* libio/fmemopen.c (fmemopen): Free stream memory in case of

	invalid length [Coverity CID 106].

	* nss/nss_files/files-key.c (search): Close stream before
	successful return [Coverity CID 107].

	* io/fts.c (fts_open): Don't allocate parent if *argv==NULL
	[Coverity CID 108].

	* sunrpc/rpc_cout.c (inline_struct): Free sizestr after use
	[Coverity CID 110, 109].

	* sunrpc/rpc_scan.c (docppline): Free file string if it is not
	going to be used [Coverity CID 111].

	* sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 112].

	* nis/nis_clone_dir.c (nis_clone_directory): Free all memory in
	error case [Coverity CID 114].

	* nis/nis_clone_res.c (nis_clone_result): Free all memory in the
	error cases [Coverity CID 115].

	* sunrpc/rpc_parse.c (get_definition): Free defp if tok ==
	TOK_EOF [Coverity CID 116].

	* sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free
	memory if socket level value cannot be retrieved [Coverity CID 117].

	* elf/cache.c (save_cache): Initialize pad to avoid writing
	uninitialized data to disk.

	* elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118].

	* intl/finddomain.c (_nl_find_domain): Avoid strdup of expand
	locale name, use strdupa.  Remove free call [Coverity CID 119].

	* sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and
	the resulting leak [Coverity CID 121].

	* sunrpc/rpc_main.c (mkfile_output): Free all allocated memory
	[Coverity CID 122].

	* sunrpc/rpc_main.c (h_output): Free guard after we are done
	[Coverity CID 123].

	* sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation
	fails [Coverity CID 126].

	* sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error
	cases [Coverity CID 127].

	* nis/nis_table.c (__create_ib_request): Free ibreq in case strdup
	fails [Coverity CID 128].

	* nis/nis_getservlist.c (nis_getservlist): Free all memory in case
	of an error [Coverity CID 130, 129].

	* nis/nis_print_group_entry.c (nis_print_group_entry): If
	nis_lookup call failed, return.  Free lookup result in error
	cases [Coverity CID 131].

	* nis/nis_removemember.c (nis_removemember): Free all memory in
	error cases [Coverity CID 132].

	* nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r):
	Always free lookup result [Coverity CID 134].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r):
	Always free lookup result [Coverity CID 135].

	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r):
	Always free lookup result [Coverity CID 136].

	* nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r):
	Before retrying, free old result [Coverity CID 137].

	* nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user):
	Free res in case UID is zero [Coverity CID 138].

	* nis/ypclnt.c (yp_update): Always free master string
	[Coverity CID 140].

	* nis/nis_creategroup.c (nis_creategroup): Free all memory in
	error cases [Coverity CID 143, 142, 141].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result
	if yp_match call succeeded [Coverity CID 155].

	* nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string
	allocated in yp_match at all times [Coverity CID 157, 156].

	* nscd/nscd.c (write_pid): Close stream also if writing failed
	[Coverity CID 165].

	* nis/nis_table.c (nis_add_entry): Move test for NULL parameter
	ahead of first use [Coverity CID 167].

	* nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test
	for NULL parameter ahead of first use [Coverity CID 168].

	* intl/finddomain.c (_nl_find_domain): We never return NULL if we
	found the locale [Coverity CID 169].

	* inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set
	herrno [Coverity CID 178].

	* nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned
	freed object [Coverity CID 182].

32 files changed, 435 insertions, 224 deletions

diff --git a/ChangeLog b/ChangeLog
index eb66426..4e50c97 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,116 @@
+2006-04-06  Ulrich Drepper  <drepper@redhat.com>
+
+	* libio/fmemopen.c (fmemopen): Free stream memory in case of
+	invalid length [Coverity CID 106].
+
+	* nss/nss_files/files-key.c (search): Close stream before
+	successful return [Coverity CID 107].
+
+	* io/fts.c (fts_open): Don't allocate parent if *argv==NULL
+	[Coverity CID 108].
+
+	* sunrpc/rpc_cout.c (inline_struct): Free sizestr after use
+	[Coverity CID 110, 109].
+
+	* sunrpc/rpc_scan.c (docppline): Free file string if it is not
+	going to be used [Coverity CID 111].
+
+	* sysdeps/unix/sysv/linux/getsourcefilter.c (getsourcefilter): Free
+	memory if socket level value cannot be retrieved [Coverity CID 112].
+
+	* nis/nis_clone_dir.c (nis_clone_directory): Free all memory in
+	error case [Coverity CID 114].
+
+	* nis/nis_clone_res.c (nis_clone_result): Free all memory in the
+	error cases [Coverity CID 115].
+
+	* sunrpc/rpc_parse.c (get_definition): Free defp if tok ==
+	TOK_EOF [Coverity CID 116].
+
+	* sysdeps/unix/sysv/linux/setsourcefilter.c (setsourcefilter): Free
+	memory if socket level value cannot be retrieved [Coverity CID 117].
+
+	* elf/cache.c (save_cache): Initialize pad to avoid writing
+	uninitialized data to disk.
+
+	* elf/cache.c (save_cache): Free file_entries_new [Coverity CID 118].
+
+	* intl/finddomain.c (_nl_find_domain): Avoid strdup of expand
+	locale name, use strdupa.  Remove free call [Coverity CID 119].
+
+	* sunrpc/rpc_main.c (generate_guard): Avoid extra allocation and
+	the resulting leak [Coverity CID 121].
+
+	* sunrpc/rpc_main.c (mkfile_output): Free all allocated memory
+	[Coverity CID 122].
+
+	* sunrpc/rpc_main.c (h_output): Free guard after we are done
+	[Coverity CID 123].
+
+	* sunrpc/svc_udp.c (cache_set): Free victim if newbuf allocation
+	fails [Coverity CID 126].
+
+	* sunrpc/svc_udp.c (svcudp_enablecache): Free memory in error
+	cases [Coverity CID 127].
+
+	* nis/nis_table.c (__create_ib_request): Free ibreq in case strdup
+	fails [Coverity CID 128].
+
+	* nis/nis_getservlist.c (nis_getservlist): Free all memory in case
+	of an error [Coverity CID 130, 129].
+
+	* nis/nis_print_group_entry.c (nis_print_group_entry): If
+	nis_lookup call failed, return.  Free lookup result in error
+	cases [Coverity CID 131].
+
+	* nis/nis_removemember.c (nis_removemember): Free all memory in
+	error cases [Coverity CID 132].
+
+	* nis/nss_nisplus/nisplus-alias.c (_nss_nisplus_getaliasbyname_r):
+	Always free lookup result [Coverity CID 134].
+
+	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_gethostton_r):
+	Always free lookup result [Coverity CID 135].
+
+	* nis/nss_nisplus/nisplus-ethers.c (_nss_nisplus_getntohost_r):
+	Always free lookup result [Coverity CID 136].
+
+	* nis/nss_nisplus/nisplus-network.c (_nss_nisplus_getnetbyaddr_r):
+	Before retrying, free old result [Coverity CID 137].
+
+	* nis/nss_nisplus/nisplus-publickey.c (_nss_nisplus_netname2user):
+	Free res in case UID is zero [Coverity CID 138].
+
+	* nis/ypclnt.c (yp_update): Always free master string
+	[Coverity CID 140].
+
+	* nis/nis_creategroup.c (nis_creategroup): Free all memory in
+	error cases [Coverity CID 143, 142, 141].
+
+	* nis/nss_nis/nis-publickey.c (_nss_nis_getpublickey): Free result
+	if yp_match call succeeded [Coverity CID 155].
+
+	* nis/nss_nis/nis-publickey.c (_nss_nis_getsecretkey): Free string
+	allocated in yp_match at all times [Coverity CID 157, 156].
+
+	* nscd/nscd.c (write_pid): Close stream also if writing failed
+	[Coverity CID 165].
+
+	* nis/nis_table.c (nis_add_entry): Move test for NULL parameter
+	ahead of first use [Coverity CID 167].
+
+	* nis/nss_nis/nis-alias.c (_nss_nis_getaliasbyname_r): Move test
+	for NULL parameter ahead of first use [Coverity CID 168].
+
+	* intl/finddomain.c (_nl_find_domain): We never return NULL if we
+	found the locale [Coverity CID 169].
+
+	* inet/getnameinfo.c (getnameinfo): __getservbyport_r does not set
+	herrno [Coverity CID 178].
+
+	* nis/nis_checkpoint.c (nis_checkpoint): Don't access and returned
+	freed object [Coverity CID 182].
+
 2006-04-05  Alan Modra  <amodra@bigpond.net.au>
 	    Jakub Jelinek  <jakub@redhat.com>
 
