nss/hosts.c
@@ -51,8 +51,6 @@
#undef ERROR_OUT_BUFERROR
#define ERROR_OUT_BUFERROR(fp) \
- (void)tio_close(fp); \
- fp=NULL; \
*errnop=ERANGE; \
*h_errnop=TRY_AGAIN; \
return NSS_STATUS_TRYAGAIN;
diff --git a/nss/networks.c b/nss/networks.c
index 859ef0e..1403b45 100644
--- a/nss/networks.c
+++ b/nss/networks.c
@@ -51,8 +51,6 @@
#undef ERROR_OUT_BUFERROR
#define ERROR_OUT_BUFERROR(fp) \
- (void)tio_close(fp); \
- fp=NULL; \
*errnop=ERANGE; \
*h_errnop=TRY_AGAIN; \
return NSS_STATUS_TRYAGAIN;
--
1.8.5.3