Based on:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=patch;h=c44496df2f090a56d3bf75df930592dac6bba46f

From c44496df2f090a56d3bf75df930592dac6bba46f Mon Sep 17 00:00:00 2001
From: Siddhesh Poyarekar <siddhesh@redhat.com>
Date: Wed, 12 Mar 2014 17:27:22 +0530
Subject: [PATCH] Provide correct buffer length to netgroup queries in nscd (BZ
 #16695)

The buffer to query netgroup entries is allocated sufficient space for
the netgroup entries and the key to be appended at the end, but it
sends in an incorrect available length to the NSS netgroup query
functions, resulting in overflow of the buffer in some special cases.
The fix here is to factor in the key length when sending the available
buffer and buffer length to the query functions.

diff -Naur a/nscd/netgroupcache.c b/nscd/netgroupcache.c
--- a/nscd/netgroupcache.c	2013-08-11 04:22:55.000000000 +0530
+++ b/nscd/netgroupcache.c	2017-08-17 17:36:31.476520384 +0530
@@ -179,7 +179,7 @@
 		  {
 		    int e;
 		    status = getfct.f (&data, buffer + buffilled,
-				       buflen - buffilled, &e);
+				       buflen - buffilled - req->key_len, &e);
 		    if (status == NSS_STATUS_RETURN)
 		      /* This was the last one for this group.  Look
 			 at next group if available.  */