autofs-5.0.4-easy-alloca-replacements.patch

   1 autofs-5.0.4 - easy alloca replacements
   2
   3 From: Valerie Aurora Henson <vaurora@redhat.com>
   4
   5 alloca() is compiler-dependent, non-standard, and has undefined
   6 behavior when it fails (IOW, the program crashes).  Replace with
   7 normal C stack variables where possible and malloc() where not.
   8 ---
   9
  10  daemon/automount.c       |   29 ++++++--------
  11  daemon/direct.c          |   12 ++----
  12  daemon/flag.c            |   13 +++---
  13  daemon/indirect.c        |   12 ++----
  14  daemon/module.c          |   45 +++++++---------------
  15  lib/cache.c              |   31 +++++----------
  16  lib/cat_path.c           |    1
  17  modules/lookup_file.c    |   82 +++++++++++++----------------------------
  18  modules/lookup_ldap.c    |   93 +++++++++++++++++++++++++++++-----------------
  19  modules/lookup_nisplus.c |   71 ++++++++++++++++++++---------------
  20  modules/mount_autofs.c   |    1
  21  modules/mount_bind.c     |    7 +--
  22  modules/mount_changer.c  |    5 --
  23  modules/mount_ext2.c     |    5 --
  24  modules/mount_generic.c  |    5 --
  25  15 files changed, 184 insertions(+), 228 deletions(-)
  26
  27
  28 diff --git a/daemon/automount.c b/daemon/automount.c
  29 index e20e7c9..269fc5b 100644
  30 --- a/daemon/automount.c
  31 +++ b/daemon/automount.c
  32 @@ -127,8 +127,8 @@ static int do_mkdir(const char *parent, const char *path, mode_t mode)
  33
  34  int mkdir_path(const char *path, mode_t mode)
  35  {
  36 -       char *buf = alloca(strlen(path) + 1);
  37 -       char *parent = alloca(strlen(path) + 1);
  38 +       char buf[PATH_MAX];
  39 +       char parent[PATH_MAX];
  40         const char *cp = path, *lcp = path;
  41         char *bp = buf, *pp = parent;
  42
  43 @@ -163,7 +163,7 @@ int mkdir_path(const char *path, mode_t mode)
  44  int rmdir_path(struct autofs_point *ap, const char *path, dev_t dev)
  45  {
  46         int len = strlen(path);
  47 -       char *buf = alloca(len + 1);
  48 +       char buf[PATH_MAX];
  49         char *cp;
  50         int first = 1;
  51         struct stat st;
  52 @@ -468,20 +468,17 @@ static int umount_subtree_mounts(struct autofs_point *ap, const char *path, unsi
  53         pthread_cleanup_push(cache_lock_cleanup, mc);
  54
  55         if (me->multi) {
  56 -               char *root, *base;
  57 -               size_t ap_len;
  58 +               char root[PATH_MAX];
  59 +               char *base;
  60                 int cur_state;
  61
  62 -               ap_len = strlen(ap->path);
  63 -
  64 -               if (!strchr(me->multi->key, '/')) {
  65 +               if (!strchr(me->multi->key, '/'))
  66                         /* Indirect multi-mount root */
  67 -                       root = alloca(ap_len + strlen(me->multi->key) + 2);
  68 -                       strcpy(root, ap->path);
  69 -                       strcat(root, "/");
  70 -                       strcat(root, me->multi->key);
  71 -               } else
  72 -                       root = me->multi->key;
  73 +                       /* sprintf okay - if it's mounted, it's
  74 +                        * PATH_MAX or less bytes */
  75 +                       sprintf(root, "%s/%s", ap->path, me->multi->key);
  76 +               else
  77 +                       strcpy(root, me->multi->key);
  78
  79                 if (is_mm_root)
  80                         base = NULL;
  81 @@ -929,14 +926,14 @@ static int get_pkt(struct autofs_point *ap, union autofs_v5_packet_union *pkt)
  82
  83  int do_expire(struct autofs_point *ap, const char *name, int namelen)
  84  {
  85 -       char buf[PATH_MAX + 1];
  86 +       char buf[PATH_MAX];
  87         int len, ret;
  88
  89         if (*name != '/') {
  90                 len = ncat_path(buf, sizeof(buf), ap->path, name, namelen);
  91         } else {
  92                 len = snprintf(buf, PATH_MAX, "%s", name);
  93 -               if (len > PATH_MAX)
  94 +               if (len >= PATH_MAX)
  95                         len = 0;
  96         }
  97
  98 diff --git a/daemon/direct.c b/daemon/direct.c
  99 index fc3c969..4f4ff20 100644
 100 --- a/daemon/direct.c
 101 +++ b/daemon/direct.c
 102 @@ -637,7 +637,9 @@ int mount_autofs_offset(struct autofs_point *ap, struct mapent *me, const char *
 103         time_t timeout = ap->exp_timeout;
 104         struct stat st;
 105         int ioctlfd, status, ret;
 106 -       const char *type, *map_name = NULL;
 107 +       const char *hosts_map_name = "-hosts";
 108 +       const char *map_name = hosts_map_name;
 109 +       const char *type;
 110         char mountpoint[PATH_MAX];
 111
 112         if (ops->version && ap->flags & MOUNT_FLAG_REMOUNT) {
 113 @@ -740,13 +742,7 @@ int mount_autofs_offset(struct autofs_point *ap, struct mapent *me, const char *
 114               mp->options, mountpoint);
 115
 116         type = ap->entry->maps->type;
 117 -       if (type && !strcmp(ap->entry->maps->type, "hosts")) {
 118 -               char *tmp = alloca(7);
 119 -               if (tmp) {
 120 -                       strcpy(tmp, "-hosts");
 121 -                       map_name = (const char *) tmp;
 122 -               }
 123 -       } else
 124 +       if (!type || strcmp(ap->entry->maps->type, "hosts"))
 125                 map_name = me->mc->map->argv[0];
 126
 127         ret = mount(map_name, mountpoint, "autofs", MS_MGC_VAL, mp->options);
 128 diff --git a/daemon/flag.c b/daemon/flag.c
 129 index e43cece..f8fe163 100644
 130 --- a/daemon/flag.c
 131 +++ b/daemon/flag.c
 132 @@ -23,10 +23,10 @@
 133  #include <sys/stat.h>
 134  #include <time.h>
 135  #include <string.h>
 136 -#include <alloca.h>
 137  #include <stdio.h>
 138  #include <signal.h>
 139  #include <errno.h>
 140 +#include <limits.h>
 141
 142  #include "automount.h"
 143
 144 @@ -113,12 +113,13 @@ void release_flag_file(void)
 145  /* * Try to create flag file */
 146  int aquire_flag_file(void)
 147  {
 148 -       char *linkf;
 149 -       int len;
 150 +       char linkf[PATH_MAX];
 151 +       size_t len;
