autofs-5.0.1 - init fd on rpc create From: Ian Kent <raven@themaw.net> If a host name lookup fails in create_udp_client() or create_tcp_client() then we immediately got to an error exit. When we exit upon an error the value of the (stack variable) fd is checked and if it appears to be a valid file descriptor it is closed. However, fd isn't initialized which could lead to incorrectly closing a descriptor that is in use. --- lib/rpc_subs.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- autofs-5.0.1.orig/lib/rpc_subs.c +++ autofs-5.0.1/lib/rpc_subs.c @@ -63,6 +63,8 @@ static CLIENT *create_udp_client(struct if (info->proto->p_proto != IPPROTO_UDP) return NULL; + fd = -1; + if (info->client) { if (!clnt_control(info->client, CLGET_FD, (char *) &fd)) { fd = -1; @@ -119,7 +121,7 @@ got_addr: len = sizeof(struct sockaddr_in); if (bind(fd, (struct sockaddr *)&laddr, len) < 0) { close(fd); - fd = RPC_ANYSOCK; + fd = -1; /* FALLTHROUGH */ } } @@ -287,6 +289,8 @@ static CLIENT *create_tcp_client(struct if (info->proto->p_proto != IPPROTO_TCP) return NULL; + fd = -1; + if (info->client) { if (!clnt_control(info->client, CLGET_FD, (char *) &fd)) { fd = -1;