From the upstream branch fw/extend_alloca.

commit dc79f9aa56933dc8b475209f9a4059965b50ea26

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 18:29:47 2015 +0100

    nscd restart: Use malloc instead of extend_alloca

    This introduces a separate function, read_cmdline, which reads the

    contents of /proc/self/cmdline into a heap-allocated buffer.

    	[BZ #18023]

    	* nscd/connections.c (read_cmdline): New function.

    	(restart): Use it.  Update comment.

commit 9bed8b7fca7867d3027b66ce3985a75136aed013

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 15:14:19 2015 +0100

    getgrent_next_nss (compat-initgroups): Remove alloca fallback

    If the caller-supplied buffer is not large enough, fall back directly

    malloc.

    The previous __libc_use_alloca check was incorrect because it did not

    take into account that extend_alloca may fail to merge allocations, so

    it would underestimate the stack space being used by roughly a factor

    of two.

    	[BZ #18023]

    	* nis/nss_compat/compat-initgroups.c (getgrent_next_nss): Fall

    	back to malloc directly, without stack allocations.

commit c95cc759ecb21f812872934ac55518aef28cf46b

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 16:03:01 2015 +0100

    _dl_map_object_deps: Use struct scratch_buffer instead of extend_alloca

    The function comment suggests that _dl_map_object_deps cannot use

    malloc, but it already allocates the l_initfini array on the heap, so

    the additional allocation should be acceptable.

    	[BZ #18023]

    	* elf/dl-deps.c (_dl_map_object_deps): Use struct

    	scratch_buffer instead of extend_alloca.

commit e38bff4db6f03d1fab732737f43a25160c3e4703

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 16:18:21 2015 +0100

    _nss_nis_initgroups_dyn: Use struct scratch_buffer instead of extend_alloca

    Also adjusts the internal function get_uid.

    	[BZ #18023]

            * nis/nss_nis/nis-initgroups.c (get_uid, _nss_nis_initgroups_dyn):

    	Use struct scratch_buffer instead of extend_alloca.

commit 8825d4709a686a870d313cc602d489ddd5354a08

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 18:55:33 2015 +0100

    nscd: Use struct scratch_buffer instead of extend_alloca in most caches

    This replaces the ERANGE retry loops with loops which have heap

    fallback.  Heap allocation might actually be required for extremely

    large NSS results.

    	[BZ #18023]

    	* nscd/grpcache.c (addgrbyX): Use struct scratch_buffer instead

    	of extend_alloca.

    	* nscd/hstcache.c (addhstbyX): Likewise.

    	* nscd/pwdcache.c (addpwbyX): Likewise.

    	* nscd/servicescache.c (addservbyX): Likewise.

commit 140d8711d446f5193b04b56e714ddf8d0eddbf62

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 18:59:48 2015 +0100

    nscd: Switch to struct scratch_buffer in adhstaiX

    The pre-allocation of the three scratch buffers increased the initial

    stack size somewhat, but if retries are needed, the previous version

    used more stack space if extend_alloca could not merge allocations.

    Lack of alloca accounting also means could be problematic with

    extremely large NSS responses, too.

    	[BZ #18023]

    	* nscd/aicache.c (addhstaiX): Use struct scratch_buffer instead

    	of extend_alloca.

commit 1af14faef808f03276766e5ee6d9ee7dc9053fba

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 19:03:01 2015 +0100

    getent: Switch to struct scratch_buffer in initgroups_keys

    The retry loop is slightly different here because getgrouplist

    provides size information, so scratch_buffer_set_array_size can be

    used to grow the buffer in a more precise fashion.

    	[BZ #18023]

    	* nss/getent.c (initgroups_keys): Use struct scratch_buffer

    	instead of extend_alloca.

commit 9b71d3b4df6dd4e49f7638d1d936c921c50fa3d9

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 19:09:00 2015 +0100

    nss_files: Use struct scratch_buffer instead of extend_alloca

    In both _nss_files_gethostbyname3_r and _nss_files_initgroups_dyn,

    __libc_use_alloca was misused because it was not taken into account

    that extend_alloca can fail to merge allocations.