 152
 153 -       len = strlen(FLAG_FILE) + MAX_PIDSIZE;
 154 -       linkf = alloca(len + 1);
 155 -       snprintf(linkf, len, "%s.%d", FLAG_FILE, getpid());
 156 +       len = snprintf(linkf, sizeof(linkf), "%s.%d", FLAG_FILE, getpid());
 157 +       if (len >= sizeof(linkf))
 158 +               /* Didn't acquire it */
 159 +               return 0;
 160
 161         /*
 162          * Repeat until it was us who made the link or we find the
 163 diff --git a/daemon/indirect.c b/daemon/indirect.c
 164 index f40c393..2539282 100644
 165 --- a/daemon/indirect.c
 166 +++ b/daemon/indirect.c
 167 @@ -90,7 +90,9 @@ static int do_mount_autofs_indirect(struct autofs_point *ap, const char *root)
 168         struct ioctl_ops *ops = get_ioctl_ops();
 169         time_t timeout = ap->exp_timeout;
 170         char *options = NULL;
 171 -       const char *type, *map_name = NULL;
 172 +       const char *hosts_map_name = "-hosts";
 173 +       const char *map_name = hosts_map_name;
 174 +       const char *type;
 175         struct stat st;
 176         struct mnt_list *mnts;
 177         int ret;
 178 @@ -142,13 +144,7 @@ static int do_mount_autofs_indirect(struct autofs_point *ap, const char *root)
 179         }
 180
 181         type = ap->entry->maps->type;
 182 -       if (type && !strcmp(ap->entry->maps->type, "hosts")) {
 183 -               char *tmp = alloca(7);
 184 -               if (tmp) {
 185 -                       strcpy(tmp, "-hosts");
 186 -                       map_name = (const char *) tmp;
 187 -               }
 188 -       } else
 189 +       if (!type || strcmp(ap->entry->maps->type, "hosts"))
 190                 map_name = ap->entry->maps->argv[0];
 191
 192         ret = mount(map_name, root, "autofs", MS_MGC_VAL, options);
 193 diff --git a/daemon/module.c b/daemon/module.c
 194 index e593d75..466d8d7 100644
 195 --- a/daemon/module.c
 196 +++ b/daemon/module.c
 197 @@ -58,15 +58,11 @@ struct lookup_mod *open_lookup(const char *name, const char *err_prefix,
 198  {
 199         struct lookup_mod *mod;
 200         char buf[MAX_ERR_BUF];
 201 -       char *fnbuf;
 202 -       size_t size_name;
 203 -       size_t size_fnbuf;
 204 +       char fnbuf[PATH_MAX];
 205 +       size_t size;
 206         void *dh;
 207         int *ver;
 208
 209 -       size_name = _strlen(name, PATH_MAX + 1);
 210 -       if (!size_name)
 211 -               return NULL;
 212
 213         mod = malloc(sizeof(struct lookup_mod));
 214         if (!mod) {
 215 @@ -77,9 +73,9 @@ struct lookup_mod *open_lookup(const char *name, const char *err_prefix,
 216                 return NULL;
 217         }
 218
 219 -       size_fnbuf = size_name + strlen(AUTOFS_LIB_DIR) + 13;
 220 -       fnbuf = alloca(size_fnbuf);
 221 -       if (!fnbuf) {
 222 +       size = snprintf(fnbuf, sizeof(fnbuf),
 223 +                       "%s/lookup_%s.so", AUTOFS_LIB_DIR, name);
 224 +       if (size >= sizeof(fnbuf)) {
 225                 free(mod);
 226                 if (err_prefix) {
 227                         char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 228 @@ -87,7 +83,6 @@ struct lookup_mod *open_lookup(const char *name, const char *err_prefix,
 229                 }
 230                 return NULL;
 231         }
 232 -       snprintf(fnbuf, size_fnbuf, "%s/lookup_%s.so", AUTOFS_LIB_DIR, name);
 233
 234         if (!(dh = dlopen(fnbuf, RTLD_NOW))) {
 235                 if (err_prefix)
 236 @@ -141,15 +136,11 @@ struct parse_mod *open_parse(const char *name, const char *err_prefix,
 237  {
 238         struct parse_mod *mod;
 239         char buf[MAX_ERR_BUF];
 240 -       char *fnbuf;
 241 -       size_t size_name;
 242 -       size_t size_fnbuf;
 243 +       char fnbuf[PATH_MAX];
 244 +       size_t size;
 245         void *dh;
 246         int *ver;
 247
 248 -       size_name = _strlen(name, PATH_MAX + 1);
 249 -       if (!size_name)
 250 -               return NULL;
 251
 252         mod = malloc(sizeof(struct parse_mod));
 253         if (!mod) {
 254 @@ -160,9 +151,9 @@ struct parse_mod *open_parse(const char *name, const char *err_prefix,
 255                 return NULL;
 256         }
 257
 258 -       size_fnbuf = size_name + strlen(AUTOFS_LIB_DIR) + 13;
 259 -       fnbuf = alloca(size_fnbuf);
 260 -       if (!fnbuf) {
 261 +       size = snprintf(fnbuf, sizeof(fnbuf),
 262 +                       "%s/parse_%s.so", AUTOFS_LIB_DIR, name);
 263 +       if (size >= sizeof(fnbuf)) {
 264                 free(mod);
 265                 if (err_prefix) {
 266                         char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 267 @@ -170,7 +161,6 @@ struct parse_mod *open_parse(const char *name, const char *err_prefix,
 268                 }
 269                 return NULL;
 270         }
 271 -       snprintf(fnbuf, size_fnbuf, "%s/parse_%s.so", AUTOFS_LIB_DIR, name);
 272
 273         if (!(dh = dlopen(fnbuf, RTLD_NOW))) {
 274                 if (err_prefix)
 275 @@ -222,15 +212,11 @@ struct mount_mod *open_mount(const char *name, const char *err_prefix)
 276  {
 277         struct mount_mod *mod;
 278         char buf[MAX_ERR_BUF];
 279 -       char *fnbuf;
 280 -       size_t size_name;
 281 -       size_t size_fnbuf;
 282 +       char fnbuf[PATH_MAX];
 283 +       size_t size;
 284         void *dh;
 285         int *ver;
 286
 287 -       size_name = _strlen(name, PATH_MAX + 1);
 288 -       if (!size_name)
 289 -               return NULL;
 290
 291         mod = malloc(sizeof(struct mount_mod));
 292         if (!mod) {
 293 @@ -241,9 +227,9 @@ struct mount_mod *open_mount(const char *name, const char *err_prefix)
 294                 return NULL;
 295         }
 296
 297 -       size_fnbuf = size_name + strlen(AUTOFS_LIB_DIR) + 13;
 298 -       fnbuf = alloca(size_fnbuf);
 299 -       if (!fnbuf) {
 300 +       size = snprintf(fnbuf, sizeof(fnbuf),
 301 +                       "%s/mount_%s.so", AUTOFS_LIB_DIR, name);
 302 +       if (size >= sizeof(fnbuf)) {
 303                 free(mod);
 304                 if (err_prefix) {
