From owner-freebsd-bugs@FreeBSD.ORG Tue Sep 2 10:30:08 2014 Return-Path: Delivered-To: freebsd-bugs@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1E47A2D9 for ; Tue, 2 Sep 2014 10:30:08 +0000 (UTC) Received: from mail-wi0-x22c.google.com (mail-wi0-x22c.google.com [IPv6:2a00:1450:400c:c05::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id A8F451AF2 for ; Tue, 2 Sep 2014 10:30:07 +0000 (UTC) Received: by mail-wi0-f172.google.com with SMTP id n3so14041028wiv.11 for ; Tue, 02 Sep 2014 03:30:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=message-id:date:from:user-agent:mime-version:to:subject :content-type; bh=ZDL6pZIZRPRnPeu1XAWGXQos86s7/wyj8GXJw5uVHdM=; b=bztIs3utgPBqqRTSoMFPRkzKrmzyxrdlqQH4xINwzMdcSNE4mHBpD2/1mOMOwfSoxF rH0KqyzbE9ovLPgUO5GO+K7okmZNGQIf5VcmWfDSX7/PqChJEbADFdNVKP69JBKwCO70 yJXha2RCDPMQuqaTavL4GWneLqd1/xzOJdivIxFU/h+L0xt26jrKBIPQYH1X6VpOGbWd rpLWj9xkXnsn9frBHOcTggi81QctgtUiPncZo/bfVj11OE1k3oioPc1IkWhWRqwujm7z ftQayjrym8bK1J7J8Xn+nafkQBcGDVAWypWYKgluEhvxiIFIbjgUh7IXFnh3339so+SD o/NA== X-Received: by 10.195.13.2 with SMTP id eu2mr9609129wjd.88.1409653805812; Tue, 02 Sep 2014 03:30:05 -0700 (PDT) Received: from chevre.local (84-73-156-164.dclient.hispeed.ch. [84.73.156.164]) by mx.google.com with ESMTPSA id gl10sm10486281wib.1.2014.09.02.03.30.04 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Tue, 02 Sep 2014 03:30:05 -0700 (PDT) Message-ID: <54059C2C.9090204@gmail.com> Date: Tue, 02 Sep 2014 12:30:04 +0200 From: Kal User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: freebsd-bugs@freebsd.org Subject: libutil: pidfile_ functions may cause leaks Content-Type: multipart/mixed; boundary="------------010005030104010302090804" X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Sep 2014 10:30:08 -0000 This is a multi-part message in MIME format. --------------010005030104010302090804 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Hi, If pidfile_write fails calling ftruncate or pwrite then pfh->pf_fd is set to -1. This will cause pidfile_close and pidfile_remove to both error out without actually freeing the pfh pointer. I have attached a patch which will make pidfile_close and pidfile_remove always cause pfh to be freed. Thanks! --------------010005030104010302090804 Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0"; name="pidfile-leak-fix.patch" Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename="pidfile-leak-fix.patch" --- pidfile.c.orig 2014-09-02 12:08:38.000000000 +0200 +++ pidfile.c 2014-09-02 12:09:35.000000000 +0200 @@ -216,13 +216,10 @@ int error; error = pidfile_verify(pfh); - if (error != 0) { - errno = error; - return (-1); + if (error == 0) { + if (close(pfh->pf_fd) == -1) + error = errno; } - - if (close(pfh->pf_fd) == -1) - error = errno; free(pfh); if (error != 0) { errno = error; @@ -237,16 +234,13 @@ int error; error = pidfile_verify(pfh); - if (error != 0) { - errno = error; - return (-1); - } - - if (unlink(pfh->pf_path) == -1) - error = errno; - if (close(pfh->pf_fd) == -1) { - if (error == 0) + if (error == 0) { + if (unlink(pfh->pf_path) == -1) error = errno; + if (close(pfh->pf_fd) == -1) { + if (error == 0) + error = errno; + } } if (freeit) free(pfh); --------------010005030104010302090804--