From peter@vk2pj.alcatel.com.au  Tue Jan  7 02:00:21 1997
Received: from gatekeeper.alcatel.com.au (gatekeeper.alcatel.com.au [203.17.66.1])
          by freefall.freebsd.org (8.8.4/8.8.4) with ESMTP id CAA11436
          for <FreeBSD-gnats-submit@freebsd.org>; Tue, 7 Jan 1997 02:00:19 -0800 (PST)
Received: from 139.188.22.50 (139.188.22.50) by gatekeeper.alcatel.com.au
 (PMDF V5.0-5 #11861) id <01IDY1HWJX8W0009BS@gatekeeper.alcatel.com.au> for
 FreeBSD-gnats-submit@freebsd.org; Tue, 07 Jan 1997 20:59:01 +1000
Received: from vk2pj.alcatel.com.au (vk2pj.alcatel.com.au)
 by cbd.alcatel.com.au (PMDF V5.0-5 #9241)
 id <01IDY1GT6WI89QVLFQ@cbd.alcatel.com.au> for
 FreeBSD-gnats-submit@freebsd.org; Tue, 07 Jan 1997 20:58:12 +1100
Received: (from peter@localhost) by vk2pj.alcatel.com.au (8.7.5/8.7.3)
 id UAA03216; Tue, 07 Jan 1997 20:59:33 +1100 (EST)
Message-Id: <199701070959.UAA03216@vk2pj.alcatel.com.au>
Date: Tue, 07 Jan 1997 20:59:33 +1100 (EST)
From: peter.jeremy@alcatel.com.au
Reply-To: peter.jeremy@alcatel.com.au
To: FreeBSD-gnats-submit@freebsd.org
Subject: man(1) leaks file descriptors
X-Send-Pr-Version: 3.2

>Number:         2392
>Category:       gnu
>Synopsis:       man(1) leaks file descriptors
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Jan  7 02:10:02 PST 1997
>Closed-Date:    Thu Jan 9 06:50:47 PST 1997
>Last-Modified:  Thu Jan  9 06:51:09 PST 1997
>Originator:     Peter Jeremy
>Release:        FreeBSD 2.1-STABLE i386
>Organization:
Peter Jeremy (VK2PJ)			peter.jeremy@alcatel.com.au
Alcatel Australia Limited
41 Mandible St				Phone: +61 2 9690 5019
ALEXANDRIA  NSW  2015			Fax:   +61 2 9690 5247
>Environment:

PAGER="exec less"
64 file descriptors

>Description:

The man(1) program opens and does not close two file descriptors for
each manual page found.  If a large number of manual entries are found
in a single execution, then man will fail with various error messages
(see below).

>How-To-Repeat:

$ man `ls /sbin`
After quitting less(1) about 28 times, the following appears:
Pipe call failed
Error executing formatting or display command
system command exited with status 512
No manual entry for mount_mfs
Read access denied for file /usr/share/man/man8/mount_msdos.8.gz
No manual entry for mount_msdos
No manual entry for mount_nfs
...

The permissions on /usr/share/man/man8/mount_msdos.8.gz are 0444.

>Fix:
	
*** /cdrom/usr/src/gnu/usr.bin/man/man/man.c	Tue May 30 01:02:00 1995
--- /usr/src/gnu/usr.bin/man/man/man.c	Sun Dec  8 09:23:45 1996
***************
*** 743,754 ****
   next:
  
    if ((fp = fopen (ult, "r")) == NULL)
-     return buf;
- 
-   if (fgets (buf, BUFSIZ, fp) == NULL)
      return ult;
  
!   if (strlen (buf) < 5)
      return ult;
  
    beg = buf;
--- 743,754 ----
   next:
  
    if ((fp = fopen (ult, "r")) == NULL)
      return ult;
  