 305                         char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 306 @@ -251,7 +237,6 @@ struct mount_mod *open_mount(const char *name, const char *err_prefix)
 307                 }
 308                 return NULL;
 309         }
 310 -       snprintf(fnbuf, size_fnbuf, "%s/mount_%s.so", AUTOFS_LIB_DIR, name);
 311
 312         if (!(dh = dlopen(fnbuf, RTLD_NOW))) {
 313                 if (err_prefix)
 314 diff --git a/lib/cache.c b/lib/cache.c
 315 index 4cb4582..cd62ac2 100644
 316 --- a/lib/cache.c
 317 +++ b/lib/cache.c
 318 @@ -482,27 +482,23 @@ struct mapent *cache_lookup_offset(const char *prefix, const char *offset, int s
 319  {
 320         struct list_head *p;
 321         struct mapent *this;
 322 -       int plen = strlen(prefix);
 323 -       char *o_key;
 324 +       /* Keys for direct maps may be as long as a path name */
 325 +       char o_key[PATH_MAX];
 326 +       /* Avoid "//" at the beginning of paths */
 327 +       const char *path_prefix = strlen(prefix) > 1 ? prefix : "";
 328 +       size_t size;
 329
 330         /* root offset duplicates "/" */
 331 -       if (plen > 1) {
 332 -               o_key = alloca(plen + strlen(offset) + 1);
 333 -               strcpy(o_key, prefix);
 334 -               strcat(o_key, offset);
 335 -       } else {
 336 -               o_key = alloca(strlen(offset) + 1);
 337 -               strcpy(o_key, offset);
 338 -       }
 339 +       size = snprintf(o_key, sizeof(o_key), "%s%s", path_prefix, offset);
 340 +       if (size >= sizeof(o_key))
 341 +               return NULL;
 342
 343         list_for_each(p, head) {
 344                 this = list_entry(p, struct mapent, multi_list);
 345                 if (!strcmp(&this->key[start], o_key))
 346 -                       goto done;
 347 +                       return this;
 348         }
 349 -       this = NULL;
 350 -done:
 351 -       return this;
 352 +       return NULL;
 353  }
 354
 355  /* cache must be read locked by caller */
 356 @@ -759,13 +755,8 @@ int cache_delete(struct mapent_cache *mc, const char *key)
 357         struct mapent *me = NULL, *pred;
 358         u_int32_t hashval = hash(key, mc->size);
 359         int status, ret = CHE_OK;
 360 -       char *this;
 361 +       char this[PATH_MAX];
 362
 363 -       this = alloca(strlen(key) + 1);
 364 -       if (!this) {
 365 -               ret = CHE_FAIL;
 366 -               goto done;
 367 -       }
 368         strcpy(this, key);
 369
 370         me = mc->hash[hashval];
 371 diff --git a/lib/cat_path.c b/lib/cat_path.c
 372 index 576b424..60669db 100644
 373 --- a/lib/cat_path.c
 374 +++ b/lib/cat_path.c
 375 @@ -12,7 +12,6 @@
 376   *
 377   * ----------------------------------------------------------------------- */
 378
 379 -#include <alloca.h>
 380  #include <string.h>
 381  #include <limits.h>
 382  #include <ctype.h>
 383 diff --git a/modules/lookup_file.c b/modules/lookup_file.c
 384 index aafeb8b..ba80f2a 100644
 385 --- a/modules/lookup_file.c
 386 +++ b/modules/lookup_file.c
 387 @@ -378,8 +378,8 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 388         unsigned int logopt = master->logopt;
 389         char *buffer;
 390         int blen;
 391 -       char *path;
 392 -       char *ent;
 393 +       char path[KEY_MAX_LEN + 1];
 394 +       char ent[MAPENT_MAX_LEN + 1];
 395         FILE *f;
 396         unsigned int path_len, ent_len;
 397         int entry, cur_state;
 398 @@ -393,20 +393,6 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 399                 return NSS_STATUS_UNAVAIL;
 400         }
 401
 402 -       path = alloca(KEY_MAX_LEN + 1);
 403 -       if (!path) {
 404 -               error(logopt,
 405 -                     MODPREFIX "could not malloc storage for path");
 406 -               return NSS_STATUS_UNAVAIL;
 407 -       }
 408 -
 409 -       ent = alloca(MAPENT_MAX_LEN + 1);
 410 -       if (!ent) {
 411 -               error(logopt,
 412 -                     MODPREFIX "could not malloc storage for mapent");
 413 -               return NSS_STATUS_UNAVAIL;
 414 -       }
 415 -
 416         f = open_fopen_r(ctxt->mapname);
 417         if (!f) {
 418                 error(logopt,
 419 @@ -618,8 +604,8 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 420         struct lookup_context *ctxt = (struct lookup_context *) context;
 421         struct map_source *source;
 422         struct mapent_cache *mc;
 423 -       char *key;
 424 -       char *mapent;
 425 +       char key[KEY_MAX_LEN + 1];
 426 +       char mapent[MAPENT_MAX_LEN + 1];
 427         FILE *f;
 428         unsigned int k_len, m_len;
 429         int entry;
 430 @@ -639,20 +625,6 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 431                 return NSS_STATUS_UNAVAIL;
 432         }
 433
 434 -       key = alloca(KEY_MAX_LEN + 1);
 435 -       if (!key) {
 436 -               error(ap->logopt,
 437 -                     MODPREFIX "could not malloc storage for key");
 438 -               return NSS_STATUS_UNAVAIL;
 439 -       }
 440 -
 441 -       mapent = alloca(MAPENT_MAX_LEN + 1);
 442 -       if (!mapent) {
 443 -               error(ap->logopt,
 444 -                     MODPREFIX "could not malloc storage for mapent");
 445 -               return NSS_STATUS_UNAVAIL;
 446 -       }
 447 -
 448         f = open_fopen_r(ctxt->mapname);
 449         if (!f) {
 450                 error(ap->logopt,
 451 @@ -972,7 +944,7 @@ int lookup_mount(struct autofs_point *ap, const char *name, int name_len, void *
 452         char key[KEY_MAX_LEN + 1];
 453         int key_len;
 454         char *mapent = NULL;
 455 -       int mapent_len;
 456 +       char mapent_buf[MAPENT_MAX_LEN + 1];
 457         int status = 0;
 458         int ret = 1;
 459
 460 @@ -1076,38 +1048,36 @@ do_cache_lookup:
 461         }
 462         if (me && (me->source == source || *me->key == '/')) {
 463                 pthread_cleanup_push(cache_lock_cleanup, mc);
 464 -               mapent_len = strlen(me->mapent);
 465 -               mapent = alloca(mapent_len + 1);
 466 -               strcpy(mapent, me->mapent);
