* libio/fmemopen.c (fmemopen): Free stream memory in case of

	invalid length [Coverity CID 106].

	* nss/nss_files/files-key.c (search): Close stream before
	successful return [Coverity CID 107].

	* io/fts.c (fts_open): Don't allocate parent if *argv==NULL
	[Coverity CID 108].

	* sunrpc/rpc_cout.c (inline_struct): Free sizestr after use
	[Coverity CID 110, 109].

	* sunrpc/rpc_scan.c (docppline): Free file string if it is not
	going to be used [Coverity CID 111].

	* sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 112].

	* nis/nis_clone_dir.c (nis_clone_directory): Free all memory in
	error case [Coverity CID 114].

	* nis/nis_clone_res.c (nis_clone_result): Free all memory in the
	error cases [Coverity CID 115].

	* sunrpc/rpc_parse.c (get_definition): Free defp if tok ==
	TOK_EOF [Coverity CID 116].

	* sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 117].

	* elf/cache.c (save_cache): Initialize pad to avoid writing
	uninitialized data to disk.

	* elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118].

	* intl/finddomain.c (_nl_find_domain): Avoid strdup of expand
	locale name, use strdupa.  Remove free call [Coverity CID 119].

	* sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and
	the resulting leak [Coverity CID 121].

	* sunrpc/rpc_main.c (mkfile_output): Free all allocated memory
	[Coverity CID 122].

	* sunrpc/rpc_main.c (h_output): Free guard after we are done
	[Coverity CID 123].

	* sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation
	fails [Coverity CID 126].

	* sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error
	cases [Coverity CID 127].

	* nis/nis_table.c (__create_ib_request): Free ibreq in case strdup
	fails [Coverity CID 128].

	* nis/nis_getservlist.c (nis_getservlist): Free all memory in case
	of an error [Coverity CID 130, 129].

	* nis/nis_print_group_entry.c (nis_print_group_entry): If
	nis_lookup call failed, return.  Free lookup result in error
	cases [Coverity CID 131].

	* nis/nis_removemember.c (nis_removemember): Free all memory in
	error cases [Coverity CID 132].

	* nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r):
	Always free lookup result [Coverity CID 134].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r):
	Always free lookup result [Coverity CID 135].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r):
	Always free lookup result [Coverity CID 136].

	* nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r):
	Before retrying, free old result [Coverity CID 137].

	* nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user):
	Free res in case UID is zero [Coverity CID 138].

	* nis/ypclnt.c (yp_update): Always free master string
	[Coverity CID 140].

	* nis/nis_creategroup.c (nis_creategroup): Free all memory in
	error cases [Coverity CID 143, 142, 141].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result
	if yp_match call succeeded [Coverity CID 155].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string
	allocated in yp_match at all times [Coverity CID 157, 156].

	* nscd/nscd.c (write_pid): Close stream also if writing failed
	[Coverity CID 165].

	* nis/nis_table.c (nis_add_entry): Move test for NULL parameter
	ahead of first use [Coverity CID 167].

	* nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test
	for NULL parameter ahead of first use [Coverity CID 168].

	* intl/finddomain.c (_nl_find_domain): We never return NULL if we
	found the locale [Coverity CID 169].

	* inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set
	herrno [Coverity CID 178].

	* nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned
	freed object [Coverity CID 182].