diff --git a/elf/cache.c b/elf/cache.c
index 9462ac1..6730fb3 100644
--- a/elf/cache.c
+++ b/elf/cache.c
@@ -1,5 +1,4 @@
-/* Copyright (C) 1999,2000,2001,2002,2003,2005
-	Free Software Foundation, Inc.
+/* Copyright (C) 1999-2003,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Andreas Jaeger <aj@suse.de>, 1999.
 
@@ -421,7 +420,7 @@ save_cache (const char *cache_name)
   if (opt_format != 2)
     {
       if (write (fd, file_entries, file_entries_size)
-	  != (ssize_t)file_entries_size)
+	  != (ssize_t) file_entries_size)
 	error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
     }
   if (opt_format != 0)
@@ -430,15 +429,16 @@ save_cache (const char *cache_name)
       if (opt_format != 2)
 	{
 	  char zero[pad];
-	  if (write (fd, zero, pad) != (ssize_t)pad)
+	  memset (zero, '\0', pad);
+	  if (write (fd, zero, pad) != (ssize_t) pad)
 	    error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
 	}
       if (write (fd, file_entries_new, file_entries_new_size)
-	  != (ssize_t)file_entries_new_size)
+	  != (ssize_t) file_entries_new_size)
 	error (EXIT_FAILURE, errno, _("Writing of cache data failed"));
     }
 
-  if (write (fd, strings, total_strlen) != (ssize_t)total_strlen)
+  if (write (fd, strings, total_strlen) != (ssize_t) total_strlen)
     error (EXIT_FAILURE, errno, _("Writing of cache data failed."));
 
   close (fd);
@@ -455,6 +455,7 @@ save_cache (const char *cache_name)
 	   cache_name);
 
   /* Free all allocated memory.  */
+  free (file_entries_new);
   free (file_entries);
   free (strings);
 
diff --git a/inet/getnameinfo.c b/inet/getnameinfo.c
index 493a423..5057fd2 100644
--- a/inet/getnameinfo.c
+++ b/inet/getnameinfo.c
@@ -403,25 +403,16 @@ getnameinfo (const struct sockaddr *sa, socklen_t addrlen, char *host,
 	if (!(flags & NI_NUMERICSERV))
 	  {
 	    struct servent *s, ts;
-	    while (__getservbyport_r (((const struct sockaddr_in *) sa)->sin_port,
-				      ((flags & NI_DGRAM) ? "udp" : "tcp"),
-				      &ts, tmpbuf, tmpbuflen, &s))
+	    int e;
+	    while ((e = __getservbyport_r (((const struct sockaddr_in *) sa)->sin_port,
+					   ((flags & NI_DGRAM)
+					    ? "udp" : "tcp"),
+					   &ts, tmpbuf, tmpbuflen, &s)))
 	      {
-		if (herrno == NETDB_INTERNAL)
-		  {
-		    if (errno == ERANGE)
-		      tmpbuf = extend_alloca (tmpbuf, tmpbuflen,
-					      2 * tmpbuflen);
-		    else
-		      {
-			__set_errno (serrno);
-			return EAI_SYSTEM;
-		      }
-		  }
+		if (e == ERANGE)
+		  tmpbuf = extend_alloca (tmpbuf, tmpbuflen, 2 * tmpbuflen);
 		else
-		  {
-		    break;
-		  }
+		  break;
 	      }
 	    if (s)
 	      {
diff --git a/intl/finddomain.c b/intl/finddomain.c
index 39e5475..9806ba1 100644
--- a/intl/finddomain.c
+++ b/intl/finddomain.c
@@ -1,5 +1,5 @@
 /* Handle list of needed message catalogs
-   Copyright (C) 1995-1999, 2000, 2001, 2002, 2004
+   Copyright (C) 1995-1999, 2000, 2001, 2002, 2004, 2006
    Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Written by Ulrich Drepper <drepper@gnu.org>, 1995.
@@ -110,7 +110,7 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
 	    break;
 	}
 
-      return cnt >= 0 ? retval : NULL;
+      return retval;
       /* NOTREACHED */
     }
 
@@ -119,20 +119,7 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
      done.  */
   alias_value = _nl_expand_alias (locale);
   if (alias_value != NULL)
-    {
-#if defined _LIBC || defined HAVE_STRDUP
-      locale = strdup (alias_value);
-      if (locale == NULL)
-	return NULL;
-#else
-      size_t len = strlen (alias_value) + 1;
-      locale = (char *) malloc (len);
-      if (locale == NULL)
-	return NULL;
-
-      memcpy (locale, alias_value, len);
-#endif
-    }
+    locale = strdupa (alias_value);
 
   /* Now we determine the single parts of the locale name.  First
      look for the language.  Termination symbols are `_' and `@' if
@@ -169,10 +156,6 @@ _nl_find_domain (dirname, locale, domainname, domainbinding)
 	}
     }
 
-  /* The room for an alias was dynamically allocated.  Free it now.  */
-  if (alias_value != NULL)
-    free (locale);
-
   /* The space for normalized_codeset is dynamically allocated.  Free it.  */
   if (mask & XPG_NORM_CODESET)
     free ((void *) normalized_codeset);
diff --git a/io/fts.c b/io/fts.c
index 2b99206..39c076a 100644
--- a/io/fts.c
+++ b/io/fts.c
@@ -93,7 +93,8 @@ fts_open(argv, options, compar)
 	register FTS *sp;
 	register FTSENT *p, *root;
 	register int nitems;
-	FTSENT *parent, *tmp;
+	FTSENT *parent = NULL;
+	FTSENT *tmp;
 