 467 +               strcpy(mapent_buf, me->mapent);
 468 +               mapent = mapent_buf;
 469                 pthread_cleanup_pop(0);
 470         }
 471         cache_unlock(mc);
 472
 473 -       if (mapent) {
 474 -               master_source_current_wait(ap->entry);
 475 -               ap->entry->current = source;
 476 +       if (!mapent)
 477 +               return NSS_STATUS_TRYAGAIN;
 478
 479 -               debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 480 -               ret = ctxt->parse->parse_mount(ap, key, key_len,
 481 -                                       mapent, ctxt->parse->context);
 482 -               if (ret) {
 483 -                       time_t now = time(NULL);
 484 -                       int rv = CHE_OK;
 485 +       master_source_current_wait(ap->entry);
 486 +       ap->entry->current = source;
 487
 488 -                       cache_writelock(mc);
 489 +       debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 490 +       ret = ctxt->parse->parse_mount(ap, key, key_len,
 491 +                                      mapent, ctxt->parse->context);
 492 +       if (ret) {
 493 +               time_t now = time(NULL);
 494 +               int rv = CHE_OK;
 495 +
 496 +               cache_writelock(mc);
 497 +               me = cache_lookup_distinct(mc, key);
 498 +               if (!me)
 499 +                       rv = cache_update(mc, source, key, NULL, now);
 500 +               if (rv != CHE_FAIL) {
 501                         me = cache_lookup_distinct(mc, key);
 502 -                       if (!me)
 503 -                               rv = cache_update(mc, source, key, NULL, now);
 504 -                       if (rv != CHE_FAIL) {
 505 -                               me = cache_lookup_distinct(mc, key);
 506 -                               me->status = now + ap->negative_timeout;
 507 -                       }
 508 -                       cache_unlock(mc);
 509 +                       me->status = now + ap->negative_timeout;
 510                 }
 511 -       }
 512 -
 513 -       if (ret)
 514 +               cache_unlock(mc);
 515                 return NSS_STATUS_TRYAGAIN;
 516 +       }
 517
 518         return NSS_STATUS_SUCCESS;
 519  }
 520 diff --git a/modules/lookup_ldap.c b/modules/lookup_ldap.c
 521 index d8a60d3..094cbdc 100644
 522 --- a/modules/lookup_ldap.c
 523 +++ b/modules/lookup_ldap.c
 524 @@ -294,10 +294,10 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 525         if (ctxt->mapname)
 526                 l += strlen(key) + strlen(ctxt->mapname) + strlen("(&(=))");
 527
 528 -       query = alloca(l);
 529 +       query = malloc(l);
 530         if (query == NULL) {
 531                 char *estr = strerror_r(errno, buf, sizeof(buf));
 532 -               crit(logopt, MODPREFIX "alloca: %s", estr);
 533 +               crit(logopt, MODPREFIX "malloc: %s", estr);
 534                 return NSS_STATUS_UNAVAIL;
 535         }
 536
 537 @@ -310,6 +310,7 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 538                      key, (int) strlen(ctxt->mapname), ctxt->mapname) >= l) {
 539                         debug(logopt,
 540                               MODPREFIX "error forming query string");
 541 +                       free(query);
 542                         return 0;
 543                 }
 544                 scope = LDAP_SCOPE_SUBTREE;
 545 @@ -317,6 +318,7 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 546                 if (sprintf(query, "(objectclass=%s)", class) >= l) {
 547                         debug(logopt,
 548                               MODPREFIX "error forming query string");
 549 +                       free(query);
 550                         return 0;
 551                 }
 552                 scope = LDAP_SCOPE_SUBTREE;
 553 @@ -340,6 +342,7 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 554                         error(logopt,
 555                               MODPREFIX "query failed for %s: %s",
 556                               query, ldap_err2string(rv));
 557 +                       free(query);
 558                         return 0;
 559                 }
 560
 561 @@ -353,6 +356,7 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 562                               MODPREFIX "query succeeded, no matches for %s",
 563                               query);
 564                         ldap_msgfree(result);
 565 +                       free(query);
 566                         return 0;
 567                 }
 568         } else {
 569 @@ -395,10 +399,12 @@ static int get_query_dn(unsigned logopt, LDAP *ldap, struct lookup_context *ctxt
 570                         ldap_msgfree(result);
 571                         error(logopt,
 572                               MODPREFIX "failed to find query dn under search base dns");
 573 +                       free(query);
 574                         return 0;
 575                 }
 576         }
 577
 578 +       free(query);
 579         qdn = strdup(dn);
 580         ldap_memfree(dn);
 581         ldap_msgfree(result);
 582 @@ -1181,7 +1187,7 @@ static int parse_server_string(unsigned logopt, const char *url, struct lookup_c
 583                         else {
 584                                 char *estr;
 585                                 estr = strerror_r(errno, buf, sizeof(buf));
 586 -                               logerr(MODPREFIX "malloc: %s", estr);
 587 +                               logerr(MODPREFIX "strdup: %s", estr);
 588                                 if (ctxt->server)
 589                                         free(ctxt->server);
 590                                 return 0;
 591 @@ -1441,23 +1447,26 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 592
 593         l = strlen("(objectclass=)") + strlen(class) + 1;
 594
 595 -       query = alloca(l);
 596 +       query = malloc(l);
 597         if (query == NULL) {
 598                 char *estr = strerror_r(errno, buf, sizeof(buf));
 599 -               logerr(MODPREFIX "alloca: %s", estr);
 600 +               logerr(MODPREFIX "malloc: %s", estr);
