elf: Fix use-after-free in ldconfig [BZ #26779]
[glibc.git] / nis / nis_removemember.c
blob4d2d4465c471901cc5c02a6ceab7b2fc32330264
1 /* Copyright (c) 1997-2022 Free Software Foundation, Inc.
2 This file is part of the GNU C Library.
4 The GNU C Library is free software; you can redistribute it and/or
5 modify it under the terms of the GNU Lesser General Public
6 License as published by the Free Software Foundation; either
7 version 2.1 of the License, or (at your option) any later version.
9 The GNU C Library is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 Lesser General Public License for more details.
14 You should have received a copy of the GNU Lesser General Public
15 License along with the GNU C Library; if not, see
16 <https://www.gnu.org/licenses/>. */
18 #include <assert.h>
19 #include <string.h>
20 #include <rpcsvc/nis.h>
21 #include <shlib-compat.h>
23 nis_error
24 nis_removemember (const_nis_name member, const_nis_name group)
26 if (group != NULL && group[0] != '\0')
28 size_t grouplen = strlen (group);
29 char buf[grouplen + 14 + NIS_MAXNAMELEN];
30 char domainbuf[grouplen + 2];
31 nis_result *res, *res2;
32 nis_error status;
33 char *cp, *cp2;
35 cp = rawmemchr (nis_leaf_of_r (group, buf, sizeof (buf) - 1), '\0');
36 cp = stpcpy (cp, ".groups_dir");
37 cp2 = nis_domain_of_r (group, domainbuf, sizeof (domainbuf) - 1);
38 if (cp2 != NULL && cp2[0] != '\0')
40 cp = stpcpy (cp, ".");
41 stpcpy (cp, cp2);
43 res = nis_lookup (buf, FOLLOW_LINKS | EXPAND_NAME);
44 if (res == NULL)
45 return NIS_NOMEMORY;
46 if (NIS_RES_STATUS (res) != NIS_SUCCESS)
48 status = NIS_RES_STATUS (res);
49 nis_freeresult (res);
50 return status;
53 if (NIS_RES_NUMOBJ (res) != 1
54 || __type_of (NIS_RES_OBJECT (res)) != NIS_GROUP_OBJ)
56 nis_freeresult (res);
57 return NIS_INVALIDOBJ;
60 nis_name *gr_members_val
61 = NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_val;
62 u_int gr_members_len
63 = NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_len;
65 u_int j = 0;
66 for (u_int i = 0; i < gr_members_len; ++i)
67 if (strcmp (gr_members_val[i], member) != 0)
68 gr_members_val[j++] = gr_members_val[i];
69 else
70 free (gr_members_val[i]);
72 /* There is no need to reallocate the gr_members_val array. We
73 just adjust the size to match the number of strings still in
74 it. Yes, xdr_array will use mem_free with a size parameter
75 but this is mapped to a simple free call which determines the
76 size of the block by itself. */
77 NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_len = j;
79 cp = stpcpy (buf, NIS_RES_OBJECT (res)->zo_name);
80 *cp++ = '.';
81 strncpy (cp, NIS_RES_OBJECT (res)->zo_domain, NIS_MAXNAMELEN);
82 res2 = nis_modify (buf, NIS_RES_OBJECT (res));
83 status = NIS_RES_STATUS (res2);
84 nis_freeresult (res);
85 nis_freeresult (res2);
87 return status;
89 else
90 return NIS_FAIL;
92 libnsl_hidden_nolink_def (nis_removemember, GLIBC_2_1)