 	/* Options check. */
 	if (options & ~FTS_OPTIONMASK) {
@@ -124,9 +125,11 @@ fts_open(argv, options, compar)
 		goto mem1;
 
 	/* Allocate/initialize root's parent. */
-	if ((parent = fts_alloc(sp, "", 0)) == NULL)
-		goto mem2;
-	parent->fts_level = FTS_ROOTPARENTLEVEL;
+	if (*argv != NULL) {
+		if ((parent = fts_alloc(sp, "", 0)) == NULL)
+			goto mem2;
+		parent->fts_level = FTS_ROOTPARENTLEVEL;
+	  }
 
 	/* Allocate/initialize root(s). */
 	for (root = NULL, nitems = 0; *argv != NULL; ++argv, ++nitems) {
diff --git a/libio/fmemopen.c b/libio/fmemopen.c
index b847f62..f3b2800 100644
--- a/libio/fmemopen.c
+++ b/libio/fmemopen.c
@@ -1,5 +1,5 @@
 /* Fmemopen implementation.
-   Copyright (C) 2000, 2002, 2005 Free Software Foundation, Inc.
+   Copyright (C) 2000, 2002, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by  Hanno Mueller, kontakt@hanno.de, 2000.
 
@@ -202,7 +202,7 @@ fmemopen (void *buf, size_t len, const char *mode)
   cookie_io_functions_t iof;
   fmemopen_cookie_t *c;
 
-  if (len == 0)
+  if (__builtin_expect (len == 0, 0))
     {
     einval:
       __set_errno (EINVAL);
@@ -227,8 +227,11 @@ fmemopen (void *buf, size_t len, const char *mode)
     }
   else
     {
-      if ((uintptr_t) len > -(uintptr_t) buf)
-	goto einval;
+      if (__builtin_expect ((uintptr_t) len > -(uintptr_t) buf, 0))
+	{
+	  free (c);
+	  goto einval;
+	}
 
       c->buffer = buf;
     }
diff --git a/nis/nis_checkpoint.c b/nis/nis_checkpoint.c
index 0146d53..23c4707 100644
--- a/nis/nis_checkpoint.c
+++ b/nis/nis_checkpoint.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -24,7 +24,7 @@
 #include "nis_intern.h"
 
 nis_result *
-nis_checkpoint(const_nis_name dirname)
+nis_checkpoint (const_nis_name dirname)
 {
   nis_result *res;
 
@@ -48,7 +48,6 @@ nis_checkpoint(const_nis_name dirname)
       if (__type_of (NIS_RES_OBJECT (res2)) != NIS_DIRECTORY_OBJ)
 	{
 	  nis_freeresult (res2);
-	  nis_freeresult (res);
 	  NIS_RES_STATUS (res) = NIS_INVALIDOBJ;
 	  return res;
 	}
diff --git a/nis/nis_clone_dir.c b/nis/nis_clone_dir.c
index 92e883f..f94a1ee 100644
--- a/nis/nis_clone_dir.c
+++ b/nis/nis_clone_dir.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -29,15 +29,24 @@ nis_clone_directory (const directory_obj *src, directory_obj *dest)
   char *addr;
   unsigned int size;
   XDR xdrs;
-  directory_obj *res;
 
   if (src == NULL)
-    return (NULL);
+    return NULL;
 
   size = xdr_sizeof ((xdrproc_t)_xdr_directory_obj, (char *)src);
   if ((addr = calloc(1, size)) == NULL)
     return NULL;
 
+  xdrmem_create(&xdrs, addr, size, XDR_ENCODE);
+  if (!_xdr_directory_obj (&xdrs, (directory_obj *)src))
+    {
+      xdr_destroy (&xdrs);
+      free (addr);
+      return NULL;
+    }
+  xdr_destroy (&xdrs);
+
+  directory_obj *res;
   if (dest == NULL)
     {
       if ((res = calloc (1, sizeof (directory_obj))) == NULL)
@@ -49,18 +58,12 @@ nis_clone_directory (const directory_obj *src, directory_obj *dest)
   else
     res = dest;
 
-  xdrmem_create(&xdrs, addr, size, XDR_ENCODE);
-  if (!_xdr_directory_obj (&xdrs, (directory_obj *)src))
-    {
-      xdr_destroy (&xdrs);
-      free (addr);
-      return NULL;
-    }
-  xdr_destroy (&xdrs);
   xdrmem_create (&xdrs, addr, size, XDR_DECODE);
   if (!_xdr_directory_obj (&xdrs, res))
     {
       xdr_destroy (&xdrs);
+      if (res != dest)
+	free (res);
       free (addr);
       return NULL;
     }
diff --git a/nis/nis_clone_res.c b/nis/nis_clone_res.c
index a0e098c..021f7cb 100644
--- a/nis/nis_clone_res.c
+++ b/nis/nis_clone_res.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 2005, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -29,7 +29,6 @@ nis_clone_result (const nis_result *src, nis_result *dest)
   char *addr;
   unsigned int size;
   XDR xdrs;
-  nis_result *res;
 
   if (src == NULL)
     return (NULL);
@@ -38,6 +37,16 @@ nis_clone_result (const nis_result *src, nis_result *dest)
   if ((addr = calloc(1, size)) == NULL)
     return NULL;
 
+  xdrmem_create (&xdrs, addr, size, XDR_ENCODE);
+  if (!_xdr_nis_result (&xdrs, (nis_result *)src))
+    {
+      xdr_destroy (&xdrs);
+      free (addr);
+      return NULL;
+    }
+  xdr_destroy (&xdrs);
+
+  nis_result *res;
   if (dest == NULL)
     {
       if ((res = calloc (1, sizeof (nis_result))) == NULL)
@@ -49,18 +58,12 @@ nis_clone_result (const nis_result *src, nis_result *dest)
   else
     res = dest;
 
-  xdrmem_create(&xdrs, addr, size, XDR_ENCODE);
-  if (!_xdr_nis_result (&xdrs, (nis_result *)src))
-    {
-      xdr_destroy (&xdrs);
-      free (addr);
-      return NULL;
-    }
-  xdr_destroy (&xdrs);
-  xdrmem_create(&xdrs, addr, size, XDR_DECODE);
-  if (!_xdr_nis_result(&xdrs, res))
+  xdrmem_create (&xdrs, addr, size, XDR_DECODE);
+  if (!_xdr_nis_result (&xdrs, res))
     {
       xdr_destroy (&xdrs);
+      if (res != dest)
+	free (res);
       free (addr);
       return NULL;
     }
diff --git a/nis/nis_creategroup.c b/nis/nis_creategroup.c
index 3786461..a7808ab 100644
--- a/nis/nis_creategroup.c
+++ b/nis/nis_creategroup.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2000, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1997.
 