 601                 return NSS_STATUS_UNAVAIL;
 602         }
 603
 604         if (sprintf(query, "(objectclass=%s)", class) >= l) {
 605                 error(logopt, MODPREFIX "error forming query string");
 606 +               free(query);
 607                 return NSS_STATUS_UNAVAIL;
 608         }
 609         query[l] = '\0';
 610
 611         /* Initialize the LDAP context. */
 612         ldap = do_reconnect(logopt, ctxt);
 613 -       if (!ldap)
 614 +       if (!ldap) {
 615 +               free(query);
 616                 return NSS_STATUS_UNAVAIL;
 617 +       }
 618
 619         /* Look around. */
 620         debug(logopt,
 621 @@ -1469,6 +1478,7 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 622                 error(logopt, MODPREFIX "query failed for %s: %s",
 623                       query, ldap_err2string(rv));
 624                 unbind_ldap_connection(logging, ldap, ctxt);
 625 +               free(query);
 626                 return NSS_STATUS_NOTFOUND;
 627         }
 628
 629 @@ -1479,6 +1489,7 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 630                       query);
 631                 ldap_msgfree(result);
 632                 unbind_ldap_connection(logging, ldap, ctxt);
 633 +               free(query);
 634                 return NSS_STATUS_NOTFOUND;
 635         } else
 636                 debug(logopt, MODPREFIX "examining entries");
 637 @@ -1548,6 +1559,7 @@ next:
 638         /* Clean up. */
 639         ldap_msgfree(result);
 640         unbind_ldap_connection(logopt, ldap, ctxt);
 641 +       free(query);
 642
 643         return NSS_STATUS_SUCCESS;
 644  }
 645 @@ -2174,7 +2186,7 @@ static int read_one_map(struct autofs_point *ap,
 646         /* Build a query string. */
 647         l = strlen("(objectclass=)") + strlen(class) + 1;
 648
 649 -       sp.query = alloca(l);
 650 +       sp.query = malloc(l);
 651         if (sp.query == NULL) {
 652                 char *estr = strerror_r(errno, buf, sizeof(buf));
 653                 logerr(MODPREFIX "malloc: %s", estr);
 654 @@ -2183,14 +2195,17 @@ static int read_one_map(struct autofs_point *ap,
 655
 656         if (sprintf(sp.query, "(objectclass=%s)", class) >= l) {
 657                 error(ap->logopt, MODPREFIX "error forming query string");
 658 +               free(sp.query);
 659                 return NSS_STATUS_UNAVAIL;
 660         }
 661         sp.query[l] = '\0';
 662
 663         /* Initialize the LDAP context. */
 664         sp.ldap = do_reconnect(ap->logopt, ctxt);
 665 -       if (!sp.ldap)
 666 +       if (!sp.ldap) {
 667 +               free(sp.query);
 668                 return NSS_STATUS_UNAVAIL;
 669 +       }
 670
 671         /* Look around. */
 672         debug(ap->logopt,
 673 @@ -2215,6 +2230,7 @@ static int read_one_map(struct autofs_point *ap,
 674                 if (rv != LDAP_SUCCESS || !sp.result) {
 675                         unbind_ldap_connection(ap->logopt, sp.ldap, ctxt);
 676                         *result_ldap = rv;
 677 +                       free(sp.query);
 678                         return NSS_STATUS_UNAVAIL;
 679                 }
 680
 681 @@ -2223,6 +2239,7 @@ static int read_one_map(struct autofs_point *ap,
 682                         ldap_msgfree(sp.result);
 683                         unbind_ldap_connection(ap->logopt, sp.ldap, ctxt);
 684                         *result_ldap = rv;
 685 +                       free(sp.query);
 686                         return NSS_STATUS_NOTFOUND;
 687                 }
 688                 ldap_msgfree(sp.result);
 689 @@ -2233,6 +2250,7 @@ static int read_one_map(struct autofs_point *ap,
 690         unbind_ldap_connection(ap->logopt, sp.ldap, ctxt);
 691
 692         source->age = age;
 693 +       free(sp.query);
 694
 695         return NSS_STATUS_SUCCESS;
 696  }
 697 @@ -2328,7 +2346,7 @@ static int lookup_one(struct autofs_point *ap,
 698         if (enc_len1)
 699                 l += 2*strlen(entry) + enc_len1 + enc_len2 + 6;
 700
 701 -       query = alloca(l);
 702 +       query = malloc(l);
 703         if (query == NULL) {
 704                 char *estr = strerror_r(errno, buf, sizeof(buf));
 705                 crit(ap->logopt, MODPREFIX "malloc: %s", estr);
 706 @@ -2336,6 +2354,7 @@ static int lookup_one(struct autofs_point *ap,
 707                         free(enc_key1);
 708                         free(enc_key2);
 709                 }
 710 +               free(query);
 711                 return CHE_FAIL;
 712         }
 713
 714 @@ -2367,14 +2386,17 @@ static int lookup_one(struct autofs_point *ap,
 715         if (ql >= l) {
 716                 error(ap->logopt,
 717                       MODPREFIX "error forming query string");
 718 +               free(query);
 719                 return CHE_FAIL;
 720         }
 721         query[ql] = '\0';
 722
 723         /* Initialize the LDAP context. */
 724         ldap = do_reconnect(ap->logopt, ctxt);
 725 -       if (!ldap)
 726 +       if (!ldap) {
 727 +               free(query);
 728                 return CHE_UNAVAIL;
 729 +       }
 730
 731         debug(ap->logopt,
 732               MODPREFIX "searching for \"%s\" under \"%s\"", query, ctxt->qdn);
 733 @@ -2384,6 +2406,7 @@ static int lookup_one(struct autofs_point *ap,
 734         if ((rv != LDAP_SUCCESS) || !result) {
 735                 crit(ap->logopt, MODPREFIX "query failed for %s", query);
 736                 unbind_ldap_connection(ap->logopt, ldap, ctxt);
 737 +               free(query);
 738                 return CHE_FAIL;
 739         }
 740
 741 @@ -2396,6 +2419,7 @@ static int lookup_one(struct autofs_point *ap,
 742                      MODPREFIX "got answer, but no entry for %s", query);
 743                 ldap_msgfree(result);
 744                 unbind_ldap_connection(ap->logopt, ldap, ctxt);
 745 +               free(query);
 746                 return CHE_MISSING;
 747         }
 748
 749 @@ -2610,6 +2634,7 @@ next:
 750                 }
 751         }
 752         pthread_cleanup_pop(1);
 753 +       free(query);
 754
