- djm@cvs.openbsd.org 2010/01/29 00:20:41

     [sshd.c]
     set FD_CLOEXEC on sock_in/sock_out; bz#1706 from jchadima AT redhat.com
     ok dtucker@

diff --git a/ChangeLog b/ChangeLog
index f9a84fddf2030bc6a0952ad836c00d52371b7ce6..67cf0fc1df6068340a4fb1981f4aa7b877bb9e7e 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,10 @@
      downgrade an error() to a debug() - this particular case can be hit in
      normal operation for certain sequences of mux slave vs session closure
      and is harmless
+   - djm@cvs.openbsd.org 2010/01/29 00:20:41
+     [sshd.c]
+     set FD_CLOEXEC on sock_in/sock_out; bz#1706 from jchadima AT redhat.com
+     ok dtucker@
 
 20100129
  - (dtucker) [openbsd-compat/openssl-compat.c] Bug #1707: Call OPENSSL_config()

diff --git a/mux.c b/mux.c
index 64781d44ccdd887b37d201c2582098fcc4bdbd60..0e07883e4666f0cb5181cb440121f50dd1f2dfef 100644 (file)
--- a/mux.c
+++ b/mux.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: mux.c,v 1.12 2010/01/27 13:26:17 djm Exp $ */
+/* $OpenBSD: mux.c,v 1.13 2010/01/29 20:16:17 djm Exp $ */
 /*
  * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org>
  *
@@ -212,7 +212,7 @@ mux_master_control_cleanup_cb(int cid, void *unused)
                sc->ctl_chan = -1;
                if (sc->type != SSH_CHANNEL_OPEN) {
                        debug2("%s: channel %d: not open", __func__, sc->self);
-                       chan_mark_dead(c);
+                       chan_mark_dead(sc);
                } else {
                        chan_read_failed(sc);
                        chan_write_failed(sc);

diff --git a/sshd.c b/sshd.c
index d84db897c2831cd8def0d67e8f2de49aeafc00c3..bf2e76cc8ef45a368a5ede22c9d1ddde8e5562f5 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.371 2010/01/13 03:48:13 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.372 2010/01/29 00:20:41 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1748,6 +1748,10 @@ main(int ac, char **av)
                    sock_in, sock_out, newsock, startup_pipe, config_s[0]);
        }
 
+       /* Executed child processes don't need these. */
+       fcntl(sock_out, F_SETFD, FD_CLOEXEC);
+       fcntl(sock_in, F_SETFD, FD_CLOEXEC);
+
        /*
         * Disable the key regeneration alarm.  We will not regenerate the
         * key since we are no longer in a position to give it to anyone. We