@@ -46,7 +46,7 @@ nis_creategroup (const_nis_name group, unsigned int flags)
       else
 	return NIS_BADNAME;
 
-      obj = malloc (sizeof (nis_object));
+      obj = calloc (1, sizeof (nis_object));
       if (__builtin_expect (obj == NULL, 0))
 	return NIS_NOMEMORY;
 
@@ -57,7 +57,13 @@ nis_creategroup (const_nis_name group, unsigned int flags)
       obj->zo_domain = strdup (domainbuf);
       if (obj->zo_name == NULL || obj->zo_owner == NULL
 	  || obj->zo_group == NULL || obj->zo_domain == NULL)
-	return NIS_NOMEMORY;
+	{
+	  free (obj->zo_group);
+	  free (obj->zo_owner);
+	  free (obj->zo_name);
+	  free (obj);
+	  return NIS_NOMEMORY;
+	}
       obj->zo_access = __nis_default_access (NULL, 0);
       obj->zo_ttl = 60 * 60;
       obj->zo_data.zo_type = NIS_GROUP_OBJ;
@@ -66,11 +72,11 @@ nis_creategroup (const_nis_name group, unsigned int flags)
       obj->zo_data.objdata_u.gr_data.gr_members.gr_members_val = NULL;
 
       res = nis_add (buf, obj);
+      nis_free_object (obj);
       if (res == NULL)
 	return NIS_NOMEMORY;
       status = NIS_RES_STATUS (res);
       nis_freeresult (res);
-      nis_free_object (obj);
 
       return status;
     }
diff --git a/nis/nis_getservlist.c b/nis/nis_getservlist.c
index 315960c..bea9d4d 100644
--- a/nis/nis_getservlist.c
+++ b/nis/nis_getservlist.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2000 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 1999, 2000, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -40,7 +40,10 @@ nis_getservlist (const_nis_name dir)
 	malloc (sizeof (nis_server *) *
 		(NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len + 1));
       if (__builtin_expect (serv == NULL, 0))
-	return NULL;
+	{
+	  nis_freeresult (res);
+	  return NULL;
+	}
 
       for (i = 0; i < NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_len;
 	   ++i)
@@ -49,13 +52,37 @@ nis_getservlist (const_nis_name dir)
 	    &NIS_RES_OBJECT (res)->DI_data.do_servers.do_servers_val[i];
 	  serv[i] = calloc (1, sizeof (nis_server));
 	  if (__builtin_expect (serv[i] == NULL, 0))
-	    return NULL;
+	    {
+	    free_all:
+	      while (i-- > 0)
+		{
+		  free (serv[i]->pkey.n_bytes);
+		  if (serv[i]->ep.ep_val != NULL)
+		    {
+		      unsigned long int j;
+		      for (j = 0; j < serv[i]->ep.ep_len; ++j)
+			{
+			  free (serv[i]->ep.ep_val[j].proto);
+			  free (serv[i]->ep.ep_val[j].family);
+			  free (serv[i]->ep.ep_val[j].uaddr);
+			}
+		      free (serv[i]->ep.ep_val);
+		    }
+		  free (serv[i]->name);
+		  free (serv[i]);
+		}
+
+	      return NULL;
+	    }
 
 	  if (server->name != NULL)
 	    {
 	      serv[i]->name = strdup (server->name);
 	      if (__builtin_expect (serv[i]->name == NULL, 0))
-		return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
 	    }
 
           serv[i]->ep.ep_len = server->ep.ep_len;
@@ -66,7 +93,10 @@ nis_getservlist (const_nis_name dir)
               serv[i]->ep.ep_val =
 		malloc (server->ep.ep_len * sizeof (endpoint));
 	      if (__builtin_expect (serv[i]->ep.ep_val == NULL, 0))
-		return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
 
               for (j = 0; j < serv[i]->ep.ep_len; ++j)
                 {
@@ -87,20 +117,20 @@ nis_getservlist (const_nis_name dir)
 		    serv[i]->ep.ep_val[j].proto = NULL;
                 }
             }
-          else
-	    serv[i]->ep.ep_val = NULL;
+
           serv[i]->key_type = server->key_type;
           serv[i]->pkey.n_len = server->pkey.n_len;
           if (server->pkey.n_len > 0)
             {
               serv[i]->pkey.n_bytes = malloc (server->pkey.n_len);
               if (__builtin_expect (serv[i]->pkey.n_bytes == NULL, 0))
-                return NULL;
+		{
+		  ++i;
+		  goto free_all;
+		}
               memcpy (serv[i]->pkey.n_bytes, server->pkey.n_bytes,
                       server->pkey.n_len);
             }
-          else
-            serv[i]->pkey.n_bytes = NULL;
         }
       serv[i] = NULL;
     }
diff --git a/nis/nis_print_group_entry.c b/nis/nis_print_group_entry.c
index 6f0ba8f..91e6399 100644
--- a/nis/nis_print_group_entry.c
+++ b/nis/nis_print_group_entry.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 2000, 2004 Free Software Foundation, Inc.
+/* Copyright (c) 1997, 1998, 2000, 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -45,12 +45,16 @@ nis_print_group_entry (const_nis_name group)
 	}
       res = nis_lookup (buf, FOLLOW_LINKS | EXPAND_NAME);
 
-      if (NIS_RES_STATUS(res) != NIS_SUCCESS)
+      if (res == NULL)
 	return;
 
-      if ((NIS_RES_NUMOBJ (res) != 1) ||
-	  (__type_of (NIS_RES_OBJECT (res)) != NIS_GROUP_OBJ))
-	return;
+      if (NIS_RES_STATUS (res) != NIS_SUCCESS
+	  || NIS_RES_NUMOBJ (res) != 1
+	  || __type_of (NIS_RES_OBJECT (res)) != NIS_GROUP_OBJ)
+	{
+	  nis_freeresult (res);
+	  return;
+	}
 
       char *mem_exp[NIS_RES_NUMOBJ (res)];
       char *mem_imp[NIS_RES_NUMOBJ (res)];
diff --git a/nis/nis_removemember.c b/nis/nis_removemember.c
index 122c302..21fe13a 100644
--- a/nis/nis_removemember.c
+++ b/nis/nis_removemember.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1998, 1999, 2004, 2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997,1998,1999,2004,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1997.
 
@@ -68,7 +68,10 @@ nis_removemember (const_nis_name member, const_nis_name group)
 	calloc (NIS_RES_OBJECT(res)->GR_data.gr_members.gr_members_len,
 		sizeof (char *));
       if (newmem == NULL)
-	return NIS_NOMEMORY;
+	{
+	  nis_freeresult (res);
+	  return NIS_NOMEMORY;
+	}
 
       k = NIS_RES_OBJECT (res)[0].GR_data.gr_members.gr_members_len;
       j = 0;
@@ -96,6 +99,7 @@ nis_removemember (const_nis_name member, const_nis_name group)
       if (newp == NULL)
 	{
 	  free (newmem);
+	  nis_freeresult (res);
 	  return NIS_NOMEMORY;
 	}
       newmem = newp;
diff --git a/nis/nis_table.c b/nis/nis_table.c
index 2ef28ac..f56b499 100644
--- a/nis/nis_table.c
+++ b/nis/nis_table.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997,1998,1999,2003,2004,2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997-1999,2003,2004,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1997.
 
