[BZ #9781]

	* grp/compat-initgroups.c (compat_call): Switch to use malloc when
	the input line is too long.

1 files changed, 21 insertions, 5 deletions

diff --git a/grp/compat-initgroups.c b/grp/compat-initgroups.c
index efd875a689..374f42a0dc 100644
--- a/grp/compat-initgroups.c
+++ b/grp/compat-initgroups.c
@@ -14,7 +14,6 @@ compat_call (service_user *nip, const char *user, gid_t group, long int *start,
 {
   struct group grpbuf;
   size_t buflen = __sysconf (_SC_GETGR_R_SIZE_MAX);
-  char *tmpbuf;
   enum nss_status status;
   set_function setgrent_fct;
   get_function getgrent_fct;
@@ -35,7 +34,9 @@ compat_call (service_user *nip, const char *user, gid_t group, long int *start,
 
   endgrent_fct = __nss_lookup_function (nip, "endgrent");
 
-  tmpbuf = __alloca (buflen);
+  char *tmpbuf = __alloca (buflen);
+  bool use_malloc = false;
+  enum nss_status result = NSS_STATUS_SUCCESS;
 
   do
     {
@@ -44,8 +45,20 @@ compat_call (service_user *nip, const char *user, gid_t group, long int *start,
 	      status == NSS_STATUS_TRYAGAIN)
 	     && *errnop == ERANGE)
         {
-          buflen *= 2;
-          tmpbuf = __alloca (buflen);
+	  if (__libc_use_alloca (buflen * 2))
+	    tmpbuf = extend_alloca (tmpbuf, buflen, buflen * 2);
+	  else
+	    {
+	      buflen *= 2;
+	      char *newbuf = realloc (use_malloc ? tmpbuf : NULL, buflen);
+	      if (newbuf == NULL)
+		{
+		  result = NSS_STATUS_TRYAGAIN;
+		  goto done;
+		}
+	      use_malloc = true;
+	      tmpbuf = newbuf;
+	    }
         }
 
       if (status != NSS_STATUS_SUCCESS)
@@ -102,8 +115,11 @@ compat_call (service_user *nip, const char *user, gid_t group, long int *start,
   while (status == NSS_STATUS_SUCCESS);
 
  done:
+  if (use_malloc)
+    free (tmpbuf);
+
   if (endgrent_fct)
     DL_CALL_FCT (endgrent_fct, ());
 
-  return NSS_STATUS_SUCCESS;
+  return result;
 }