    	[BZ #18023]

    	* nss/nss_files/files-hosts.c (_nss_files_gethostbyname3_r):

    	Use struct scratch_buffer instead of extend_alloca.

    	* nss/nss_files/files-initgroups.c (_nss_files_initgroups_dyn):

    	Likewise.

commit 11c2a8bad9ca5fe510b73c0204b3dcf703f14d5c

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 19:11:55 2015 +0100

    gethostid (Linux variant): Switch to struct scratch_buffer

    Previously, extend_alloca was used without alloca accounting,

    which could have been problematic with large NSS results.

    	[BZ #18023]

    	* sysdeps/unix/sysv/linux/gethostid.c (gethostid): Use struct

    	scratch_buffer instead of extend_alloca.

commit 6de00dd8a3a76d0b7586393451e65ad6c2721a71

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 19:14:29 2015 +0100

    getlogin_r (Linux variant): Switch to struct scratch_buffer

    This corrects the alloca accounting as a side effect.  It was not off

    if extend_alloca failed to merge allocations.

    	[BZ #18023]

    	* sysdeps/unix/sysv/linux/getlogin_r.c (__getlogin_r_loginuid):

    	Use struct scratch_buffer instead of extend_alloca.

commit 488063238ee5c87b66c6982b1b6d508e30e44386

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 19:48:31 2015 +0100

    wordexp: Rewrite parse_tilde to use struct scratch_buffer

    	[BZ #18023]

    	* posix/wordexp.c (parse_tilde): Use struct scratch_buffer

    	instead of extend_alloca.

commit 683543bbb3e2c1b17554c4096d00c2980f39a802

Author: Florian Weimer <fweimer@redhat.com>

Date:   Sun Mar 1 23:22:45 2015 +0100

    Remove macros extend_alloca, extend_alloca_account [BZ #18023]

    And also the helper macro stackinfo_alloca_round.

    extend_alloca simply does not work on x86_64 and current i386 because

    its peculiar stack alignment rules.

    Here's an analysis of the _dl_fini situation (before the removal of

    extend_alloca).

    Dump of assembler code for function _dl_fini:

    <+0>:	push   %rbp

    <+1>:	mov    %rsp,%rbp

    <+4>:	push   %r15

    <+6>:	push   %r14

    <+8>:	push   %r13

    <+10>:	push   %r12

    <+12>:	push   %rbx

    <+13>:	sub    $0x38,%rsp

    The function pushes 6 registers on the stack and allocates 0x38 bytes,

    which means that %rsp is a multiple of 16 after function prologue.

    The initial alloca allocation does not change %rsp alignment:

    <+210>:	shr    $0x4,%rcx

    <+214>:	shl    $0x4,%rcx

    <+218>:	sub    %rcx,%rsp

    %r15 is the address of the previous stack allocation, it is used below.

    This is the extend_alloca reallocation branch:

    <+734>:	add    $0xf,%rdx

    <+738>:	and    $0xfffffffffffffff0,%rdx

    <+742>:	lea    0x1e(%rdx),%rcx

    <+746>:	shr    $0x4,%rcx

    <+750>:	shl    $0x4,%rcx

    <+754>:	sub    %rcx,%rsp

    <+757>:	lea    0xf(%rsp),%rcx

    <+762>:	and    $0xfffffffffffffff0,%rcx

    <+766>:	lea    (%rcx,%rdx,1),%rsi

    <+770>:	cmp    %rsi,%r15

    <+773>:	je     0x7f963940b673 <_dl_fini+787>

    <+775>:	mov    %rdx,-0x58(%rbp)

    <+787>:	add    %rdx,-0x58(%rbp)

    (a) %rdx, the new requested size, is rounded up to a multiple of 16

    (+734, %+738), and the result is stored in %rdx@738.

    (b) %rdx@738 + 31 is rounded down to a multiple of 16, the result is

    stored in rcx@750 (+742, +746, +750).  So %rcx@750 == %rdx@738 + 16.

