4 files changed, 67 insertions, 15 deletions

diff --git a/lib/libc/gen/getnetgrent.c b/lib/libc/gen/getnetgrent.c
index ca75d9b8d6c9f..bbd1495bfe790 100644
--- a/lib/libc/gen/getnetgrent.c
+++ b/lib/libc/gen/getnetgrent.c
@@ -203,9 +203,7 @@ setnetgrent(const char *group)
 			if (parse_netgrp(group))
 				endnetgrent();
 			else {
-				grouphead.grname = (char *)
-					malloc(strlen(group) + 1);
-				strcpy(grouphead.grname, group);
+				grouphead.grname = strdup(group);
 			}
 			if (netf)
 				fclose(netf);
@@ -417,7 +415,7 @@ static int
 parse_netgrp(const char *group)
 {
 	char *spos, *epos;
-	int len, strpos;
+	int len, strpos, freepos;
 #ifdef DEBUG
 	int fields;
 #endif
@@ -454,9 +452,9 @@ parse_netgrp(const char *group)
 	while (pos != NULL && *pos != '\0') {
 		if (*pos == '(') {
 			grp = (struct netgrp *)malloc(sizeof (struct netgrp));
+			if (grp == NULL)
+				return(1);
 			bzero((char *)grp, sizeof (struct netgrp));
-			grp->ng_next = grouphead.gr;
-			grouphead.gr = grp;
 			pos++;
 			gpos = strsep(&pos, ")");
 #ifdef DEBUG
@@ -477,6 +475,13 @@ parse_netgrp(const char *group)
 					if (len > 0) {
 						grp->ng_str[strpos] =  (char *)
 							malloc(len + 1);
+						if (grp->ng_str[strpos] == NULL) {
+							for (freepos = 0; freepos < strpos; freepos++)
+								if (grp->ng_str[freepos] != NULL)
+									free(grp->ng_str[freepos]);
+							free(grp);
+							return(1);
+						}
 						bcopy(spos, grp->ng_str[strpos],
 							len + 1);
 					}
@@ -490,6 +495,8 @@ parse_netgrp(const char *group)
 					grp->ng_str[strpos] = NULL;
 				}
 			}
+			grp->ng_next = grouphead.gr;
+			grouphead.gr = grp;
 #ifdef DEBUG
 			/*
 			 * Note: on other platforms, malformed netgroup
@@ -526,7 +533,7 @@ parse_netgrp(const char *group)
 static struct linelist *
 read_for_group(const char *group)
 {
-	char *pos, *spos, *linep, *olinep;
+	char *pos, *spos, *linep;
 	int len, olen;
 	int cont;
 	struct linelist *lp;
@@ -534,6 +541,7 @@ read_for_group(const char *group)
 #ifdef YP
 	char *result;
 	int resultlen;
+	linep = NULL;
 