32 files changed, 435 insertions, 224 deletions

diff --git a/ChangeLog b/ChangeLog
index eb6642651e..4e50c97615 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,116 @@
+2006-04-06  Ulrich Drepper  <drepper@redhat.com>
+
+	* libio/fmemopen.c (fmemopen): Free stream memory in case of
+	invalid length [Coverity CID 106].
+
+	* nss/nss_files/files-key.c (search): Close stream before
+	successful return [Coverity CID 107].
+
+	* io/fts.c (fts_open): Don't allocate parent if *argv==NULL
+	[Coverity CID 108].
+
+	* sunrpc/rpc_cout.c (inline_struct): Free sizestr after use
+	[Coverity CID 110, 109].
+
+	* sunrpc/rpc_scan.c (docppline): Free file string if it is not
+	going to be used [Coverity CID 111].
+
+	* sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free
+	memory if socket level value cannot be retrieved [Coverity CID 112].
+
+	* nis/nis_clone_dir.c (nis_clone_directory): Free all memory in
+	error case [Coverity CID 114].
+
+	* nis/nis_clone_res.c (nis_clone_result): Free all memory in the
+	error cases [Coverity CID 115].
+
+	* sunrpc/rpc_parse.c (get_definition): Free defp if tok ==
+	TOK_EOF [Coverity CID 116].
+
+	* sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free
+	memory if socket level value cannot be retrieved [Coverity CID 117].
+
+	* elf/cache.c (save_cache): Initialize pad to avoid writing
+	uninitialized data to disk.
+
+	* elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118].
+
+	* intl/finddomain.c (_nl_find_domain): Avoid strdup of expand
+	locale name, use strdupa.  Remove free call [Coverity CID 119].
+
+	* sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and
+	the resulting leak [Coverity CID 121].
+
+	* sunrpc/rpc_main.c (mkfile_output): Free all allocated memory
+	[Coverity CID 122].
+
+	* sunrpc/rpc_main.c (h_output): Free guard after we are done
+	[Coverity CID 123].
+
+	* sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation
+	fails [Coverity CID 126].
+
+	* sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error
+	cases [Coverity CID 127].
+
+	* nis/nis_table.c (__create_ib_request): Free ibreq in case strdup
+	fails [Coverity CID 128].
+
+	* nis/nis_getservlist.c (nis_getservlist): Free all memory in case
+	of an error [Coverity CID 130, 129].
+
+	* nis/nis_print_group_entry.c (nis_print_group_entry): If
+	nis_lookup call failed, return.  Free lookup result in error
+	cases [Coverity CID 131].
+
+	* nis/nis_removemember.c (nis_removemember): Free all memory in
+	error cases [Coverity CID 132].
+
+	* nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r):
+	Always free lookup result [Coverity CID 134].
+
+	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r):
+	Always free lookup result [Coverity CID 135].
+
+	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r):
+	Always free lookup result [Coverity CID 136].
+
+	* nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r):
+	Before retrying, free old result [Coverity CID 137].
+
+	* nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user):
+	Free res in case UID is zero [Coverity CID 138].
+
+	* nis/ypclnt.c (yp_update): Always free master string
+	[Coverity CID 140].
+
+	* nis/nis_creategroup.c (nis_creategroup): Free all memory in
+	error cases [Coverity CID 143, 142, 141].
+
+	* nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result
+	if yp_match call succeeded [Coverity CID 155].
+
+	* nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string
+	allocated in yp_match at all times [Coverity CID 157, 156].
+
+	* nscd/nscd.c (write_pid): Close stream also if writing failed
+	[Coverity CID 165].
+
+	* nis/nis_table.c (nis_add_entry): Move test for NULL parameter
+	ahead of first use [Coverity CID 167].
+
+	* nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test
+	for NULL parameter ahead of first use [Coverity CID 168].
+
+	* intl/finddomain.c (_nl_find_domain): We never return NULL if we
+	found the locale [Coverity CID 169].
+
+	* inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set
+	herrno [Coverity CID 178].
+
+	* nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned
+	freed object [Coverity CID 182].
+
 2006-04-05  Alan Modra  <amodra@bigpond.net.au>
 	    Jakub Jelinek  <jakub@redhat.com>
 
diff --git a/elf/cache.c b/elf/cache.c
index 9462ac1b53..6730fb36eb 100644
--- a/elf/cache.c
+++ b/elf/cache.c
@@ -1,5 +1,4 @@
-/* Copyright (C) 1999,2000,2001,2002,2003,2005
-	Free Software Foundation, Inc.
+/* Copyright (C) 1999-2003,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Andreas Jaeger <aj@suse.de>, 1999.
 