    (c) %rcx@750 bytes are allocated on the stack (+754).  %rsp is rounded

    upwards to a multiple of 16, result is stored in %rcx@762 (+757, +762).

    This does not change the value of %rsp because it already was a multiple

    of 16.

    (d) %rsi@766 == %rcx@762 + %rdx@738 is compared against %r15.  But this

    comparison is always false because we allocated 16 extra bytes on the

    stack in (b), which were reserved for the alignment in (c), but in fact

    unused.  We are left with a gap in stack usage, and the comparison is

    always false.

    (@XXX refers to register values after executing the instruction at

    offset +XXX.)

    If the alignment gap was actually used because of different alignment

    for %rsp, then the comparison failure would still occur because the gap

    would not have been added after this reallocation, but before the

    previous allocation.

    As a result, extend_alloca is never able to merge allocations.  It also

    turns out that the interface is difficult to use, especially in

    cojunction with alloca account (which is rarely optional).

    	[BZ #18023]

    	* include/alloca.h (stackinfo_alloca_round, extend_alloca,

    	extend_alloca_account): Remove.

diff --git a/elf/dl-deps.c b/elf/dl-deps.c

index 1b8bac65932a7713..bc59f0ff7b4d7c61 100644

--- a/elf/dl-deps.c

+++ b/elf/dl-deps.c

@@ -27,6 +27,7 @@

 #include <unistd.h>

 #include <sys/param.h>

 #include <ldsodefs.h>

+#include <scratch_buffer.h>

 #include <dl-dst.h>

@@ -184,9 +185,8 @@ _dl_map_object_deps (struct link_map *map,

   /* Pointer to last unique object.  */

   tail = &known[nlist - 1];

-  /* No alloca'd space yet.  */

-  struct link_map **needed_space = NULL;

-  size_t needed_space_bytes = 0;

+  struct scratch_buffer needed_space;

+  scratch_buffer_init (&needed_space);

   /* Process each element of the search list, loading each of its

      auxiliary objects and immediate dependencies.  Auxiliary objects

@@ -217,13 +217,12 @@ _dl_map_object_deps (struct link_map *map,

       if (l->l_searchlist.r_list == NULL && l->l_initfini == NULL

 	  && l != map && l->l_ldnum > 0)

 	{

-	  size_t new_size = l->l_ldnum * sizeof (struct link_map *);

-

-	  if (new_size > needed_space_bytes)

-	    needed_space

-	      = extend_alloca (needed_space, needed_space_bytes, new_size);

-

-	  needed = needed_space;

+	  /* l->l_ldnum includes space for the terminating NULL.  */

+	  if (!scratch_buffer_set_array_size

+	      (&needed_space, l->l_ldnum, sizeof (struct link_map *)))

+	    _dl_signal_error (ENOMEM, map->l_name, NULL,

+			      N_("cannot allocate dependency buffer"));

+	  needed = needed_space.data;

 	}

       if (l->l_info[DT_NEEDED] || l->l_info[AUXTAG] || l->l_info[FILTERTAG])

@@ -463,8 +462,11 @@ _dl_map_object_deps (struct link_map *map,

 	  struct link_map **l_initfini = (struct link_map **)

 	    malloc ((2 * nneeded + 1) * sizeof needed[0]);

 	  if (l_initfini == NULL)

-	    _dl_signal_error (ENOMEM, map->l_name, NULL,

-			      N_("cannot allocate dependency list"));

+	    {

+	      scratch_buffer_free (&needed_space);

+	      _dl_signal_error (ENOMEM, map->l_name, NULL,

+				N_("cannot allocate dependency list"));

+	    }

 	  l_initfini[0] = l;

 	  memcpy (&l_initfini[1], needed, nneeded * sizeof needed[0]);

 	  memcpy (&l_initfini[nneeded + 1], l_initfini,

@@ -482,6 +484,8 @@ _dl_map_object_deps (struct link_map *map,

     }

  out:

+  scratch_buffer_free (&needed_space);

