2 files changed, 39 insertions, 27 deletions

diff --git a/lib/libc/gen/getgrent.c b/lib/libc/gen/getgrent.c
index e9b9d1fccd20..3a4a067b9648 100644
--- a/lib/libc/gen/getgrent.c
+++ b/lib/libc/gen/getgrent.c
@@ -283,22 +283,27 @@ grscan(search, gid, name)
 
 #ifdef YP
 
-static void
+static int
 _gr_breakout_yp(struct group *gr, char *result)
 {
 	char *s, *cp;
 	char **m;
 
-	s = strsep(&result, ":"); /* name */
+	/*
+	 * XXX If 's' ends up being a NULL pointer, punt on this group.
+	 * It means the NIS group entry is badly formatted and should
+	 * be skipped.
+	 */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* name */
 	gr->gr_name = s;
 
-	s = strsep(&result, ":"); /* password */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* password */
 	gr->gr_passwd = s;
 
-	s = strsep(&result, ":"); /* gid */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* gid */
 	gr->gr_gid = atoi(s);
 
-	s = result;
+	if ((s = result) == NULL) return 0;
 	cp = 0;
 
 	for (m = _gr_group.gr_mem = members; /**/; s++) {
@@ -322,6 +327,8 @@ _gr_breakout_yp(struct group *gr, char *result)
 		}
 	}
 	*m = NULL;
+
+	return 1;
 }
 
 static char *_gr_yp_domain;
@@ -348,9 +355,8 @@ _getypgroup(struct group *gr, const char *name, char *map)
 	if(resultlen >= sizeof resultbuf) return 0;
 	strcpy(resultbuf, result);
 	result = resultbuf;
-	_gr_breakout_yp(gr, resultbuf);
+	return(_gr_breakout_yp(gr, resultbuf));
 
-	return 1;
 }
 
 
@@ -398,9 +404,8 @@ unpack:
 		strcpy(resultbuf, result);
 		free(result);
 		if(result = strchr(resultbuf, '\n')) *result = '\0';
-		_gr_breakout_yp(gr, resultbuf);
+		return(_gr_breakout_yp(gr, resultbuf));
 	}
-	return 1;
 }
 
 #endif /* YP */
diff --git a/lib/libc/gen/getpwent.c b/lib/libc/gen/getpwent.c
index 8b17ca24a892..83ef1ac539c7 100644
--- a/lib/libc/gen/getpwent.c
+++ b/lib/libc/gen/getpwent.c
@@ -492,7 +492,7 @@ struct _namelist *n;
 	_pluscnt = _minuscnt = 0;
 }
 
-static void
+static int
 _pw_breakout_yp(struct passwd *pw, char *result, int master)
 {
 	char *s;
@@ -506,67 +506,73 @@ _pw_breakout_yp(struct passwd *pw, char *result, int master)
 	strcpy(dir, pw->pw_dir); pw->pw_dir = (char *)&dir;
 	strcpy(shell, pw->pw_shell); pw->pw_shell = (char *)&shell;
 
-	s = strsep(&result, ":"); /* name */
+	/*
+	 * XXX Sanity check: make sure all fields are valid (no NULLs).
+	 * If we find a badly formatted entry, we punt.
+	 */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* name */
 	if(!(pw->pw_fields & _PWF_NAME) || (pw->pw_name[0] == '+')) {
 		pw->pw_name = s;
 		pw->pw_fields |= _PWF_NAME;
 	}
 
-	s = strsep(&result, ":"); /* password */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* password */
 	if(!(pw->pw_fields & _PWF_PASSWD)) {
 		pw->pw_passwd = s;
 		pw->pw_fields |= _PWF_PASSWD;
 	}
 
-	s = strsep(&result, ":"); /* uid */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* uid */
 	if(!(pw->pw_fields & _PWF_UID)) {
 		pw->pw_uid = atoi(s);
 		pw->pw_fields |= _PWF_UID;
 	}
 
-	s = strsep(&result, ":"); /* gid */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* gid */
 	if(!(pw->pw_fields & _PWF_GID))  {
 		pw->pw_gid = atoi(s);
 		pw->pw_fields |= _PWF_GID;
 	}
 
 	if (master) {
-		s = strsep(&result, ":"); /* class */
+		if ((s = strsep(&result, ":")) == NULL) return 0; /* class */
 		if(!(pw->pw_fields & _PWF_CLASS))  {
 			pw->pw_class = s;
 			pw->pw_fields |= _PWF_CLASS;
 		}
 
-		s = strsep(&result, ":"); /* change */
+		if ((s = strsep(&result, ":")) == NULL) return 0; /* change */
 		if(!(pw->pw_fields & _PWF_CHANGE))  {
 			pw->pw_change = atol(s);
 			pw->pw_fields |= _PWF_CHANGE;
 		}
 
-		s = strsep(&result, ":"); /* expire */
+		if ((s = strsep(&result, ":")) == NULL) return 0; /* expire */
 		if(!(pw->pw_fields & _PWF_EXPIRE))  {
 			pw->pw_expire = atol(s);
 			pw->pw_fields |= _PWF_EXPIRE;
 		}
 	}
 
-	s = strsep(&result, ":"); /* gecos */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* gecos */
 	if(!(pw->pw_fields & _PWF_GECOS)) {
 		pw->pw_gecos = s;
 		pw->pw_fields |= _PWF_GECOS;
 	}
 
-	s = strsep(&result, ":"); /* dir */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* dir */
 	if(!(pw->pw_fields & _PWF_DIR)) {
 		pw->pw_dir = s;
 		pw->pw_fields |= _PWF_DIR;
 	}
 
-	s = strsep(&result, ":"); /* shell */
+	if ((s = strsep(&result, ":")) == NULL) return 0; /* shell */
 	if(!(pw->pw_fields & _PWF_SHELL)) {
 		pw->pw_shell = s;
 		pw->pw_fields |= _PWF_SHELL;
 	}
+
+	return 1;
 }
 
 static char *_pw_yp_domain;
@@ -574,11 +580,15 @@ static char *_pw_yp_domain;
 static int
 _havemaster(char *_pw_yp_domain)
 {
-	int order;
+	int keylen, resultlen;
+	char *key, *result;
 
-	if (yp_order(_pw_yp_domain, "master.passwd.byname", (int *)&order)) {
+	if (yp_first(_pw_yp_domain, "master.passwd.byname",
+		&key, &keylen, &result, &resultlen)) {
+		free(result);
 		return 0;
 	}
+	free(result);
 	return 1;
 }
 
@@ -651,9 +661,7 @@ _getyppass(struct passwd *pw, const char *name, const char *map)
 	if (_pw_passwd.pw_fields == -1)
 		return(0);
 	result = resultbuf;
-	_pw_breakout_yp(pw, resultbuf, gotmaster);
-
-	return 1;
+	return(_pw_breakout_yp(pw, resultbuf, gotmaster));
 }
 
 static int
@@ -744,9 +752,8 @@ unpack:
 		if (_pw_passwd.pw_fields == -1)
 			goto tryagain;
 		if(result = strchr(resultbuf, '\n')) *result = '\0';
-		_pw_breakout_yp(pw, resultbuf, gotmaster);
+		return(_pw_breakout_yp(pw, resultbuf, gotmaster));
 	}
-	return 1;
 }
 
 #endif /* YP */