Re: fd used for saving redirected fds leaked to child processes

[Peter Stephenson <p.stephenson@xxxxxxxxxxx>]

On Fri, 29 Sep 2017 15:06:24 +0000
Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx> wrote:
> % Src/zsh -fc ': 3>&1' 
> 1: Src/exec.c:2330: Saved file descriptor not marked as internal

That happens if the file descriptor was already closed, in which case
the new code is inapplicable, so this would access off the start
of the array.

pws

diff --git a/Src/exec.c b/Src/exec.c
index 0d2dc4e..f2e187a 100644
--- a/Src/exec.c
+++ b/Src/exec.c
@@ -2325,16 +2325,19 @@ addfd(int forked, int *save, struct multio **mfds, int fd1, int fd2, int rflag,
 		     * fd1 may already be closed here, so
 		     * ignore bad file descriptor error
 		     */
-		    if (fdN < 0 && errno != EBADF) {
-			zerr("cannot duplicate fd %d: %e", fd1, errno);
-			mfds[fd1] = NULL;
-			closemnodes(mfds);
-			return;
+		    if (fdN < 0) {
+			if (errno != EBADF) {
+			    zerr("cannot duplicate fd %d: %e", fd1, errno);
+			    mfds[fd1] = NULL;
+			    closemnodes(mfds);
+			    return;
+			}
+		    } else {
+			DPUTS(fdtable[fdN] != FDT_INTERNAL,
+			      "Saved file descriptor not marked as internal");
+			fdtable[fdN] |= FDT_SAVED_MASK;
 		    }
 		    save[fd1] = fdN;
-		    DPUTS(fdtable[fdN] != FDT_INTERNAL,
-			  "Saved file descriptor not marked as internal");
-		    fdtable[fdN] |= FDT_SAVED_MASK;
 		}
 	    }
 	}