Bug#696296: qtwebkit: Sets FD_CLOEXEC incorrectly with F_SETFL instead of F_SETFD

[Guillem Jover]

Source: qtwebkit
Version: 2.2.1-5
Severity: important
Tags: patch
User: debian-...@lists.debian.org
Usertags: fcntl-fd-cloexec

Hi!

This package contains code that tries to set the FD_CLOEXEC flag for a
file descriptor, but it does using F_SETFL instead of F_SETFD.

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at
worst to terminate execution.

Attached a patch fixing this. (I'm filing bug reports for webkit and
the other packages embedding webkit too.)

Thanks,
Guillem

From a2bc96adfe779c5d33933a3fde8b9bef6a43bd7b Mon Sep 17 00:00:00 2001
From: Guillem Jover <guil...@hadrons.org>
Date: Wed, 19 Dec 2012 00:51:08 +0100
Subject: [PATCH] qtwebkit: Set FD_CLOEXEC correctly using F_SETFD not F_SETFL

Using that value on F_SETFL is just wrong, and might make the call fail
on some systems, as it's requesting to set an undetermined flag. For
example on GNU/* FD_CLOEXEC has value 1, which matches with O_WRONLY.

This might cause the code to at least leak file descriptors, and at worst
to terminate execution.
---
 Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
index 92ffff3..588a3a6 100644
--- a/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
+++ b/Source/WebKit2/Platform/CoreIPC/unix/ConnectionUnix.cpp
@@ -217,7 +217,7 @@ void Connection::readyReadHandler()
                 attachmentCount--;
 
             for (int i = 0; i < attachmentCount; ++i) {
-                while (fcntl(fileDescriptors[i], F_SETFL, FD_CLOEXEC) == -1) {
+                while (fcntl(fileDescriptors[i], F_SETFD, FD_CLOEXEC) == -1) {
                     if (errno != EINTR) {
                         ASSERT_NOT_REACHED();
                         return;
-- 
1.8.1.rc0