[PATCH] nss: Add missing failure check to __nss_database_get (bug 28940)

[DJ Delorie]

[sorry for the delay]

Florian Weimer <fweimer@redhat.com> writes:
>> This fix is obvious, but at the moment, there are two places that need
>> fixing:
>>
>>   local = nss_database_state_get ();
>>
>>   result = __nss_action_parse (service_line);
>>   if (result == NULL)
>>     return -1;
>>
>>   atomic_store_release (&local->data.reload_disabled, 1);
>
> Hmm.  You mean we should check the return value of
> nss_database_state_get () there as well?

No, I meant that __nss_action_parse is called twice in the file, and
neither has a check.

>> As this depends (sort of) on the contents of /etc/nsswitch.conf, should
>> this test be run in a container where the contents of that can be
>> controlled?
>
> I think we get more interesting results if we don't run in a container.
>
> For example, my user is supplied by sssd.

We get more *random* results, sure.  I'm worried that some results would
be false positives if the user's system doesn't happen to trigger the
bug.