+

   if (errno == 0 && errno_saved != 0)

     __set_errno (errno_saved);

diff --git a/include/alloca.h b/include/alloca.h

index fd90664f0a17cd6d..c0b83954436ed4c1 100644

--- a/include/alloca.h

+++ b/include/alloca.h

@@ -23,57 +23,17 @@ libc_hidden_proto (__libc_alloca_cutoff)

 #include <allocalim.h>

-#ifndef stackinfo_alloca_round

-# define stackinfo_alloca_round(l) (((l) + 15) & -16)

-#endif

-

-#if _STACK_GROWS_DOWN

-# define extend_alloca(buf, len, newlen) \

-  (__typeof (buf)) ({ size_t __newlen = stackinfo_alloca_round (newlen);      \

-		      char *__newbuf = __alloca (__newlen);		      \

-		      if (__newbuf + __newlen == (char *) (buf))	      \

-			len += __newlen;				      \

-		      else						      \

-			len = __newlen;					      \

-		      __newbuf; })

-#elif _STACK_GROWS_UP

-# define extend_alloca(buf, len, newlen) \

-  (__typeof (buf)) ({ size_t __newlen = stackinfo_alloca_round (newlen);      \

-		      char *__newbuf = __alloca (__newlen);		      \

-		      char *__buf = (char *) (buf);			      \

-		      if (__buf + len == __newbuf)			      \

-			{						      \

-			  len += __newlen;				      \

-			  __newbuf = __buf;				      \

-			}						      \

-		      else						      \

-			len = __newlen;					      \

-		      __newbuf; })

-#else

-# define extend_alloca(buf, len, newlen) \

-  __alloca (((len) = (newlen)))

-#endif

-

 #if defined stackinfo_get_sp && defined stackinfo_sub_sp

 # define alloca_account(size, avar) \

   ({ void *old__ = stackinfo_get_sp ();					      \

      void *m__ = __alloca (size);					      \

      avar += stackinfo_sub_sp (old__);					      \

      m__; })

-# define extend_alloca_account(buf, len, newlen, avar) \

-  ({ void *old__ = stackinfo_get_sp ();					      \

-     void *m__ = extend_alloca (buf, len, newlen);			      \

-     avar += stackinfo_sub_sp (old__);					      \

-     m__; })

 #else

 # define alloca_account(size, avar) \

   ({ size_t s__ = (size);						      \

      avar += s__;							      \

      __alloca (s__); })

-# define extend_alloca_account(buf, len, newlen, avar) \

-  ({ size_t s__ = (newlen);						      \

-     avar += s__;							      \

-     extend_alloca (buf, len, s__); })

 #endif

 # endif /* !_ISOMAC */

diff --git a/nis/nss_compat/compat-initgroups.c b/nis/nss_compat/compat-initgroups.c

index 1b37e0c295f481df..cc3db7889ba289db 100644

--- a/nis/nss_compat/compat-initgroups.c

+++ b/nis/nss_compat/compat-initgroups.c

@@ -310,7 +310,6 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,

 		 overwrite the pointer with one to a bigger buffer.  */

 	      char *tmpbuf = buffer;

 	      size_t tmplen = buflen;

-	      bool use_malloc = false;

 	      for (int i = 0; i < mystart; i++)

 		{

@@ -319,29 +318,26 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,

 			 == NSS_STATUS_TRYAGAIN

 			 && *errnop == ERANGE)

                     {

-                      if (__libc_use_alloca (tmplen * 2))

-                        {

-                          if (tmpbuf == buffer)

-                            {

-                              tmplen *= 2;

-                              tmpbuf = __alloca (tmplen);

-                            }

-                          else

-                            tmpbuf = extend_alloca (tmpbuf, tmplen, tmplen * 2);

-                        }

-                      else

-                        {

-                          tmplen *= 2;

-                          char *newbuf = realloc (use_malloc ? tmpbuf : NULL, tmplen);

-

-                          if (newbuf == NULL)

-                            {

-                              status = NSS_STATUS_TRYAGAIN;