 755         return ret;
 756  }
 757 @@ -2696,7 +2721,7 @@ int lookup_mount(struct autofs_point *ap, const char *name, int name_len, void *
 758         char key[KEY_MAX_LEN + 1];
 759         int key_len;
 760         char *mapent = NULL;
 761 -       int mapent_len;
 762 +       char mapent_buf[MAPENT_MAX_LEN + 1];
 763         int status = 0;
 764         int ret = 1;
 765
 766 @@ -2766,38 +2791,36 @@ int lookup_mount(struct autofs_point *ap, const char *name, int name_len, void *
 767                         me = cache_lookup_distinct(mc, "*");
 768         }
 769         if (me && (me->source == source || *me->key == '/')) {
 770 -               mapent_len = strlen(me->mapent);
 771 -               mapent = alloca(mapent_len + 1);
 772 -               strcpy(mapent, me->mapent);
 773 +               strcpy(mapent_buf, me->mapent);
 774 +               mapent = mapent_buf;
 775         }
 776         cache_unlock(mc);
 777
 778 -       if (mapent) {
 779 -               master_source_current_wait(ap->entry);
 780 -               ap->entry->current = source;
 781 +       if (!mapent)
 782 +               return NSS_STATUS_TRYAGAIN;
 783
 784 -               debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 785 -               ret = ctxt->parse->parse_mount(ap, key, key_len,
 786 -                                        mapent, ctxt->parse->context);
 787 -               if (ret) {
 788 -                       time_t now = time(NULL);
 789 -                       int rv = CHE_OK;
 790 +       master_source_current_wait(ap->entry);
 791 +       ap->entry->current = source;
 792
 793 -                       /* Record the the mount fail in the cache */
 794 -                       cache_writelock(mc);
 795 +       debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 796 +       ret = ctxt->parse->parse_mount(ap, key, key_len,
 797 +                                      mapent, ctxt->parse->context);
 798 +       if (ret) {
 799 +               time_t now = time(NULL);
 800 +               int rv = CHE_OK;
 801 +
 802 +               /* Record the the mount fail in the cache */
 803 +               cache_writelock(mc);
 804 +               me = cache_lookup_distinct(mc, key);
 805 +               if (!me)
 806 +                       rv = cache_update(mc, source, key, NULL, now);
 807 +               if (rv != CHE_FAIL) {
 808                         me = cache_lookup_distinct(mc, key);
 809 -                       if (!me)
 810 -                               rv = cache_update(mc, source, key, NULL, now);
 811 -                       if (rv != CHE_FAIL) {
 812 -                               me = cache_lookup_distinct(mc, key);
 813 -                               me->status = now + ap->negative_timeout;
 814 -                       }
 815 -                       cache_unlock(mc);
 816 +                       me->status = now + ap->negative_timeout;
 817                 }
 818 -       }
 819 -
 820 -       if (ret)
 821 +               cache_unlock(mc);
 822                 return NSS_STATUS_TRYAGAIN;
 823 +       }
 824
 825         return NSS_STATUS_SUCCESS;
 826  }
 827 diff --git a/modules/lookup_nisplus.c b/modules/lookup_nisplus.c
 828 index 4c3ce60..0c75905 100644
 829 --- a/modules/lookup_nisplus.c
 830 +++ b/modules/lookup_nisplus.c
 831 @@ -92,10 +92,10 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 832         int cur_state, len;
 833
 834         pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
 835 -       tablename = alloca(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 836 +       tablename = malloc(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 837         if (!tablename) {
 838                 char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 839 -               logerr(MODPREFIX "alloca: %s", estr);
 840 +               logerr(MODPREFIX "malloc: %s", estr);
 841                 pthread_setcancelstate(cur_state, NULL);
 842                 return NSS_STATUS_UNAVAIL;
 843         }
 844 @@ -107,6 +107,7 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 845                 nis_freeresult(result);
 846                 crit(logopt,
 847                      MODPREFIX "couldn't locate nis+ table %s", ctxt->mapname);
 848 +               free(tablename);
 849                 pthread_setcancelstate(cur_state, NULL);
 850                 return NSS_STATUS_NOTFOUND;
 851         }
 852 @@ -118,6 +119,7 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 853                 nis_freeresult(result);
 854                 crit(logopt,
 855                      MODPREFIX "couldn't enumrate nis+ map %s", ctxt->mapname);
 856 +               free(tablename);
 857                 pthread_setcancelstate(cur_state, NULL);
 858                 return NSS_STATUS_UNAVAIL;
 859         }
 860 @@ -155,6 +157,7 @@ int lookup_read_master(struct master *master, time_t age, void *context)
 861         }
 862
 863         nis_freeresult(result);
 864 +       free(tablename);
 865         pthread_setcancelstate(cur_state, NULL);
 866
 867         return NSS_STATUS_SUCCESS;
 868 @@ -180,10 +183,10 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 869         mc = source->mc;
 870
 871         pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
 872 -       tablename = alloca(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 873 +       tablename = malloc(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 874         if (!tablename) {
 875                 char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 876 -               logerr(MODPREFIX "alloca: %s", estr);
 877 +               logerr(MODPREFIX "malloc: %s", estr);
 878                 pthread_setcancelstate(cur_state, NULL);
 879                 return NSS_STATUS_UNAVAIL;
 880         }
 881 @@ -195,6 +198,7 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 882                 nis_freeresult(result);
 883                 crit(ap->logopt,
 884                      MODPREFIX "couldn't locate nis+ table %s", ctxt->mapname);
 885 +               free(tablename);
