From: ALT Linux investigation
Subject: [PATCH] Treat unavailable NSS groups as absent and avoid freeing graph data

When getgrnam_r() reaches an unavailable NSS provider such as winbind, glibc
may return ENOENT. Role members are optional, so treat this like a missing
group. Also, parse_line() can be extending an existing graph node; its error
path must not free the node's list, which remains owned by the graph.

This patch is prepared against libnss-role source revision d40c8cd
(0.5.6-alt4 source used by the test VM).

--- a/src/common.c
+++ b/src/common.c
@@ -193,8 +193,11 @@ static int get_gid_by_groupname(const char *gr_name, gid_t *gid)
     }

     if  (err != 0) {
         free(buffer);
+        /* An NSS provider may report an unavailable database as ENOENT. */
+        if (err == ENOENT)
+            return LIBROLE_NO_SUCH_GROUP;
         return errno_to_result(err);
     }
     if (!grp_ptr) {
         free(buffer);
--- a/src/parser.c
+++ b/src/parser.c
@@ -297,6 +297,8 @@ int parse_line(char *line, struct librole_graph *G)
     return result;

 libnss_role_parse_line_error:
-    free(role->list);
+    /* Existing role lists are owned by G and freed by librole_graph_free(). */
+    if (!role_exists)
+        free(role->list);
     return result;
 }