Bug#696295: webkit: Sets FD_CLOEXEC incorrectly with F_SETFL instead of F_SETFD

[Guillem Jover]

Source: webkit
Version: 1.9.2-1
Severity: important
Tags: patch
User: debian-...@lists.debian.org
Usertags: fcntl-fd-cloexec

Hi!

This package contains code that tries to set the FD_CLOEXEC flag for a
file descriptor, but it does using F_SETFL instead of F_SETFD.

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at
worst to terminate execution.

Attached a patch fixing this.

Thanks,
Guillem

From 11a42b913f468a08ef8b390982167fe58fa87bdf Mon Sep 17 00:00:00 2001
From: Guillem Jover <guil...@hadrons.org>
Date: Wed, 19 Dec 2012 00:27:32 +0100
Subject: [PATCH] webkit: Set FD_CLOEXEC correctly using F_SETFD not F_SETFL

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at worst
to terminate execution.
---
 Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
index 7cb1f32..14ae1c8 100644
--- a/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
@@ -348,7 +348,7 @@ static ssize_t readBytesFromSocket(int socketDescriptor, uint8_t* buffer, int co
                 memcpy(fileDescriptors, CMSG_DATA(controlMessage), sizeof(int) * *fileDescriptorsCount);
 
                 for (size_t i = 0; i < *fileDescriptorsCount; ++i) {
-                    while (fcntl(fileDescriptors[i], F_SETFL, FD_CLOEXEC) == -1) {
+                    while (fcntl(fileDescriptors[i], F_SETFD, FD_CLOEXEC) == -1) {
                         if (errno != EINTR) {
                             ASSERT_NOT_REACHED();
                             break;
-- 
1.8.1.rc0