summaryrefslogtreecommitdiff
path: root/libc
diff options
context:
space:
mode:
authorEric Andersen <andersen@codepoet.org>2002-04-13 15:13:59 +0000
committerEric Andersen <andersen@codepoet.org>2002-04-13 15:13:59 +0000
commit929686ba6a01168aee43cb3b854d24133f4ef38e (patch)
tree50b87b9891d721ea194f97d013dc30267c04019f /libc
parent520204fff130a917266f452ed672a0885b8e0d8f (diff)
Patch from Jim Treadway <jim@stardot-tech.com>:
The internal __getgrent function doesn't allocate enough memory to hold the trailing NULL pointer in the gr_mem member of the returned 'struct group *'.
Diffstat (limited to 'libc')
-rw-r--r--libc/pwd_grp/__getgrent.c28
1 files changed, 9 insertions, 19 deletions
diff --git a/libc/pwd_grp/__getgrent.c b/libc/pwd_grp/__getgrent.c
index d1bf8e61e..2da45973f 100644
--- a/libc/pwd_grp/__getgrent.c
+++ b/libc/pwd_grp/__getgrent.c
@@ -145,26 +145,16 @@ struct group *__getgrent(int grp_fd)
}
#else /* !GR_SCALE_DYNAMIC */
if (members != NULL)
- free(members);
- members = (char **) malloc(1 * sizeof(char *));
-
- while ((ptr = strchr(ptr, ',')) != NULL) {
- *ptr = '\0';
- ptr++;
- members[member_num] = field_begin;
- field_begin = ptr;
- member_num++;
- members =
- (char **) realloc((void *) members,
-
- (member_num + 1) * sizeof(char *));
- }
- if (*field_begin == '\0')
- members[member_num] = NULL;
- else {
- members[member_num] = field_begin;
- members[member_num + 1] = NULL;
+ free(members);
+ members = (char **) malloc((member_num + 1) * sizeof(char *));
+ for ( ; field_begin && *field_begin != '\0'; field_begin = ptr) {
+ if ((ptr = strchr(field_begin, ',')) != NULL)
+ *ptr++ = '\0';
+ members[member_num++] = field_begin;
+ members = (char **) realloc(members,
+ (member_num + 1) * sizeof(char *));
}
+ members[member_num] = NULL;
#endif /* GR_SCALE_DYNAMIC */
group.gr_mem = members;