-			      goto done;

-                            }

-                          use_malloc = true;

-                          tmpbuf = newbuf;

-                        }

+		      /* Check for overflow. */

+		      if (__glibc_unlikely (tmplen * 2 < tmplen))

+			{

+			  __set_errno (ENOMEM);

+			  status = NSS_STATUS_TRYAGAIN;

+			  goto done;

+			}

+		      /* Increase the size.  Make sure that we retry

+			 with a reasonable size.  */

+		      tmplen *= 2;

+		      if (tmplen < 1024)

+			tmplen = 1024;

+		      if (tmpbuf != buffer)

+			free (tmpbuf);

+		      tmpbuf = malloc (tmplen);

+		      if (__glibc_unlikely (tmpbuf == NULL))

+			{

+			  status = NSS_STATUS_TRYAGAIN;

+			  goto done;

+			}

                     }

 		  if (__builtin_expect  (status != NSS_STATUS_NOTFOUND, 1))

@@ -369,7 +365,7 @@ getgrent_next_nss (ent_t *ent, char *buffer, size_t buflen, const char *user,

 	      status = NSS_STATUS_NOTFOUND;

  done:

-	      if (use_malloc)

+	      if (tmpbuf != buffer)

 	        free (tmpbuf);

 	    }

diff --git a/nis/nss_nis/nis-initgroups.c b/nis/nss_nis/nis-initgroups.c

index 3784c101f7ee31aa..c872b32e15f55e3d 100644

--- a/nis/nss_nis/nis-initgroups.c

+++ b/nis/nss_nis/nis-initgroups.c

@@ -16,7 +16,6 @@

    License along with the GNU C Library; if not, see

    <http://www.gnu.org/licenses/>.  */

-#include <alloca.h>

 #include <ctype.h>

 #include <errno.h>

 #include <grp.h>

@@ -27,6 +26,7 @@

 #include <rpcsvc/yp.h>

 #include <rpcsvc/ypclnt.h>

 #include <sys/param.h>

+#include <scratch_buffer.h>

 #include "nss-nis.h"

 #include <libnsl.h>

@@ -120,27 +120,30 @@ internal_getgrent_r (struct group *grp, char *buffer, size_t buflen,

 static int

 get_uid (const char *user, uid_t *uidp)

 {

-  size_t buflen = sysconf (_SC_GETPW_R_SIZE_MAX);

-  char *buf = (char *) alloca (buflen);

+  struct scratch_buffer tmpbuf;

+  scratch_buffer_init (&tmpbuf);

   while (1)

     {

       struct passwd result;

       struct passwd *resp;

-      int r = getpwnam_r (user, &result, buf, buflen, &resp);

+      int r = getpwnam_r (user, &result, tmpbuf.data, tmpbuf.length, &resp);

       if (r == 0 && resp != NULL)

 	{

 	  *uidp = resp->pw_uid;

+	  scratch_buffer_free (&tmpbuf);

 	  return 0;

 	}

       if (r != ERANGE)

 	break;

-      buf = extend_alloca (buf, buflen, 2 * buflen);

+      if (!scratch_buffer_grow (&tmpbuf))

+	return 1;

     }

+  scratch_buffer_free (&tmpbuf);

   return 1;

 }

@@ -254,8 +257,6 @@ _nss_nis_initgroups_dyn (const char *user, gid_t group, long int *start,

     }

   struct group grpbuf, *g;

-  size_t buflen = sysconf (_SC_GETPW_R_SIZE_MAX);

-  char *tmpbuf;

   enum nss_status status;

   intern_t intern = { NULL, NULL, 0 };

   gid_t *groups = *groupsp;

@@ -264,15 +265,21 @@ _nss_nis_initgroups_dyn (const char *user, gid_t group, long int *start,

   if (status != NSS_STATUS_SUCCESS)

     return status;

-  tmpbuf = __alloca (buflen);

+  struct scratch_buffer tmpbuf;

+  scratch_buffer_init (&tmpbuf);

   while (1)

