diff --git a/ChangeLog b/ChangeLog index cf32934e1d..8a70d3f6e0 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,9 @@ +Wed Oct 2 14:18:56 2013 Nobuyoshi Nakada + + * io.c (rb_io_close_read): keep fptr in write_io to be discarded, to + fix freed pointer access when it is in use by other threads, and get + rid of potential memory/fd leak. + Tue Oct 1 23:44:00 2013 Charlie Somerville * vm_core.h: use __attribute__((unused)) in UNINTIALIZED_VAR on clang diff --git a/io.c b/io.c index a60c17a92b..053d34f931 100644 --- a/io.c +++ b/io.c @@ -4432,11 +4432,14 @@ rb_io_close_read(VALUE io) write_io = GetWriteIO(io); if (io != write_io) { rb_io_t *wfptr; - rb_io_fptr_cleanup(fptr, FALSE); GetOpenFile(write_io, wfptr); RFILE(io)->fptr = wfptr; - RFILE(write_io)->fptr = NULL; - rb_io_fptr_finalize(fptr); + /* bind to write_io temporarily to get rid of memory/fd leak */ + fptr->tied_io_for_writing = 0; + fptr->mode &= ~FMODE_DUPLEX; + RFILE(write_io)->fptr = fptr; + rb_io_fptr_cleanup(fptr, FALSE); + /* should not finalize fptr because another thread may be reading it */ return Qnil; }