io.c: keep fptr read-closed

* io.c (rb_io_close_read): keep fptr in write_io to be discarded, to
  fix freed pointer access when it is in use by other threads, and get
  rid of potential memory/fd leak.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@43112 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

1 files changed, 6 insertions, 3 deletions

diff --git a/io.c b/io.c
index a60c17a92b..053d34f931 100644
--- a/io.c
+++ b/io.c
@@ -4432,11 +4432,14 @@ rb_io_close_read(VALUE io)
     write_io = GetWriteIO(io);
     if (io != write_io) {
 	rb_io_t *wfptr;
-        rb_io_fptr_cleanup(fptr, FALSE);
 	GetOpenFile(write_io, wfptr);
         RFILE(io)->fptr = wfptr;
-        RFILE(write_io)->fptr = NULL;
-        rb_io_fptr_finalize(fptr);
+	/* bind to write_io temporarily to get rid of memory/fd leak */
+	fptr->tied_io_for_writing = 0;
+	fptr->mode &= ~FMODE_DUPLEX;
+	RFILE(write_io)->fptr = fptr;
+	rb_io_fptr_cleanup(fptr, FALSE);
+	/* should not finalize fptr because another thread may be reading it */
         return Qnil;
     }