Fix use-after-free introduced in r300388.

[delphij]

Summary

In r300388, endnetconfig() was called on nc_handle which would release
the associated netconfig structure, which means tmpnconf->nc_netid
would be a use-after-free.

Solve this by doing endnetconfig() in return paths instead.

Reported by: jemalloc via kevlo

Test Plan

Run various RPC daemons

[ngie]

Yowch... thanks for catching this. One note/concern about this code (both before and after this change).

lib/libc/rpc/rpcb_clnt.c

511 ↗

(On Diff #29881)

In the event netid is NULL (which was a pathological condition before, but can happen now if strdup fails), it's going to return a NULL loopnconf, which is going to trigger a delayed segfault on line 516 in getclnthandle. It should probably return NULL if loopnconf is NULL between line 515 and 516.

[delphij]

lib/libc/rpc/rpcb_clnt.c

511 ↗

(On Diff #29881)

I don't quite follow -- isn't the case handled in 506-509?

[cem]

Wouldn't it be easier to just endnetconfig() in both return paths? Avoid a bunch of unused strdup calls too.

[delphij]

Use endnetconfig() instead of previous approach.

[delphij]

In D11288#233844, @cem wrote:

Wouldn't it be easier to just endnetconfig() in both return paths? Avoid a bunch of unused strdup calls too.

Done.