 886                 pthread_setcancelstate(cur_state, NULL);
 887                 return NSS_STATUS_NOTFOUND;
 888         }
 889 @@ -206,6 +210,7 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 890                 nis_freeresult(result);
 891                 crit(ap->logopt,
 892                      MODPREFIX "couldn't enumrate nis+ map %s", ctxt->mapname);
 893 +               free(tablename);
 894                 pthread_setcancelstate(cur_state, NULL);
 895                 return NSS_STATUS_UNAVAIL;
 896         }
 897 @@ -245,6 +250,7 @@ int lookup_read_map(struct autofs_point *ap, time_t age, void *context)
 898
 899         source->age = age;
 900
 901 +       free(tablename);
 902         pthread_setcancelstate(cur_state, NULL);
 903
 904         return NSS_STATUS_SUCCESS;
 905 @@ -271,11 +277,11 @@ static int lookup_one(struct autofs_point *ap,
 906         mc = source->mc;
 907
 908         pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
 909 -       tablename = alloca(strlen(key) +
 910 -                       strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 911 +       tablename = malloc(strlen(key) + strlen(ctxt->mapname) +
 912 +                          strlen(ctxt->domainname) + 20);
 913         if (!tablename) {
 914                 char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 915 -               logerr(MODPREFIX "alloca: %s", estr);
 916 +               logerr(MODPREFIX "malloc: %s", estr);
 917                 pthread_setcancelstate(cur_state, NULL);
 918                 return -1;
 919         }
 920 @@ -286,6 +292,7 @@ static int lookup_one(struct autofs_point *ap,
 921         if (result->status != NIS_SUCCESS && result->status != NIS_S_SUCCESS) {
 922                 nis_error rs = result->status;
 923                 nis_freeresult(result);
 924 +               free(tablename);
 925                 pthread_setcancelstate(cur_state, NULL);
 926                 if (rs == NIS_NOTFOUND ||
 927                     rs == NIS_S_NOTFOUND ||
 928 @@ -303,6 +310,7 @@ static int lookup_one(struct autofs_point *ap,
 929         cache_unlock(mc);
 930
 931         nis_freeresult(result);
 932 +       free(tablename);
 933         pthread_setcancelstate(cur_state, NULL);
 934
 935         return ret;
 936 @@ -327,10 +335,10 @@ static int lookup_wild(struct autofs_point *ap, struct lookup_context *ctxt)
 937         mc = source->mc;
 938
 939         pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, &cur_state);
 940 -       tablename = alloca(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 941 +       tablename = malloc(strlen(ctxt->mapname) + strlen(ctxt->domainname) + 20);
 942         if (!tablename) {
 943                 char *estr = strerror_r(errno, buf, MAX_ERR_BUF);
 944 -               logerr(MODPREFIX "alloca: %s", estr);
 945 +               logerr(MODPREFIX "malloc: %s", estr);
 946                 pthread_setcancelstate(cur_state, NULL);
 947                 return -1;
 948         }
 949 @@ -341,6 +349,7 @@ static int lookup_wild(struct autofs_point *ap, struct lookup_context *ctxt)
 950         if (result->status != NIS_SUCCESS && result->status != NIS_S_SUCCESS) {
 951                 nis_error rs = result->status;
 952                 nis_freeresult(result);
 953 +               free(tablename);
 954                 pthread_setcancelstate(cur_state, NULL);
 955                 if (rs == NIS_NOTFOUND ||
 956                     rs == NIS_S_NOTFOUND ||
 957 @@ -357,6 +366,7 @@ static int lookup_wild(struct autofs_point *ap, struct lookup_context *ctxt)
 958         cache_unlock(mc);
 959
 960         nis_freeresult(result);
 961 +       free(tablename);
 962         pthread_setcancelstate(cur_state, NULL);
 963
 964         return ret;
 965 @@ -546,36 +556,37 @@ int lookup_mount(struct autofs_point *ap, const char *name, int name_len, void *
 966         }
 967         if (me && (me->source == source || *me->key == '/')) {
 968                 mapent_len = strlen(me->mapent);
 969 -               mapent = alloca(mapent_len + 1);
 970 +               mapent = malloc(mapent_len + 1);
 971                 strcpy(mapent, me->mapent);
 972         }
 973         cache_unlock(mc);
 974
 975 -       if (mapent) {
 976 -               master_source_current_wait(ap->entry);
 977 -               ap->entry->current = source;
 978 +       if (!mapent)
 979 +               return NSS_STATUS_TRYAGAIN;
 980
 981 -               debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 982 -               ret = ctxt->parse->parse_mount(ap, key, key_len,
 983 -                                              mapent, ctxt->parse->context);
 984 -               if (ret) {
 985 -                       time_t now = time(NULL);
 986 -                       int rv = CHE_OK;
 987 +       master_source_current_wait(ap->entry);
 988 +       ap->entry->current = source;
 989 +
 990 +       debug(ap->logopt, MODPREFIX "%s -> %s", key, mapent);
 991 +       ret = ctxt->parse->parse_mount(ap, key, key_len,
 992 +                                      mapent, ctxt->parse->context);
 993 +       if (ret) {
 994 +               time_t now = time(NULL);
 995 +               int rv = CHE_OK;
 996
 997 -                       cache_writelock(mc);
 998 +               cache_writelock(mc);
 999 +               me = cache_lookup_distinct(mc, key);
1000 +               if (!me)
1001 +                       rv = cache_update(mc, source, key, NULL, now);
1002 +               if (rv != CHE_FAIL) {
1003                         me = cache_lookup_distinct(mc, key);
1004 -                       if (!me)
1005 -                               rv = cache_update(mc, source, key, NULL, now);
1006 -                       if (rv != CHE_FAIL) {
1007 -                               me = cache_lookup_distinct(mc, key);
1008 -                               me->status = time(NULL) + ap->negative_timeout;
1009 -                       }
1010 -                       cache_unlock(mc);
1011 +                       me->status = time(NULL) + ap->negative_timeout;
1012                 }
1013 -       }
1014 -
1015 -       if (ret)
