Path: utzoo!attcan!uunet!mcsun!hp4nl!star.cs.vu.nl!maart
From: maart@cs.vu.nl (Maarten Litmaath)
Newsgroups: comp.bugs.4bsd
Subject: in.rshd forgets to close a file descriptor
Message-ID: <7664@star.cs.vu.nl>
Date: 19 Sep 90 18:04:45 GMT
Sender: news@cs.vu.nl
Reply-To: maart@cs.vu.nl (Maarten Litmaath)
Organization: VU Dept. of Computer Science, Amsterdam, The Netherlands
Lines: 66

The following command will hang if the remote Bourne shell doesn't close
every file descriptor > 2 itself:

	rsh machine 'sleep 1000 > /dev/null 2>&1 < /dev/null &'

Cause of the problem: stderr of the remote command is dup()ed from a pipe
which isn't closed afterwards, so even if stderr is redirected to /dev/null
the write side of the pipe still isn't (fully) closed, so in.rshd doesn't
receive an EOF indication until the command has finished.

Though the `standard' Bourne shell and csh _do_ close every unneeded
file descriptor, the in.rshd behavior is definitely buggy.

Lastly the patch below fixes 2 other bugs.

--------------------cut here--------------------
*** in.rshd.c	Wed Sep 19 19:11:21 1990
--- in.rshd.c.new	Wed Sep 19 19:19:30 1990
***************
*** 170,176 ****
  			(void) close(0); (void) close(1); (void) close(2);
  			(void) close(f); (void) close(pv[1]);
  			readfrom = (1<<s) | (1<<pv[0]);
! 			ioctl(pv[1], FIONBIO, (char *)&one);
  			/* should set s nbio! */
  			do {
  				ready = readfrom;
--- 170,176 ----
  			(void) close(0); (void) close(1); (void) close(2);
  			(void) close(f); (void) close(pv[1]);
  			readfrom = (1<<s) | (1<<pv[0]);
! 			ioctl(pv[0], FIONBIO, (char *)&one);
  			/* should set s nbio! */
  			do {
  				ready = readfrom;
***************
*** 197,202 ****
--- 197,203 ----
  		setpgrp(0, getpid());
  		(void) close(s); (void) close(pv[0]);
  		dup2(pv[1], 2);
+ 		close(pv[1]);
  	}
  	if (*pwd->pw_shell == '\0')
  		pwd->pw_shell = "/bin/sh";
***************
*** 213,219 ****
  		cp++;
  	else
  		cp = pwd->pw_shell;
! 	execl(pwd->pw_shell, cp, "-c", cmdbuf, 0);
  	perror(pwd->pw_shell);
  	exit(1);
  protofail:
--- 214,220 ----
  		cp++;
  	else
  		cp = pwd->pw_shell;
! 	execl(pwd->pw_shell, cp, "-c", cmdbuf, (char *) 0);
  	perror(pwd->pw_shell);
  	exit(1);
  protofail:
--------------------cut here--------------------
--
      "That's right, you wanted the "Self-Destruct" button, to your left."
                                 (John Woods)