Re: bug with eval, proc-subst and pipes

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Sat, 20 Jul 2013 18:11:44 +0100
Peter Stephenson <p.w.stephenson@xxxxxxxxxxxx> wrote:
> On Fri, 19 Jul 2013 21:58:53 +0100
> Stephane Chazelas <stephane.chazelas@xxxxxxxxx> wrote:
> > and fd 13 by closedumps() (the missing link to compinit?).
> 
> That's distinctly suspicious, if 13 was opened for the process
> substitution.
> 
> Does the following fix it, or is there yet more?

It did, apart from the other bit.

> If it does we still have an error for older systems, but I suspect
> FD_CLOEXEC (and O_CLOEXEC) are widely enough supported that may be more
> a theoretical then an actual problem.

This removes the side effects of the error in this case by properly
removing the dump record instead of just trimming it inconsistently, so
no one will try to use the closed file descriptor in the parent shell.

However, it presumably implies there are cases where the dump is being
removed where it doesn't need to be, which is the only way that could
trigger reuse of the file descriptor in the dump record.  The only
obvious way that could happen is a failed exec without a fork.  That's a
slightly strange to thing to happen in your main shell: it would mean
you're trying to replace it with something else but gave up and shrugged
your shoulders and carried on using it.  So there's presumably still
some aspect I'm missing.

diff --git a/Src/parse.c b/Src/parse.c
index b670925..0c2a458 100644
--- a/Src/parse.c
+++ b/Src/parse.c
@@ -3418,6 +3418,16 @@ incrdumpcount(FuncDump f)
     f->count++;
 }
 
+/**/
+static void
+freedump(FuncDump f)
+{
+    munmap((void *) f->addr, f->len);
+    zclose(f->fd);
+    zsfree(f->filename);
+    zfree(f, sizeof(*f));
+}
+
 /* Decrement the reference counter for a dump file. If zero, unmap the file. */
 
 /**/
@@ -3434,10 +3444,7 @@ decrdumpcount(FuncDump f)
 		q->next = p->next;
 	    else
 		dumps = p->next;
-	    munmap((void *) f->addr, f->len);
-	    zclose(f->fd);
-	    zsfree(f->filename);
-	    zfree(f, sizeof(*f));
+	    freedump(f);
 	}
     }
 }
@@ -3447,10 +3454,11 @@ decrdumpcount(FuncDump f)
 mod_export void
 closedumps(void)
 {
-    FuncDump p;
-
-    for (p = dumps; p; p = p->next)
-	zclose(p->fd);
+    while (dumps) {
+	FuncDump p = dumps->next;
+	freedump(dumps);
+	dumps = p;
+    }
 }
 #endif