@@ -421,7 +420,7 @@ save_cache (const char *cache_name)
   if (opt_format != 2)
     {
       if (write (fd, file_entries, file_entries_size)
-	  != (ssize_t)file_entries_size)
+	  != (ssize_t) file_entries_size)
 	error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
     }
   if (opt_format != 0)
@@ -430,15 +429,16 @@ save_cache (const char *cache_name)
       if (opt_format != 2)
 	{
 	  char zero[pad];
-	  if (write (fd, zero, pad) != (ssize_t)pad)
+	  memset (zero, '\0', pad);
+	  if (write (fd, zero, pad) != (ssize_t) pad)
 	    error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
 	}
       if (write (fd, file_entries_new, file_entries_new_size)
-	  != (ssize_t)file_entries_new_size)
+	  != (ssize_t) file_entries_new_size)
 	error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
     }
 
-  if (write (fd, strings, total_strlen) != (ssize_t)total_strlen)
+  if (write (fd, strings, total_strlen) != (ssize_t) total_strlen)
     error (EXIT_FAILURE, errno, _("Writing of cache data failed."));
 
   close (fd);
@@ -455,6 +455,7 @@ save_cache (const char *cache_name)
 	   cache_name);
 
   /* Free all allocated memory.  */
+  free (file_entries_new);
   free (file_entries);
   free (strings);
 
diff --git a/inet/getnameinfo.c b/inet/getnameinfo.c
index 493a423c10..5057fd221a 100644
--- a/inet/getnameinfo.c
+++ b/inet/getnameinfo.c
@@ -403,25 +403,16 @@ getnameinfo (const struct sockaddr *sa, socklen_t addrlen, char *host,
 	if (!(flags & NI_NUMERICSERV))
 	  {
 	    struct servent *s, ts;
-	    while (__getservbyport_r (((const struct sockaddr_in *) sa)->sin_port,
-				      ((flags & NI_DGRAM) ? "udp" : "tcp"),
-				      &ts, tmpbuf, tmpbuflen, &s))
+	    int e;
+	    while ((e = __getservbyport_r (((const struct sockaddr_in *) sa)->sin_port,
+					   ((flags & NI_DGRAM)
+					    ? "udp" : "tcp"),
+					   &ts, tmpbuf, tmpbuflen, &s)))
 	      {
-		if (herrno == NETDB_INTERNAL)
-		  {
-		    if (errno == ERANGE)
-		      tmpbuf = extend_alloca (tmpbuf, tmpbuflen,
-					      2 * tmpbuflen);
-		    else
-		      {
-			__set_errno (serrno);
-			return EAI_SYSTEM;
-		      }
-		  }
+		if (e == ERANGE)
+		  tmpbuf = extend_alloca (tmpbuf, tmpbuflen, 2 * tmpbuflen);
 		else
-		  {
-		    break;
-		  }
+		  break;
 	      }
 	    if (s)
 	      {
diff --git a/intl/finddomain.c b/intl/finddomain.c
index 39e54755d2..9806ba12cd 100644
--- a/intl/finddomain.c
+++ b/intl/finddomain.c
@@ -1,5 +1,5 @@
 /* Handle list of needed message catalogs
-   Copyright (C) 1995-1999, 2000, 2001, 2002, 2004
+   Copyright (C) 1995-1999, 2000, 2001, 2002, 2004, 2006
    Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper <drepper@gnu.org>, 1995.
@@ -110,7 +110,7 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
 	    break;
 	}
 
-      return cnt >= 0 ? retval : NULL;
+      return retval;
       /* NOTREACHED */
     }
 
@@ -119,20 +119,7 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
      done.  */
   alias_value = _nl_expand_alias (locale);
   if (alias_value != NULL)
-    {
-#if defined _LIBC || defined HAVE_STRDUP
-      locale = strdup (alias_value);
-      if (locale == NULL)
-	return NULL;
-#else
-      size_t len = strlen (alias_value) + 1;
-      locale = (char *) malloc (len);
-      if (locale == NULL)
-	return NULL;
-
-      memcpy (locale, alias_value, len);
-#endif
-    }
+    locale = strdupa (alias_value);
 
   /* Now we determine the single parts of the locale name.  First
      look for the language.  Termination symbols are `_' and `@' if
@@ -169,10 +156,6 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
 	}
     }
 