     {

       while ((status =

-	      internal_getgrent_r (&grpbuf, tmpbuf, buflen, errnop,

+	      internal_getgrent_r (&grpbuf, tmpbuf.data, tmpbuf.length, errnop,

 				   &intern)) == NSS_STATUS_TRYAGAIN

              && *errnop == ERANGE)

-	tmpbuf = extend_alloca (tmpbuf, buflen, 2 * buflen);

+	if (!scratch_buffer_grow (&tmpbuf))

+	  {

+	    status = NSS_STATUS_TRYAGAIN;

+	    *errnop = errno;

+	    goto done;

+	  }

       if (status != NSS_STATUS_SUCCESS)

 	{

@@ -331,6 +338,7 @@ done:

       intern.start = intern.start->next;

       free (intern.next);

     }

+  scratch_buffer_free (&tmpbuf);

   return status;

 }

diff --git a/nscd/aicache.c b/nscd/aicache.c

index 7bf4131979451040..ea29b1c3d99bb530 100644

--- a/nscd/aicache.c

+++ b/nscd/aicache.c

@@ -27,6 +27,7 @@

 #include <sys/mman.h>

 #include <resolv/resolv-internal.h>

 #include <resolv/res_hconf.h>

+#include <scratch_buffer.h>

 #include "dbg_log.h"

 #include "nscd.h"

@@ -113,10 +114,13 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

   int old_res_options = _res.options;

   _res.options &= ~DEPRECATED_RES_USE_INET6;

-  size_t tmpbuf6len = 1024;

-  char *tmpbuf6 = alloca (tmpbuf6len);

-  size_t tmpbuf4len = 0;

-  char *tmpbuf4 = NULL;

+  struct scratch_buffer tmpbuf6;

+  scratch_buffer_init (&tmpbuf6);

+  struct scratch_buffer tmpbuf4;

+  scratch_buffer_init (&tmpbuf4);

+  struct scratch_buffer canonbuf;

+  scratch_buffer_init (&canonbuf);

+

   int32_t ttl = INT32_MAX;

   ssize_t total = 0;

   char *key_copy = NULL;

@@ -129,6 +133,7 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

       int status[2] = { NSS_STATUS_UNAVAIL, NSS_STATUS_UNAVAIL };

       int naddrs = 0;

       size_t addrslen = 0;

+

       char *canon = NULL;

       size_t canonlen;

@@ -143,12 +148,17 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

 	      at = &atmem;

 	      rc6 = 0;

 	      herrno = 0;

-	      status[1] = DL_CALL_FCT (fct4, (key, &at, tmpbuf6, tmpbuf6len,

+	      status[1] = DL_CALL_FCT (fct4, (key, &at,

+					      tmpbuf6.data, tmpbuf6.length,

 					      &rc6, &herrno, &ttl));

 	      if (rc6 != ERANGE || (herrno != NETDB_INTERNAL

 				    && herrno != TRY_AGAIN))

 		break;

-	      tmpbuf6 = extend_alloca (tmpbuf6, tmpbuf6len, 2 * tmpbuf6len);

+	      if (!scratch_buffer_grow (&tmpbuf6))

+		{

+		  rc6 = ENOMEM;

+		  break;

+		}

 	    }

 	  if (rc6 != 0 && herrno == NETDB_INTERNAL)

@@ -226,41 +236,38 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

 	  while (1)

 	    {

 	      rc6 = 0;

-	      status[0] = DL_CALL_FCT (fct, (key, AF_INET6, &th[0], tmpbuf6,

-					     tmpbuf6len, &rc6, &herrno, &ttl,

+	      status[0] = DL_CALL_FCT (fct, (key, AF_INET6, &th[0],

+					     tmpbuf6.data, tmpbuf6.length,

+					     &rc6, &herrno, &ttl,

 					     &canon));

 	      if (rc6 != ERANGE || herrno != NETDB_INTERNAL)

 		break;

-	      tmpbuf6 = extend_alloca (tmpbuf6, tmpbuf6len, 2 * tmpbuf6len);