@@ -41,7 +41,15 @@ __create_ib_request (const_nis_name name, unsigned int flags)
 
   /* Not of "[key=value,key=value,...],foo.." format? */
   if (cptr[0] != '[')
-    return (ibreq->ibr_name = strdup (cptr)) == NULL ? NULL : ibreq;
+    {
+      ibreq->ibr_name = strdup (cptr);
+      if (ibreq->ibr_name == NULL)
+	{
+	  free (ibreq);
+	  return NULL;
+	}
+      return ibreq;
+    }
 
   /* "[key=value,...],foo" format */
   ibreq->ibr_name = strchr (cptr, ']');
@@ -497,15 +505,7 @@ libnsl_hidden_def (nis_list)
 nis_result *
 nis_add_entry (const_nis_name name, const nis_object *obj2, unsigned int flags)
 {
-  nis_object obj;
-  nis_result *res;
-  nis_error status;
-  ib_request *ibreq;
-  size_t namelen = strlen (name);
-  char buf1[namelen + 20];
-  char buf4[namelen + 20];
-
-  res = calloc (1, sizeof (nis_result));
+  nis_result *res = calloc (1, sizeof (nis_result));
   if (res == NULL)
     return NULL;
 
@@ -515,12 +515,18 @@ nis_add_entry (const_nis_name name, const nis_object *obj2, unsigned int flags)
       return res;
     }
 
-  if ((ibreq = __create_ib_request (name, flags)) == NULL)
+  size_t namelen = strlen (name);
+  char buf1[namelen + 20];
+  char buf4[namelen + 20];
+
+  ib_request *ibreq = __create_ib_request (name, flags);
+  if (ibreq == NULL)
     {
       NIS_RES_STATUS (res) = NIS_BADNAME;
       return res;
     }
 
+  nis_object obj;
   memcpy (&obj, obj2, sizeof (nis_object));
 
   if (obj.zo_name == NULL || strlen (obj.zo_name) == 0)
@@ -543,11 +549,12 @@ nis_add_entry (const_nis_name name, const nis_object *obj2, unsigned int flags)
     }
   ibreq->ibr_obj.ibr_obj_len = 1;
 
-  if ((status = __do_niscall (ibreq->ibr_name, NIS_IBADD,
-			      (xdrproc_t) _xdr_ib_request,
-			      (caddr_t) ibreq,
-			      (xdrproc_t) _xdr_nis_result,
-			      (caddr_t) res, 0, NULL)) != NIS_SUCCESS)
+  nis_error status = __do_niscall (ibreq->ibr_name, NIS_IBADD,
+				   (xdrproc_t) _xdr_ib_request,
+				   (caddr_t) ibreq,
+				   (xdrproc_t) _xdr_nis_result,
+				   (caddr_t) res, 0, NULL);
+  if (status  != NIS_SUCCESS)
     NIS_RES_STATUS (res) = status;
 
   nis_free_request (ibreq);
diff --git a/nis/nss_nis/nis-alias.c b/nis/nss_nis/nis-alias.c
index 3b0887b..1da999b 100644
--- a/nis/nss_nis/nis-alias.c
+++ b/nis/nss_nis/nis-alias.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-2002, 2003 Free Software Foundation, Inc.
+/* Copyright (C) 1996-2002, 2003, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@vt.uni-paderborn.de>, 1996.
 
@@ -206,32 +206,29 @@ enum nss_status
 _nss_nis_getaliasbyname_r (const char *name, struct aliasent *alias,
 			   char *buffer, size_t buflen, int *errnop)
 {
-  enum nss_status retval;
-  int parse_res;
-  char *domain;
-  char *result;
-  int len;
-  char *p;
-  size_t namlen = strlen (name);
-  char name2[namlen + 1];
-  size_t i;
-
   if (name == NULL)
     {
       *errnop = EINVAL;
       return NSS_STATUS_UNAVAIL;
     }
 
+  size_t namlen = strlen (name);
+  char name2[namlen + 1];
+
+  char *domain;
   if (yp_get_default_domain (&domain))
     return NSS_STATUS_UNAVAIL;
 
   /* Convert name to lowercase.  */
+  size_t i;
   for (i = 0; i < namlen; ++i)
     name2[i] = _tolower (name[i]);
   name2[i] = '\0';
 
-  retval = yperr2nss (yp_match (domain, "mail.aliases", name2, namlen,
-				&result, &len));
+  char *result;
+  int len;
+  enum nss_status retval = yperr2nss (yp_match (domain, "mail.aliases", name2,
+						namlen, &result, &len));
 
   if (retval != NSS_STATUS_SUCCESS)
     {
@@ -247,14 +244,15 @@ _nss_nis_getaliasbyname_r (const char *name, struct aliasent *alias,
       return NSS_STATUS_TRYAGAIN;
     }
 
-  p = strncpy (buffer, result, len);
+  char *p = strncpy (buffer, result, len);
   buffer[len] = '\0';
   while (isspace (*p))
     ++p;
   free (result);
 
   alias->alias_local = 0;
-  parse_res = _nss_nis_parse_aliasent (name, p, alias, buffer, buflen, errnop);
+  int parse_res = _nss_nis_parse_aliasent (name, p, alias, buffer, buflen,
+					   errnop);
   if (parse_res < 1)
     {
       if (parse_res == -1)
diff --git a/nis/nss_nis/nis-publickey.c b/nis/nss_nis/nis-publickey.c
index 5aa41b8..f82db19 100644
--- a/nis/nss_nis/nis-publickey.c
+++ b/nis/nss_nis/nis-publickey.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-1999,2001,2002,2005 Free Software Foundation, Inc.
+/* Copyright (C) 1996-1999,2001,2002,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1996.
 
@@ -73,6 +73,7 @@ _nss_nis_getpublickey (const char *netname, char *pkey, int *errnop)
 	*p = 0;
       strncpy (pkey, result, HEXKEYBYTES + 1);
       pkey[HEXKEYBYTES] = '\0';
+      free (result);
     }
   return NSS_STATUS_SUCCESS;
 }
@@ -115,20 +116,20 @@ _nss_nis_getsecretkey (const char *netname, char *skey, char *passwd,
   if (result != NULL)
     {
       char *p = strchr (result, ':');
-      if (p == NULL)
-	return NSS_STATUS_SUCCESS;
-
-      ++p;
-      strncpy (buf, p, 2 * (HEXKEYBYTES + 1));
-      buf[2 * HEXKEYBYTES + 1] = '\0';
-      if (!xdecrypt (buf, passwd))
-	return NSS_STATUS_SUCCESS;
-
-      if (memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) != 0)
-	return NSS_STATUS_SUCCESS;
-
-      buf[HEXKEYBYTES] = '\0';
-      strcpy (skey, buf);
+      if (p != NULL)
+	{
+	  ++p;
+	  strncpy (buf, p, 2 * (HEXKEYBYTES + 1));
+	  buf[2 * HEXKEYBYTES + 1] = '\0';
+	  if (xdecrypt (buf, passwd)
+	      && memcmp (buf, &(buf[HEXKEYBYTES]), KEYCHECKSUMSIZE) == 0)
+	    {
+	      buf[HEXKEYBYTES] = '\0';
+	      strcpy (skey, buf);
+	    }
+	}
+
+      free (result);
     }
   return NSS_STATUS_SUCCESS;
 }
diff --git a/nis/nss_nisplus/nisplus-alias.c b/nis/nss_nisplus/nisplus-alias.c
index d7926e1..86ea5d7 100644
--- a/nis/nss_nisplus/nisplus-alias.c
+++ b/nis/nss_nisplus/nisplus-alias.c
@@ -304,10 +304,18 @@ _nss_nisplus_getaliasbyname_r (const char *name, struct aliasent *alias,
     }
 
