autofs-5.0.3 - nisplus partial and free From: Jeff Bastian <jbastian@redhat.com> During a nisplus key lookup nis_list() can return NIS_PARTIAL as well as possibly NIS_NOTFOUND or NIS_S_NOTFOUND when the key doesn't exist. This patch adds this to the checks and fixes a use after free of the result struct. --- modules/lookup_nisplus.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- autofs-5.0.1.orig/modules/lookup_nisplus.c +++ autofs-5.0.1/modules/lookup_nisplus.c @@ -285,13 +285,15 @@ static int lookup_one(struct autofs_poin result = nis_list(tablename, FOLLOW_PATH | FOLLOW_LINKS, NULL, NULL); if (result->status != NIS_SUCCESS && result->status != NIS_S_SUCCESS) { + nis_error rs = result->status; nis_freeresult(result); pthread_setcancelstate(cur_state, NULL); - if (result->status == NIS_NOTFOUND || - result->status == NIS_S_NOTFOUND) + if (rs == NIS_NOTFOUND || + rs == NIS_S_NOTFOUND || + rs == NIS_PARTIAL) return CHE_MISSING; - return -result->status; + return -rs; } @@ -338,13 +340,15 @@ static int lookup_wild(struct autofs_poi result = nis_list(tablename, FOLLOW_PATH | FOLLOW_LINKS, NULL, NULL); if (result->status != NIS_SUCCESS && result->status != NIS_S_SUCCESS) { + nis_error rs = result->status; nis_freeresult(result); pthread_setcancelstate(cur_state, NULL); - if (result->status == NIS_NOTFOUND || - result->status == NIS_S_NOTFOUND) + if (rs == NIS_NOTFOUND || + rs == NIS_S_NOTFOUND || + rs == NIS_PARTIAL) return CHE_MISSING; - return -result->status; + return -rs; } this = NIS_RES_OBJECT(result);