+	      if (!scratch_buffer_grow (&tmpbuf6))

+		{

+		  rc6 = ENOMEM;

+		  break;

+		}

 	    }

 	  if (rc6 != 0 && herrno == NETDB_INTERNAL)

 	    goto out;

-	  /* If the IPv6 lookup has been successful do not use the

-	     buffer used in that lookup, use a new one.  */

-	  if (status[0] == NSS_STATUS_SUCCESS && rc6 == 0)

-	    {

-	      tmpbuf4len = 512;

-	      tmpbuf4 = alloca (tmpbuf4len);

-	    }

-	  else

-	    {

-	      tmpbuf4len = tmpbuf6len;

-	      tmpbuf4 = tmpbuf6;

-	    }

-

 	  /* Next collect IPv4 information.  */

 	  while (1)

 	    {

 	      rc4 = 0;

-	      status[1] = DL_CALL_FCT (fct, (key, AF_INET, &th[1], tmpbuf4,

-					     tmpbuf4len, &rc4, &herrno,

+	      status[1] = DL_CALL_FCT (fct, (key, AF_INET, &th[1],

+					     tmpbuf4.data, tmpbuf4.length,

+					     &rc4, &herrno,

 					     ttl == INT32_MAX ? &ttl : NULL,

 					     canon == NULL ? &canon : NULL));

 	      if (rc4 != ERANGE || herrno != NETDB_INTERNAL)

 		break;

-	      tmpbuf4 = extend_alloca (tmpbuf4, tmpbuf4len, 2 * tmpbuf4len);

+	      if (!scratch_buffer_grow (&tmpbuf4))

+		{

+		  rc4 = ENOMEM;

+		  break;

+		}

 	    }

 	  if (rc4 != 0 && herrno == NETDB_INTERNAL)

@@ -286,13 +293,11 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

 	      cfct = __nss_lookup_function (nip, "getcanonname_r");

 	      if (cfct != NULL)

 		{

-		  const size_t max_fqdn_len = 256;

-		  char *buf = alloca (max_fqdn_len);

 		  char *s;

 		  int rc;

-		  if (DL_CALL_FCT (cfct, (key, buf, max_fqdn_len, &s,

-					  &rc, &herrno))

+		  if (DL_CALL_FCT (cfct, (key, canonbuf.data, canonbuf.length,

+					  &s, &rc, &herrno))

 		      == NSS_STATUS_SUCCESS)

 		    canon = s;

 		  else

@@ -321,18 +326,20 @@ addhstaiX (struct database_dyn *db, int fd, request_header *req,

 		      addrfamily = AF_INET6;

 		    }

-		  size_t tmpbuflen = 512;

-		  char *tmpbuf = alloca (tmpbuflen);

 		  int rc;

 		  while (1)

 		    {

 		      rc = __gethostbyaddr2_r (addr, addrlen, addrfamily,

-					       &hstent_mem, tmpbuf, tmpbuflen,

+					       &hstent_mem,

+					       canonbuf.data, canonbuf.length,

 					       &hstent, &herrno, NULL);

 		      if (rc != ERANGE || herrno != NETDB_INTERNAL)

 			break;

-		      tmpbuf = extend_alloca (tmpbuf, tmpbuflen,

-					      tmpbuflen * 2);

+		      if (!scratch_buffer_grow (&canonbuf))

+			{

+			  rc = ENOMEM;

+			  break;

+			}

 		    }

 		  if (rc == 0)

@@ -560,6 +567,10 @@ next_nip:

 	dh->usable = false;

     }

+  scratch_buffer_free (&tmpbuf6);

+  scratch_buffer_free (&tmpbuf4);

+  scratch_buffer_free (&canonbuf);

+

   return timeout;

 }

diff --git a/nscd/connections.c b/nscd/connections.c

index 26d2c0091b8f320d..9615c159285f0044 100644

--- a/nscd/connections.c

+++ b/nscd/connections.c

@@ -1353,64 +1353,83 @@ request from '%s' [%ld] not handled due to missing permission"),

     }

 }