Description of problem:

if libcall realloc(hosts, nhostsbak * sizeof(char *)) returns 0, it may lead to an null pointer dereference in hosts[0].

337 static int
338 init_transport(struct netconfig *nconf)
339 {

<...snip...>

466 if (nconf->nc_semantics == NC_TPI_CLTS) {
467 /*
468 * If no hosts were specified, just bind to INADDR_ANY. Otherwise
469 * make sure 127.0.0.1 is added to the list.
470 */
471 nhostsbak = nhosts;
472 nhostsbak++;
473 hosts = realloc(hosts, nhostsbak * sizeof(char *)); // <- realloc may return NULL
474 if (nhostsbak == 1)
475 hosts[0] = "*";
476 else {
477 if (hints.ai_family == AF_INET)

{ 478 hosts[nhostsbak - 1] = "127.0.0.1"; 479 }

else if (hints.ai_family == AF_INET6)

{ 480 hosts[nhostsbak - 1] = "::1"; 481 }

else
482 return 1;
483 }
<...snip...>

Version-Release number of selected component (if applicable):

rpcbind-1.2.6-5.el9.x86_64