   if (__builtin_expect (niserr2nss (result->status) != NSS_STATUS_SUCCESS, 0))
-    return niserr2nss (result->status);
+    {
+      enum nss_status status = niserr2nss (result->status);
+      nis_freeresult (result);
+      return status;
+    }
 
   parse_res = _nss_nisplus_parse_aliasent (result, 0, alias,
 					   buffer, buflen, errnop);
+
+  /* We do not need the lookup result anymore.  */
+  nis_freeresult (result);
+
   if (__builtin_expect (parse_res < 1, 0))
     {
       __set_errno (olderr);
diff --git a/nis/nss_nisplus/nisplus-ethers.c b/nis/nss_nisplus/nisplus-ethers.c
index ca0a9e2..8b628fc 100644
--- a/nis/nss_nisplus/nisplus-ethers.c
+++ b/nis/nss_nisplus/nisplus-ethers.c
@@ -261,17 +261,18 @@ _nss_nisplus_gethostton_r (const char *name, struct etherent *eth,
 
   int parse_res = _nss_nisplus_parse_etherent (result, eth, buffer,
 					       buflen, errnop);
+
+  /* We do not need the lookup result anymore.  */
+  nis_freeresult (result);
+
   if (__builtin_expect (parse_res < 1, 0))
     {
       __set_errno (olderr);
 
       if (parse_res == -1)
-	{
-	  nis_freeresult (result);
-	  return NSS_STATUS_TRYAGAIN;
-	}
-      else
-	return NSS_STATUS_NOTFOUND;
+	return NSS_STATUS_TRYAGAIN;
+
+      return NSS_STATUS_NOTFOUND;
     }
 
   return NSS_STATUS_SUCCESS;
@@ -326,13 +327,14 @@ _nss_nisplus_getntohost_r (const struct ether_addr *addr, struct etherent *eth,
 
   int parse_res = _nss_nisplus_parse_etherent (result, eth, buffer,
 					       buflen, errnop);
+
+  /* We do not need the lookup result anymore.  */
+  nis_freeresult (result);
+
   if (__builtin_expect (parse_res < 1, 0))
     {
       if (parse_res == -1)
-	{
-	  nis_freeresult (result);
-	  return NSS_STATUS_TRYAGAIN;
-	}
+	return NSS_STATUS_TRYAGAIN;
 
       return NSS_STATUS_NOTFOUND;
     }
diff --git a/nis/nss_nisplus/nisplus-network.c b/nis/nss_nisplus/nisplus-network.c
index 960c055..211e7c3 100644
--- a/nis/nss_nisplus/nisplus-network.c
+++ b/nis/nss_nisplus/nisplus-network.c
@@ -443,6 +443,7 @@ _nss_nisplus_getnetbyaddr_r (uint32_t addr, const int type,
 		   removed (one by one) */
 		buf2[b2len - 2] = '\0';
 		b2len -= 2;
+		nis_freeresult (result);
 		continue;
 	      }
 
diff --git a/nis/nss_nisplus/nisplus-publickey.c b/nis/nss_nisplus/nisplus-publickey.c
index c24e898..24b22d9 100644
--- a/nis/nss_nisplus/nisplus-publickey.c
+++ b/nis/nss_nisplus/nisplus-publickey.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 1997, 1999, 2001, 2003, 2005 Free Software Foundation, Inc.
+/* Copyright (c) 1997,1999,2001,2003,2005,2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1997.
 
@@ -394,6 +394,7 @@ _nss_nisplus_netname2user (char netname[MAXNETNAMELEN + 1], uid_t *uidp,
   if (*uidp == 0)
     {
       syslog (LOG_ERR, _("netname2user: should not have uid 0"));
+      nis_freeresult (res);
       return NSS_STATUS_NOTFOUND;
     }
 
diff --git a/nis/ypclnt.c b/nis/ypclnt.c
index 78adf6a..65bc8d1 100644
--- a/nis/ypclnt.c
+++ b/nis/ypclnt.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1996-2001, 2002, 2003, 2004, 2005
+/* Copyright (C) 1996-2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Thorsten Kukuk <kukuk@suse.de>, 1996.
@@ -955,16 +955,22 @@ yp_update (char *domain, char *map, unsigned ypop,
   args.update_args.datum.yp_buf_len = datalen;
   args.update_args.datum.yp_buf_val = data;
 
-  if ((r = yp_master (domain, map, &master)) != 0)
+  if ((r = yp_master (domain, map, &master)) != YPERR_SUCCESS)
     return r;
 
   if (!host2netname (servername, master, domain))
     {
       fputs (_("yp_update: cannot convert host to netname\n"), stderr);
+      free (master);
       return YPERR_YPERR;
     }
 
-  if ((clnt = clnt_create (master, YPU_PROG, YPU_VERS, "tcp")) == NULL)
+  clnt = clnt_create (master, YPU_PROG, YPU_VERS, "tcp");
+
+  /* We do not need the string anymore.  */
+  free (master);
+
+  if (clnt == NULL)
     {
       clnt_pcreateerror ("yp_update: clnt_create");
       return YPERR_RPC;
diff --git a/nptl/ChangeLog b/nptl/ChangeLog
index 3ad04ed..03572d8 100644
--- a/nptl/ChangeLog
+++ b/nptl/ChangeLog
@@ -1,3 +1,8 @@
+2006-04-06  Ulrich Drepper  <drepper@redhat.com>
+
+	* pthread_getattr_np.c (pthread_getattr_np): Close fp if getrlimit
+	fails [Coverity CID 105].
+
 2006-04-05  Ulrich Drepper  <drepper@redhat.com>
 
 	* sysdeps/pthread/pthread.h: Add nonnull attributes.
diff --git a/nptl/pthread_getattr_np.c b/nptl/pthread_getattr_np.c
index ba720af..4bdc7b5 100644
--- a/nptl/pthread_getattr_np.c
+++ b/nptl/pthread_getattr_np.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2002, 2003, 2004 Free Software Foundation, Inc.
+/* Copyright (C) 2002, 2003, 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@redhat.com>, 2002.
 