-  /* The room for an alias was dynamically allocated.  Free it now.  */
-  if (alias_value != NULL)
-    free (locale);
-
   /* The space for normalized_codeset is dynamically allocated.  Free it.  */
   if (mask & XPG_NORM_CODESET)
     free ((void *) normalized_codeset);
diff --git a/io/fts.c b/io/fts.c
index 2b99206b88..39c076a2c8 100644
--- a/io/fts.c
+++ b/io/fts.c
@@ -93,7 +93,8 @@ fts_open(argv, options, compar)
 	register FTS *sp;
 	register FTSENT *p, *root;
 	register int nitems;
-	FTSENT *parent, *tmp;
+	FTSENT *parent = NULL;
+	FTSENT *tmp;
 
 	/* Options check. */
 	if (options & ~FTS_OPTIONMASK) {
@@ -124,9 +125,11 @@ fts_open(argv, options, compar)
 		goto mem1;
 
 	/* Allocate/initialize root's parent. */
-	if ((parent = fts_alloc(sp, "", 0)) == NULL)
-		goto mem2;
-	parent->fts_level = FTS_ROOTPARENTLEVEL;
+	if (*argv != NULL) {
+		if ((parent = fts_alloc(sp, "", 0)) == NULL)
+			goto mem2;
+		parent->fts_level = FTS_ROOTPARENTLEVEL;
+	  }
 
 	/* Allocate/initialize root(s). */
 	for (root = NULL, nitems = 0; *argv != NULL; ++argv, ++nitems) {
diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index b847f62c9a..f3b280092c 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -1,5 +1,5 @@
 /* Fmemopen implementation.
-   Copyright (C) 2000, 2002, 2005 Free Software Foundation, Inc.
+   Copyright (C) 2000, 2002, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by  Hanno Mueller, kontakt@hanno.de, 2000.
 
@@ -202,7 +202,7 @@ fmemopen (void *buf, size_t len, const char *mode)
   cookie_io_functions_t iof;
   fmemopen_cookie_t *c;
 
-  if (len == 0)
+  if (__builtin_expect (len == 0, 0))
     {
     einval:
       __set_errno (EINVAL);
@@ -227,8 +227,11 @@ fmemopen (void *buf, size_t len, const char *mode)
     }
   else
     {
-      if ((uintptr_t) len > -(uintptr_t) buf)
-	goto einval;
+      if (__builtin_expect ((uintptr_t) len > -(uintptr_t) buf, 0))
+	{
+	  free (c);
+	  goto einval;
+	}
 
       c->buffer = buf;
     }
diff --git a/nis/nis_checkpoint.c b/nis/nis_checkpoint.c
index 0146d53054..23c4707b6f 100644
--- a/nis/nis_checkpoint.c
+++ b/nis/nis_checkpoint.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -24,7 +24,7 @@
 #include "nis_intern.h"
 
 nis_result *
-nis_checkpoint(const_nis_name dirname)
+nis_checkpoint (const_nis_name dirname)
 {
   nis_result *res;
 
@@ -48,7 +48,6 @@ nis_checkpoint(const_nis_name dirname)
       if (__type_of (NIS_RES_OBJECT (res2)) != NIS_DIRECTORY_OBJ)
 	{
 	  nis_freeresult (res2);
-	  nis_freeresult (res);
 	  NIS_RES_STATUS (res) = NIS_INVALIDOBJ;
 	  return res;
 	}
diff --git a/nis/nis_clone_dir.c b/nis/nis_clone_dir.c
index 92e883fde9..f94a1eeb74 100644
--- a/nis/nis_clone_dir.c
+++ b/nis/nis_clone_dir.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -29,15 +29,24 @@ nis_clone_directory (const directory_obj *src, directory_obj *dest)
   char *addr;
   unsigned int size;
   XDR xdrs;
-  directory_obj *res;
 
   if (src == NULL)
-    return (NULL);
+    return NULL;
 
   size = xdr_sizeof ((xdrproc_t)_xdr_directory_obj, (char *)src);
   if ((addr = calloc(1, size)) == NULL)
     return NULL;
 
+  xdrmem_create(&xdrs, addr, size, XDR_ENCODE);
+  if (!_xdr_directory_obj (&xdrs, (directory_obj *)src))