* nis/nis_table.c: Fix realloc handling.

	* nis/nis_removemember.c: Likewise.

3 files changed, 17 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index 52e7117608..f12c8ab21b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2005-04-29  Ulrich Drepper  <drepper@redhat.com>
+
+	* nis/nis_table.c: Fix realloc handling.
+	* nis/nis_removemember.c: Likewise.
+
 2005-04-28  Ulrich Drepper  <drepper@redhat.com>
 
 	[BZ #798]
diff --git a/nis/nis_removemember.c b/nis/nis_removemember.c
index b9e27ab48c..122c3022ff 100644
--- a/nis/nis_removemember.c
+++ b/nis/nis_removemember.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2004 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2004, 2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -92,9 +92,13 @@ nis_removemember (const_nis_name member, const_nis_name group)
       /* This realloc() call always decreases the size.  This cannot
 	 fail.  We still have the test but do not recover memory
 	 (i.e., we overwrite the input pointer).  */
-      newmem = realloc (newmem, k * sizeof (char*));
-      if (newmem == NULL)
-	return NIS_NOMEMORY;
+      nis_name *newp = realloc (newmem, k * sizeof (char*));
+      if (newp == NULL)
+	{
+	  free (newmem);
+	  return NIS_NOMEMORY;
+	}
+      newmem = newp;
 
       NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_val = newmem;
       NIS_RES_OBJECT (res)->GR_data.gr_members.gr_members_len = k;
diff --git a/nis/nis_table.c b/nis/nis_table.c
index 13acdfdf50..2531a3fbc5 100644
--- a/nis/nis_table.c
+++ b/nis/nis_table.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2003, 2004 Free Software Foundation, Inc.
+/* Copyright (c) 1997,1998,1999,2003,2004,2005 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1997.
 
@@ -94,9 +94,10 @@ __create_ib_request (const_nis_name name, unsigned int flags)
       if ((search_len + 1) >= size)
         {
           size += 1;
-          search_val = realloc (search_val, size * sizeof (nis_attr));
-	  if (search_val == NULL)
+	  nis_attr *newp = realloc (search_val, size * sizeof (nis_attr));
+	  if (newp == NULL)
 	    goto free_null;
+	  search_val = newp;
 	}
       search_val[search_len].zattr_ndx = strdup (key);
       if ((search_val[search_len].zattr_ndx) == NULL)