@@ -83,51 +83,55 @@ pthread_getattr_np (thread_id, attr)
       if (fp == NULL)
 	ret = errno;
       /* We need the limit of the stack in any case.  */
-      else if (getrlimit (RLIMIT_STACK, &rl) != 0)
-	ret = errno;
       else
 	{
-	  /* We need no locking.  */
-	  __fsetlocking (fp, FSETLOCKING_BYCALLER);
+	  if (getrlimit (RLIMIT_STACK, &rl) != 0)
+	    ret = errno;
+	  else
+	    {
+	      /* We need no locking.  */
+	      __fsetlocking (fp, FSETLOCKING_BYCALLER);
 
-	  /* Until we found an entry (which should always be the case)
-	     mark the result as a failure.  */
-	  ret = ENOENT;
+	      /* Until we found an entry (which should always be the case)
+		 mark the result as a failure.  */
+	      ret = ENOENT;
 
-	  char *line = NULL;
-	  size_t linelen = 0;
-	  uintptr_t last_to = 0;
+	      char *line = NULL;
+	      size_t linelen = 0;
+	      uintptr_t last_to = 0;
 
-	  while (! feof_unlocked (fp))
-	    {
-	      if (__getdelim (&line, &linelen, '\n', fp) <= 0)
-		break;
-
-	      uintptr_t from;
-	      uintptr_t to;
-	      if (sscanf (line, "%" SCNxPTR "-%" SCNxPTR, &from, &to) != 2)
-		continue;
-	      if (from <= (uintptr_t) __libc_stack_end
-		  && (uintptr_t) __libc_stack_end < to)
+	      while (! feof_unlocked (fp))
 		{
-		  /* Found the entry.  Now we have the info we need.  */
-		  iattr->stacksize = rl.rlim_cur;
-		  iattr->stackaddr = (void *) to;
-
-		  /* The limit might be too high.  */
-		  if ((size_t) iattr->stacksize
-		      > (size_t) iattr->stackaddr - last_to)
-		    iattr->stacksize = (size_t) iattr->stackaddr - last_to;
-
-		  /* We succeed and no need to look further.  */
-		  ret = 0;
-		  break;
+		  if (__getdelim (&line, &linelen, '\n', fp) <= 0)
+		    break;
+
+		  uintptr_t from;
+		  uintptr_t to;
+		  if (sscanf (line, "%" SCNxPTR "-%" SCNxPTR, &from, &to) != 2)
+		    continue;
+		  if (from <= (uintptr_t) __libc_stack_end
+		      && (uintptr_t) __libc_stack_end < to)
+		    {
+		      /* Found the entry.  Now we have the info we need.  */
+		      iattr->stacksize = rl.rlim_cur;
+		      iattr->stackaddr = (void *) to;
+
+		      /* The limit might be too high.  */
+		      if ((size_t) iattr->stacksize
+			  > (size_t) iattr->stackaddr - last_to)
+			iattr->stacksize = (size_t) iattr->stackaddr - last_to;
+
+		      /* We succeed and no need to look further.  */
+		      ret = 0;
+		      break;
+		    }
+		  last_to = to;
 		}
-	      last_to = to;
+
+	      free (line);
 	    }
 
 	  fclose (fp);
-	  free (line);
 	}
     }
 
diff --git a/nscd/nscd.c b/nscd/nscd.c
index 8a8e45a..16f55cf 100644
--- a/nscd/nscd.c
+++ b/nscd/nscd.c
@@ -487,10 +487,10 @@ write_pid (const char *file)
     return -1;
 
   fprintf (fp, "%d\n", getpid ());
-  if (fflush (fp) || ferror (fp))
-    return -1;
+
+  int result = fflush (fp) || ferror (fp) ? -1 : 0;
 
   fclose (fp);
 
-  return 0;
+  return result;
 }
diff --git a/nss/nss_files/files-key.c b/nss/nss_files/files-key.c
index f00fc1c..5c7ad09 100644
--- a/nss/nss_files/files-key.c
+++ b/nss/nss_files/files-key.c
@@ -1,5 +1,5 @@
 /* Public key file parser in nss_files module.
-   Copyright (C) 1996, 1997, 1998 Free Software Foundation, Inc.
+   Copyright (C) 1996, 1997, 1998, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -78,6 +78,7 @@ search (const char *netname, char *result, int *errnop, int secret)
 	p = __strtok_r (NULL, ":\n", &save_ptr);
       if (p == NULL)  /* malformed line? */
 	continue;
+      fclose (stream);
       strcpy (result, p);
       return NSS_STATUS_SUCCESS;
     }
diff --git a/sunrpc/rpc_cout.c b/sunrpc/rpc_cout.c
index dfc57fd..21056e8 100644
--- a/sunrpc/rpc_cout.c
+++ b/sunrpc/rpc_cout.c
@@ -551,6 +551,7 @@ inline_struct (definition *def, int flag)
 	    }
 	  size = 0;
 	  i = 0;
+	  free (sizestr);
 	  sizestr = NULL;
 	  print_stat (indent + 1, &dl->decl);
 	}
diff --git a/sunrpc/rpc_main.c b/sunrpc/rpc_main.c
index 2679720..954657a 100644
--- a/sunrpc/rpc_main.c
+++ b/sunrpc/rpc_main.c
@@ -531,7 +531,7 @@ generate_guard (const char *pathname)
 
   filename = strrchr (pathname, '/');	/* find last component */
   filename = ((filename == NULL) ? pathname : filename + 1);
-  guard = strdup (filename);
+  guard = extendfile (filename, "_H_RPCGEN");
   /* convert to upper case */
   tmp = guard;
   while (*tmp)
@@ -541,7 +541,6 @@ generate_guard (const char *pathname)
       tmp++;
     }
 
-  guard = extendfile (guard, "_H_RPCGEN");
   return guard;
 }
 
@@ -661,6 +660,7 @@ h_output (const char *infile, const char *define, int extend,
     }
 
   fprintf (fout, "\n#endif /* !_%s */\n", guard);
+  free (guard);
   close_input ();
   close_output (outfilename);
 }
@@ -946,6 +946,8 @@ clnt_output (const char *infile, const char *define, int extend,
   close_output (outfilename);
 }
 