 	while (_netgr_yp_enabled || fgets(line, LINSIZ, netf) != NULL) {
 		if (_netgr_yp_enabled) {
@@ -554,6 +562,7 @@ read_for_group(const char *group)
 			free(result);
 		}
 #else
+	linep = NULL;
 	while (fgets(line, LINSIZ, netf) != NULL) {
 #endif
 		pos = (char *)&line;
@@ -576,8 +585,14 @@ read_for_group(const char *group)
 			pos++;
 		if (*pos != '\n' && *pos != '\0') {
 			lp = (struct linelist *)malloc(sizeof (*lp));
+			if (lp == NULL) 
+				return(NULL);
 			lp->l_parsed = 0;
 			lp->l_groupname = (char *)malloc(len + 1);
+			if (lp->l_groupname == NULL) {
+				free(lp);
+				return(NULL);
+			}
 			bcopy(spos, lp->l_groupname, len);
 			*(lp->l_groupname + len) = '\0';
 			len = strlen(pos);
@@ -595,15 +610,15 @@ read_for_group(const char *group)
 				} else
 					cont = 0;
 				if (len > 0) {
-					linep = (char *)malloc(olen + len + 1);
-					if (olen > 0) {
-						bcopy(olinep, linep, olen);
-						free(olinep);
+					linep = (char *)reallocf(linep, olen + len + 1);
+					if (linep == NULL) {
+						free(lp->l_groupname);
+						free(lp);
+						return(NULL);
 					}
 					bcopy(pos, linep + olen, len);
 					olen += len;
 					*(linep + olen) = '\0';
-					olinep = linep;
 				}
 				if (cont) {
 					if (fgets(line, LINSIZ, netf)) {
@@ -634,5 +649,5 @@ read_for_group(const char *group)
 	 */
 	rewind(netf);
 #endif
-	return ((struct linelist *)0);
+	return (NULL);
 }
diff --git a/lib/libutil/libutil.h b/lib/libutil/libutil.h
index 47896c167a066..25ac1dba12130 100644
--- a/lib/libutil/libutil.h
+++ b/lib/libutil/libutil.h
@@ -170,6 +170,7 @@ struct pidfh *pidfile_open(const char *path, mode_t mode, pid_t *pidptr);
 int pidfile_write(struct pidfh *pfh);
 int pidfile_close(struct pidfh *pfh);
 int pidfile_remove(struct pidfh *pfh);
+int pidfile_fileno(struct pidfh *pfh);
 #endif
 
 #ifdef _UFS_UFS_QUOTA_H_
diff --git a/lib/libutil/pidfile.3 b/lib/libutil/pidfile.3
index c42b95b1f8385..7ab9857731985 100644
--- a/lib/libutil/pidfile.3
+++ b/lib/libutil/pidfile.3
@@ -46,6 +46,8 @@
 .Fn pidfile_close "struct pidfh *pfh"
 .Ft int
 .Fn pidfile_remove "struct pidfh *pfh"
+.Ft int
+.Fn pidfile_fileno "struct pidfh *pfh"
 .Sh DESCRIPTION
 The
 .Nm pidfile
@@ -92,6 +94,10 @@ to start a child process.
 The
 .Fn pidfile_remove
 function closes and removes a pidfile.
+.Pp
+The
+.Fn pidfile_fileno
+function returns the file descriptor for the open pid file.
 .Sh RETURN VALUES
 The
 .Fn pidfile_open
@@ -105,15 +111,25 @@ If an error occurs,
 will be set.
 .Pp
 .Rv -std pidfile_write pidfile_close pidfile_remove
+.Pp
+The
+.Fn pidfile_fileno
+function returns the low-level file descriptor.
+It returns -1 and sets
+.Va errno
+if a NULL
+.Vt pidfh
+is specified, or if the pidfile is no longer open.
 .Sh EXAMPLES
 The following example shows in which order these functions should be used.
 Note that it is safe to pass
 .Dv NULL
 to
 .Fn pidfile_write ,
-.Fn pidfile_remove
-and
+.Fn pidfile_remove ,
 .Fn pidfile_close
+and
+.Fn pidfile_fileno
 functions.
 .Bd -literal
 struct pidfh *pfh;
@@ -244,6 +260,16 @@ and
 system calls and the
 .Xr flopen 3
 library function.
+.Pp
+The
+.Fn pidfile_fileno
+function will fail if:
+.Bl -tag -width Er
+.It Bq Er EDOOFUS
+Improper function use.
+Probably called not from the process which used
+.Fn pidfile_open .
+.El
 .Sh SEE ALSO
 .Xr open 2 ,
 .Xr daemon 3 ,
diff --git a/lib/libutil/pidfile.c b/lib/libutil/pidfile.c
index fcd504c18e990..cf5accebe3b41 100644
--- a/lib/libutil/pidfile.c
+++ b/lib/libutil/pidfile.c
@@ -266,3 +266,13 @@ pidfile_remove(struct pidfh *pfh)
 
 	return (_pidfile_remove(pfh, 1));
 }
+
+int
+pidfile_fileno(struct pidfh *pfh)
+{
+	if (pfh == NULL || pfh->pf_fd == -1) {
+		errno = EDOOFUS;
+		return (-1);
+	}
+	return (pfh->pf_fd);
+}