Project

General

Profile

Actions
Copy link

Bug #13796

open

libuuid: map_state() leaks file when mmap() fails

Added by Marcel Telka over 2 years ago. Updated over 2 years ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
lib - userland libraries
Start date:
Due date:
% Done:

0%

Estimated time:
Difficulty:
Medium
Tags:
Gerrit CR:
External Bug:

Description

When mmap() fails in map_state() the fd is not closed and leaks at line 273:

269      data = (shared_buffer_t *)mmap(NULL, sizeof (shared_buffer_t),
270          PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);
271  
272      if (data == MAP_FAILED)
273          return (-1);
274  
275      (void) mutex_init(&data->lock, USYNC_PROCESS|LOCK_ROBUST, 0);
276  
277      (void) close(fd);
Actions
Copy link
 #1

Updated by Marcel Telka over 2 years ago

  • Subject changed from map_state() leaks file when mmap() fails to libuuid: map_state() leaks file when mmap() fails
Actions
Copy link
 #2

Updated by Marcel Telka over 2 years ago

The situation seems to be even worse:

In a case the the mmap() fails we will also leave file_type set to a non-zero value. With this, any subsequent call to map_state() will succeed (return 1), leaving silently data set to MAP_FAILED (-1) and confusing all map_state() callers - currently it is uuid_create() only.

Actions
Copy link

Also available in: Atom PDF