From f12d80442c6ecb870c043c075cfacb31a899ff81 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Fran=C3=A7ois=20Degros?= Date: Wed, 20 Aug 2025 15:45:32 +1000 Subject: [PATCH] Use sysconf(_SC_OPEN_MAX) on systems without close_range or closefrom Close all the file descriptors in the range [3 .. sysconf(_SC_OPEN_MAX)-1] before executing a filter program to avoid leaking file descriptors into subprocesses. Bug: https://github.com/libarchive/libarchive/issues/2520 --- libarchive/filter_fork_posix.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libarchive/filter_fork_posix.c b/libarchive/filter_fork_posix.c index 0c3d33d8d..7c4851933 100644 --- a/libarchive/filter_fork_posix.c +++ b/libarchive/filter_fork_posix.c @@ -78,7 +78,8 @@ __archive_create_child(const char *cmd, int *child_stdin, int *child_stdout, int stdin_pipe[2], stdout_pipe[2], tmp; #if !defined(POSIX_SPAWN_CLOEXEC_DEFAULT) && \ - (HAVE_FORK || HAVE_VFORK) && (HAVE_CLOSEFROM || HAVE_CLOSE_RANGE) + (HAVE_FORK || HAVE_VFORK) && \ + (HAVE_CLOSEFROM || HAVE_CLOSE_RANGE || defined(_SC_OPEN_MAX)) #undef HAVE_POSIX_SPAWNP #endif @@ -185,6 +186,9 @@ __archive_create_child(const char *cmd, int *child_stdin, int *child_stdout, closefrom(3); #elif HAVE_CLOSE_RANGE close_range(3, ~0U, 0); +#elif defined(_SC_OPEN_MAX) + for (int i = sysconf(_SC_OPEN_MAX); i > 3;) + close(--i); #endif execvp(cmdline->path, cmdline->argv); -- 2.47.2