From: Eric Wong <e@80x24.org>
Date: Thu, 12 May 2016 07:59:39 GMT
Subject: Re: [PATCH 2/2] am: plug FILE * leak in split_mail_conv()
Message-ID: <20160512075939.GA31343@dcvr.yhbt.net>
In-Reply-To: <20160512044730.GA5436@sigill.intra.peff.net>

Jeff King <peff@peff.net> wrote:
> On Wed, May 11, 2016 at 04:35:46PM -0700, Junio C Hamano wrote:
> > +++ b/builtin/am.c
> > @@ -761,9 +761,11 @@ static int split_mail_conv(mail_conv_fn fn, struct am_state *state,
> >  		mail = mkpath("%s/%0*d", state->dir, state->prec, i + 1);
> >  
> >  		out = fopen(mail, "w");
> > -		if (!out)
> > +		if (!out) {
> > +			fclose(in);
> >  			return error(_("could not open '%s' for writing: %s"),
> >  					mail, strerror(errno));
> > +		}
> 
> Presumably `fclose` doesn't ever overwrite errno in practice, but I
> guess it could in theory.

I think both patches in this series would benefit from capturing
errno before cleanup.  `fclose` can call `free`, and `free` could
do any manner of things such as calling `madvise` with a flag
not implemented in the running kernel, or failing an optional
trylock without being fatal.

There's lots of non-standard malloc implementations out there :)

So I'm not sure if there's ever a guarantee that a non-error
function call preserves `errno`.