2 files changed, 12 insertions, 3 deletions
diff --git a/ChangeLog b/ChangeLog
index cf32934e1d..8a70d3f6e0 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Wed Oct  2 14:18:56 2013  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* io.c (rb_io_close_read): keep fptr in write_io to be discarded, to
+	  fix freed pointer access when it is in use by other threads, and get
+	  rid of potential memory/fd leak.
+
 Tue Oct  1 23:44:00 2013  Charlie Somerville  <charliesome@ruby-lang.org>
 
 	* vm_core.h: use __attribute__((unused)) in UNINTIALIZED_VAR on clang
diff --git a/io.c b/io.c
index a60c17a92b..053d34f931 100644
--- a/io.c
+++ b/io.c
@@ -4432,11 +4432,14 @@ rb_io_close_read(VALUE io)
     write_io = GetWriteIO(io);
     if (io != write_io) {
 	rb_io_t *wfptr;
-        rb_io_fptr_cleanup(fptr, FALSE);
 	GetOpenFile(write_io, wfptr);
         RFILE(io)->fptr = wfptr;
-        RFILE(write_io)->fptr = NULL;
-        rb_io_fptr_finalize(fptr);
+	/* bind to write_io temporarily to get rid of memory/fd leak */
+	fptr->tied_io_for_writing = 0;
+	fptr->mode &= ~FMODE_DUPLEX;
+	RFILE(write_io)->fptr = fptr;
+	rb_io_fptr_cleanup(fptr, FALSE);
+	/* should not finalize fptr because another thread may be reading it */
         return Qnil;
     }