Bug#696299: chromium-browser: Sets FD_CLOEXEC incorrectly with F_SETFL instead of F_SETFD

[Guillem Jover]

Source: chromium-browser
Version: 22.0.1229.94~r161065-3
Severity: important
Tags: patch
User: debian-...@lists.debian.org
Usertags: fcntl-fd-cloexec

Hi!

This package contains code that tries to set the FD_CLOEXEC flag for a
file descriptor, but it does using F_SETFL instead of F_SETFD.

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at
worst to terminate execution.

Attached a patch fixing this. (I'm filing bug reports for webkit and
the other webkit embedding packages too.)

Thanks,
Guillem

From 034edb78e782772b35a4b27a1c715e9dba0a15ca Mon Sep 17 00:00:00 2001
From: Guillem Jover <guil...@hadrons.org>
Date: Wed, 19 Dec 2012 03:07:55 +0100
Subject: [PATCH] chromium-browser: Set FD_CLOEXEC correctly using F_SETFD not
 F_SETFL

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at worst
to terminate execution.
---
 .../WebKit/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/third_party/WebKit/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp b/src/third_party/WebKit/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
index 885e495..71f822d 100644
--- a/src/third_party/WebKit/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
+++ b/src/third_party/WebKit/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
@@ -346,7 +346,7 @@ static ssize_t readBytesFromSocket(int socketDescriptor, uint8_t* buffer, int co
                 memcpy(fileDescriptors, CMSG_DATA(controlMessage), sizeof(int) * *fileDescriptorsCount);
 
                 for (size_t i = 0; i < *fileDescriptorsCount; ++i) {
-                    while (fcntl(fileDescriptors[i], F_SETFL, FD_CLOEXEC) == -1) {
+                    while (fcntl(fileDescriptors[i], F_SETFD, FD_CLOEXEC) == -1) {
                         if (errno != EINTR) {
                             ASSERT_NOT_REACHED();
                             break;
-- 
1.8.1.rc0