[BusyBox] [PATCH] __getgrent.c is broken if GR_SCALE_DYNAMIC is defined

[Jim Treadway]

The internal __getgrent function doesn't allocate enough memory to hold 
the trailing NULL pointer in the gr_mem member of the returned 'struct 
group *'.

The following patch fixes the problem; unfortunately it is against the
older, pre-uClibc version in the uClinux-coldfire distribution, but I
think it will patch fairly painlessly since this file has been largely
unchanged.

As far as I can tell this problem exists in uClibc CVS, busybox.stable, 
and busybox CVS.

Jim


diff -u -r1.1.1.2 __getgrent.c
--- ./lib/libc/getent/__getgrent.c	22 Feb 2002 08:09:26 -0000	1.1.1.2
+++ ./lib/libc/getent/__getgrent.c	13 Apr 2002 04:31:03 -0000
@@ -44,7 +44,7 @@
   static struct group group;
   char * ptr;
   char * field_begin;
-  short member_num;
+  int member_num;
   char * endptr;
   int line_len;
 
@@ -142,25 +142,17 @@
       members[member_num+1]=NULL;
     }
 #else /* !GR_SCALE_DYNAMIC */
-  if (members!=NULL)
-    free (members);
-  members=(char **) malloc(1*sizeof(char *));
-  while ((ptr=strchr(ptr, ','))!=NULL)
-    {
-      *ptr='\0';
-      ptr++;
-      members[member_num]=field_begin;
-      field_begin=ptr;
-      member_num++;
-      members=(char **)realloc((void *)members, (member_num+1)*sizeof(char *));
-    }
-  if (*field_begin=='\0')
-      members[member_num]=NULL;
-  else
-    {
-      members[member_num]=field_begin;
-      members[member_num+1]=NULL;
-    }
+  if (members != NULL)
+	  free(members);
+  members = (char **) malloc((member_num + 1) * sizeof(char *));
+  for ( ; field_begin && *field_begin != '\0'; field_begin = ptr) {
+  	  if ((ptr = strchr(field_begin, ',')) != NULL)
+		  *ptr++ = '\0';
+	  members[member_num++] = field_begin;
+	  members = (char **) realloc(members,
+				      (member_num + 1) * sizeof(char *));
+  }
+  members[member_num] = NULL;
 #endif /* GR_SCALE_DYNAMIC */
 
   group.gr_mem=members;