fix fd leak in tmpfile when the fdopen operation fails

this condition could only happen due to malloc failure.

the fdopen operation is also moved to take place after the unlink to
minimize the window during which a link to the file exists in the
directory table.

diff --git a/src/stdio/tmpfile.c b/src/stdio/tmpfile.c
index a7d0000aecaeec7b9bae5e4fe235286706b22bf4..525090aa066d49cc20a4a762b17a4d54a3ec1b4f 100644 (file)
--- a/src/stdio/tmpfile.c
+++ b/src/stdio/tmpfile.c
@@ -16,12 +16,13 @@ FILE *tmpfile(void)
                __randname(s+13);
                fd = sys_open(s, O_RDWR|O_CREAT|O_EXCL, 0600);
                if (fd >= 0) {
-                       f = __fdopen(fd, "w+");
 #ifdef SYS_unlink
                        __syscall(SYS_unlink, s);
 #else
                        __syscall(SYS_unlinkat, AT_FDCWD, s, 0);
 #endif
+                       f = __fdopen(fd, "w+");
+                       if (!f) __syscall(SYS_close, fd);
                        return f;
                }
        }