BZ#17460: Fix buffer overrun in nscd --help.

ChangeLog

@@ -1,3 +1,11 @@
+2014-10-08  Roland McGrath  <roland@hack.frob.com>
+
+	[BZ #17460]
+	* nscd/nscd.c (more_help): Rewrite list of tables collection
+	using xstrdup and asprintf.
+
+	* nscd/nscd_conf.c: Remove local xstrdup declaration.
+
 2014-10-08  Kostya Serebryany  <konstantin.s.serebryany@gmail.com>
 	    Roland McGrath  <roland@hack.frob.com>
 

NEWS

@@ -9,7 +9,7 @@ Version 2.21
 
 * The following bugs are resolved with this release:
 
-  6652, 14171, 17266, 17363, 17370, 17371, 17411.
+  6652, 14171, 17266, 17363, 17370, 17371, 17411, 17460.
 
 Version 2.20
 

nscd/nscd.c

@@ -451,23 +451,25 @@ parse_opt (int key, char *arg, struct argp_state *state)
 static char *
 more_help (int key, const char *text, void *input)
 {
-  char *tables, *tp = NULL;
-
   switch (key)
     {
     case ARGP_KEY_HELP_EXTRA:
       {
-	dbtype cnt;
-
-	tables = xmalloc (sizeof (dbnames) + 1);
-	for (cnt = 0; cnt < lastdb; cnt++)
-	  {
-	    strcat (tables, dbnames[cnt]);
-	    strcat (tables, " ");
-	  }
-      }
-
 	/* We print some extra information.  */
+
+	char *tables = xstrdup (dbnames[0]);
+	for (dbtype i = 1; i < lastdb; ++i)
+	  {
+	    char *more_tables;
+	    if (asprintf (&more_tables, "%s %s", tables, dbnames[i]) < 0)
+	      more_tables = NULL;
+	    free (tables);
+	    if (more_tables == NULL)
+	      return NULL;
+	    tables = more_tables;
+	  }
+
+	char *tp;
 	if (asprintf (&tp, gettext ("\
 Supported tables:\n\
 %s\n\
@@ -478,6 +480,7 @@ For bug reporting instructions, please see:\n\
 	  tp = NULL;
 	free (tables);
 	return tp;
+      }
 
     default:
       break;

nscd/nscd_conf.c

@@ -32,9 +32,6 @@
 #include "dbg_log.h"
 #include "nscd.h"
 
-/* Wrapper functions with error checking for standard functions.  */
-extern char *xstrdup (const char *s);
-
 
 /* Names of the databases.  */
 const char *const dbnames[lastdb] =