+static const char space[] = " ";
+
 static char *
 file_name (const char *file, const char *ext)
 {
@@ -954,16 +956,17 @@ file_name (const char *file, const char *ext)
 
   if (access (temp, F_OK) != -1)
     return (temp);
-  else
-    return ((char *) " ");
+
+  free (temp);
+  return (char *) space;
 }
 
 static void
 mkfile_output (struct commandline *cmd)
 {
   char *mkfilename;
-  const char *clientname, *clntname, *xdrname, *hdrname;
-  const char *servername, *svcname, *servprogname, *clntprogname;
+  char *clientname, *clntname, *xdrname, *hdrname;
+  char *servername, *svcname, *servprogname, *clntprogname;
 
   svcname = file_name (cmd->infile, "_svc.c");
   clntname = file_name (cmd->infile, "_clnt.c");
@@ -977,8 +980,8 @@ mkfile_output (struct commandline *cmd)
     }
   else
     {
-      servername = " ";
-      clientname = " ";
+      servername = (char *) space;
+      clientname = (char *) space;
     }
   servprogname = extendfile (cmd->infile, "_server");
   clntprogname = extendfile (cmd->infile, "_client");
@@ -988,6 +991,8 @@ mkfile_output (struct commandline *cmd)
       char *cp, *temp;
 
       mkfilename = alloc (strlen ("Makefile.") + strlen (cmd->infile) + 1);
+      if (mkfilename == NULL)
+	abort ();
       temp = rindex (cmd->infile, '.');
       cp = stpcpy (mkfilename, "Makefile.");
       strncpy (cp, cmd->infile, (temp - cmd->infile));
@@ -1046,6 +1051,23 @@ $(LDLIBS) \n\n");
   f_print (fout, "clean:\n\t $(RM) core $(TARGETS) $(OBJECTS_CLNT) \
 $(OBJECTS_SVC) $(CLIENT) $(SERVER)\n\n");
   close_output (mkfilename);
+
+  free (clntprogname);
+  free (servprogname);
+  if (servername != space)
+    free (servername);
+  if (clientname != space)
+    free (clientname);
+  if (mkfilename != (char *) cmd->outfile)
+    free (mkfilename);
+  if (svcname != space)
+    free (svcname);
+  if (clntname != space)
+    free (clntname);
+  if (xdrname != space)
+    free (xdrname);
+  if (hdrname != space)
+    free (hdrname);
 }
 
 /*
diff --git a/sunrpc/rpc_parse.c b/sunrpc/rpc_parse.c
index 2a29878..9678f28 100644
--- a/sunrpc/rpc_parse.c
+++ b/sunrpc/rpc_parse.c
@@ -91,6 +91,7 @@ get_definition (void)
       def_const (defp);
       break;
     case TOK_EOF:
+      free (defp);
       return (NULL);
     default:
       error ("definition keyword expected");
diff --git a/sunrpc/rpc_scan.c b/sunrpc/rpc_scan.c
index 42ab2ba..af90ef6 100644
--- a/sunrpc/rpc_scan.c
+++ b/sunrpc/rpc_scan.c
@@ -535,6 +535,7 @@ docppline (const char *line, int *lineno, const char **fname)
   *p = 0;
   if (*file == 0)
     {
+      free (file);
       *fname = NULL;
     }
   else
diff --git a/sunrpc/svc_udp.c b/sunrpc/svc_udp.c
index c0c115a..67b84f1 100644
--- a/sunrpc/svc_udp.c
+++ b/sunrpc/svc_udp.c
@@ -485,6 +485,7 @@ svcudp_enablecache (SVCXPRT *transp, u_long size)
   uc->uc_entries = ALLOC (cache_ptr, size * SPARSENESS);
   if (uc->uc_entries == NULL)
     {
+      mem_free (uc, sizeof (struct udp_cache));
       CACHE_PERROR (_("enablecache: could not allocate cache data"));
       return 0;
     }
@@ -492,6 +493,8 @@ svcudp_enablecache (SVCXPRT *transp, u_long size)
   uc->uc_fifo = ALLOC (cache_ptr, size);
   if (uc->uc_fifo == NULL)
     {
+      mem_free (uc->uc_entries, size * SPARSENESS);
+      mem_free (uc, sizeof (struct udp_cache));
       CACHE_PERROR (_("enablecache: could not allocate cache fifo"));
       return 0;
     }
@@ -545,6 +548,7 @@ cache_set (SVCXPRT *xprt, u_long replylen)
       newbuf = mem_alloc (su->su_iosz);
       if (newbuf == NULL)
 	{
+	  mem_free (victim, sizeof (struct cache_node));
 	  CACHE_PERROR (_("cache_set: could not allocate new rpc_buffer"));
 	  return;
 	}
diff --git a/sysdeps/unix/sysv/linux/getsourcefilter.c b/sysdeps/unix/sysv/linux/getsourcefilter.c
index fdcf8d6..a6f89a3 100644
--- a/sysdeps/unix/sysv/linux/getsourcefilter.c
+++ b/sysdeps/unix/sysv/linux/getsourcefilter.c
@@ -1,5 +1,5 @@
 /* Get source filter.  Linux version.
-   Copyright (C) 2004 Free Software Foundation, Inc.
+   Copyright (C) 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@redhat.com>, 2004.
 
@@ -112,23 +112,27 @@ getsourcefilter (int s, uint32_t interface, const struct sockaddr *group,
   gf->gf_numsrc = *numsrc;
 
   /* We need to provide the appropriate socket level value.  */
+  int result;
   int sol = __get_sol (group->sa_family, grouplen);
   if (sol == -1)
     {
       __set_errno (EINVAL);
-      return -1;
+      result = -1;
     }
-
-  int result = __getsockopt (s, sol, MCAST_MSFILTER, gf, &needed);
-
-  /* If successful, copy the results to the places the caller wants
-     them in.  */
-  if (result == 0)
+  else
     {
-      *fmode = gf->gf_fmode;
-      memcpy (slist, gf->gf_slist,
-	      MIN (*numsrc, gf->gf_numsrc) * sizeof (struct sockaddr_storage));
-      *numsrc = gf->gf_numsrc;
+      result = __getsockopt (s, sol, MCAST_MSFILTER, gf, &needed);
+
+      /* If successful, copy the results to the places the caller wants
+	 them in.  */
+      if (result == 0)
+	{
+	  *fmode = gf->gf_fmode;
+	  memcpy (slist, gf->gf_slist,
+		  MIN (*numsrc, gf->gf_numsrc)
+		  * sizeof (struct sockaddr_storage));
+	  *numsrc = gf->gf_numsrc;
+	}
     }
 
   if (! use_alloca)
diff --git a/sysdeps/unix/sysv/linux/setsourcefilter.c b/sysdeps/unix/sysv/linux/setsourcefilter.c
index f5c4d97..dc223de 100644
--- a/sysdeps/unix/sysv/linux/setsourcefilter.c
+++ b/sysdeps/unix/sysv/linux/setsourcefilter.c
@@ -1,5 +1,5 @@
 /* Set source filter.  Linux version.
-   Copyright (C) 2004 Free Software Foundation, Inc.
+   Copyright (C) 2004, 2006 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
    Contributed by Ulrich Drepper <drepper@redhat.com>, 2004.
 
@@ -57,14 +57,15 @@ setsourcefilter (int s, uint32_t interface, const struct sockaddr *group,
   memcpy (gf->gf_slist, slist, numsrc * sizeof (struct sockaddr_storage));
 
   /* We need to provide the appropriate socket level value.  */
+  int result;
   int sol = __get_sol (group->sa_family, grouplen);
   if (sol == -1)
     {
       __set_errno (EINVAL);
-      return -1;
+      result = -1;
     }
-
-  int result = __setsockopt (s, sol, MCAST_MSFILTER, gf, needed);
+  else
+    result = __setsockopt (s, sol, MCAST_MSFILTER, gf, needed);
 
   if (! use_alloca)
     {