1016 +               cache_unlock(mc);
1017 +               free(mapent);
1018                 return NSS_STATUS_TRYAGAIN;
1019 +       }
1020 +       free(mapent);
1021
1022         return NSS_STATUS_SUCCESS;
1023  }
1024 diff --git a/modules/mount_autofs.c b/modules/mount_autofs.c
1025 index 44fc043..fab2906 100644
1026 --- a/modules/mount_autofs.c
1027 +++ b/modules/mount_autofs.c
1028 @@ -18,7 +18,6 @@
1029  #include <malloc.h>
1030  #include <string.h>
1031  #include <signal.h>
1032 -#include <alloca.h>
1033  #include <sys/param.h>
1034  #include <sys/types.h>
1035  #include <sys/stat.h>
1036 diff --git a/modules/mount_bind.c b/modules/mount_bind.c
1037 index 361f0c2..b8ef581 100644
1038 --- a/modules/mount_bind.c
1039 +++ b/modules/mount_bind.c
1040 @@ -69,7 +69,7 @@ out:
1041  int mount_mount(struct autofs_point *ap, const char *root, const char *name, int name_len,
1042                 const char *what, const char *fstype, const char *options, void *context)
1043  {
1044 -       char *fullpath;
1045 +       char fullpath[PATH_MAX];
1046         char buf[MAX_ERR_BUF];
1047         int err;
1048         int i, len;
1049 @@ -80,14 +80,11 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1050         /* Root offset of multi-mount */
1051         len = strlen(root);
1052         if (root[len - 1] == '/') {
1053 -               fullpath = alloca(len);
1054                 len = snprintf(fullpath, len, "%s", root);
1055         /* Direct mount name is absolute path so don't use root */
1056         } else if (*name == '/') {
1057 -               fullpath = alloca(len + 1);
1058                 len = sprintf(fullpath, "%s", root);
1059         } else {
1060 -               fullpath = alloca(len + name_len + 2);
1061                 len = sprintf(fullpath, "%s/%s", root, name);
1062         }
1063         fullpath[len] = '\0';
1064 @@ -141,7 +138,7 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1065                 }
1066         } else {
1067                 char *cp;
1068 -               char *basepath = alloca(strlen(fullpath) + 1);
1069 +               char basepath[PATH_MAX];
1070                 int status;
1071                 struct stat st;
1072
1073 diff --git a/modules/mount_changer.c b/modules/mount_changer.c
1074 index c30190d..856cf6a 100644
1075 --- a/modules/mount_changer.c
1076 +++ b/modules/mount_changer.c
1077 @@ -44,7 +44,7 @@ int mount_init(void **context)
1078  int mount_mount(struct autofs_point *ap, const char *root, const char *name, int name_len,
1079                 const char *what, const char *fstype, const char *options, void *context)
1080  {
1081 -       char *fullpath;
1082 +       char fullpath[PATH_MAX];
1083         char buf[MAX_ERR_BUF];
1084         int err;
1085         int len, status, existed = 1;
1086 @@ -57,14 +57,11 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1087         /* Root offset of multi-mount */
1088         len = strlen(root);
1089         if (root[len - 1] == '/') {
1090 -               fullpath = alloca(len);
1091                 len = snprintf(fullpath, len, "%s", root);
1092         /* Direct mount name is absolute path so don't use root */
1093         } else if (*name == '/') {
1094 -               fullpath = alloca(len + 1);
1095                 len = sprintf(fullpath, "%s", root);
1096         } else {
1097 -               fullpath = alloca(len + name_len + 2);
1098                 len = sprintf(fullpath, "%s/%s", root, name);
1099         }
1100         fullpath[len] = '\0';
1101 diff --git a/modules/mount_ext2.c b/modules/mount_ext2.c
1102 index 192ec04..85329ab 100644
1103 --- a/modules/mount_ext2.c
1104 +++ b/modules/mount_ext2.c
1105 @@ -36,7 +36,7 @@ int mount_init(void **context)
1106  int mount_mount(struct autofs_point *ap, const char *root, const char *name, int name_len,
1107                 const char *what, const char *fstype, const char *options, void *context)
1108  {
1109 -       char *fullpath;
1110 +       char fullpath[PATH_MAX];
1111         char buf[MAX_ERR_BUF];
1112         const char *p, *p1;
1113         int err, ro = 0;
1114 @@ -49,14 +49,11 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1115         /* Root offset of multi-mount */
1116         len = strlen(root);
1117         if (root[len - 1] == '/') {
1118 -               fullpath = alloca(len);
1119                 len = snprintf(fullpath, len, "%s", root);
1120         /* Direct mount name is absolute path so don't use root */
1121         } else if (*name == '/') {
1122 -               fullpath = alloca(len + 1);
1123                 len = sprintf(fullpath, "%s", root);
1124         } else {
1125 -               fullpath = alloca(len + name_len + 2);
1126                 len = sprintf(fullpath, "%s/%s", root, name);
1127         }
1128         fullpath[len] = '\0';
1129 diff --git a/modules/mount_generic.c b/modules/mount_generic.c
1130 index 6d7b4b3..1dc1bfd 100644
1131 --- a/modules/mount_generic.c
1132 +++ b/modules/mount_generic.c
1133 @@ -37,7 +37,7 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1134                 const char *what, const char *fstype, const char *options,
1135                 void *context)
1136  {
1137 -       char *fullpath;
1138 +       char fullpath[PATH_MAX];
1139         char buf[MAX_ERR_BUF];
1140         int err;
1141         int len, status, existed = 1;
1142 @@ -48,14 +48,11 @@ int mount_mount(struct autofs_point *ap, const char *root, const char *name, int
1143         /* Root offset of multi-mount */
1144         len = strlen(root);
1145         if (root[len - 1] == '/') {
1146 -               fullpath = alloca(len);
1147                 len = snprintf(fullpath, len, "%s", root);
1148         /* Direct mount name is absolute path so don't use root */
1149         } else if (*name == '/') {
1150 -               fullpath = alloca(len + 1);
1151                 len = sprintf(fullpath, "%s", root);
1152         } else {
1153 -               fullpath = alloca(len + name_len + 2);
1154                 len = sprintf(fullpath, "%s/%s", root, name);
1155         }
1156         fullpath[len] = '\0';