!   end = fgets (buf, BUFSIZ, fp);
!   fclose(fp);
! 
!   if (!end || strlen (buf) < 5)
      return ult;
  
    beg = buf;
***************
*** 937,950 ****
      {
        cp = line;
        fgets (line, 100, fp);
        if (*cp++ == '\'' && *cp++ == '\\' && *cp++ == '"' && *cp++ == ' ')
  	{
  	  if (debug)
  	    fprintf (stderr, "parsing directive from file\n");
  
  	  status = parse_roff_directive (cp, file, buf);
- 
- 	  fclose (fp);
  
  	  if (status == 0)
  	    return buf;
--- 937,949 ----
      {
        cp = line;
        fgets (line, 100, fp);
+       fclose(fp);
        if (*cp++ == '\'' && *cp++ == '\\' && *cp++ == '"' && *cp++ == ' ')
  	{
  	  if (debug)
  	    fprintf (stderr, "parsing directive from file\n");
  
  	  status = parse_roff_directive (cp, file, buf);
  
  	  if (status == 0)
  	    return buf;
*** /cdrom/usr/src/gnu/usr.bin/man/man/manpath.c	Tue May 30 01:02:01 1995
--- /usr/src/gnu/usr.bin/man/man/manpath.c	Sat Dec 14 17:57:10 1996
***************
*** 202,210 ****
  
        if (!strncmp ("MANDATORY_MANPATH", bp, 17))
  	{
! 	  if ((p = strchr (bp, ' ')) == NULL)
! 	    if ((p = strchr (bp, '\t')) == NULL)
! 	      return -1;
  
  	  bp = p;
  
--- 202,212 ----
  
        if (!strncmp ("MANDATORY_MANPATH", bp, 17))
  	{
! 	  if ((p = strchr (bp, ' ')) == NULL &&
! 	      (p = strchr (bp, '\t')) == NULL) {
! 	    fclose(config);
! 	    return -1;
! 	  }
  
  	  bp = p;
  
***************
*** 224,232 ****
  	}
        else if (!strncmp ("MANPATH_MAP", bp, 11))
  	{
! 	  if ((p = strchr (bp, ' ')) == NULL)
! 	    if ((p = strchr (bp, '\t')) == NULL)
! 	      return -1;
  
  	  bp = p;
  
--- 226,236 ----
  	}
        else if (!strncmp ("MANPATH_MAP", bp, 11))
  	{
! 	  if ((p = strchr (bp, ' ')) == NULL &&
! 	      (p = strchr (bp, '\t')) == NULL) {
! 	    fclose(config);
! 	    return -1;
! 	  }
  
  	  bp = p;
  
***************
*** 259,264 ****
--- 263,269 ----
        dlp++;
      }
  
+   fclose(config);
    dlp->bin[0] = '\0';
    dlp->mandir[0] = '\0';
    dlp->mandatory = 0;
>Release-Note:
>Audit-Trail:

From: Mike Pritchard <mpp>
To: peter.jeremy@alcatel.com.au
Cc: FreeBSD-gnats-submit@freebsd.org
Subject: Re: gnu/2392: man(1) leaks file descriptors
Date: Tue, 7 Jan 1997 23:31:23 -0800 (PST)

 I can still get man to fail even with the supplied patch.
 You must have missed a leak or two.  In my case, /usr/share/man/cat*
 is not writable to the man program, which may be
 where the leak is in my case.
 
 peter.jeremy@alcatel.com.au wrote:
 > 
 > 
 > >Number:         2392
 > >Category:       gnu
 > >Synopsis:       man(1) leaks file descriptors
 > 
 > PAGER="exec less"
 > 64 file descriptors
 > 
 > >Description:
 > 
 > The man(1) program opens and does not close two file descriptors for
 > each manual page found.  If a large number of manual entries are found
 > in a single execution, then man will fail with various error messages
 > (see below).
 > 
 > >How-To-Repeat:
 > 
 > $ man `ls /sbin`
 > After quitting less(1) about 28 times, the following appears:
 > Pipe call failed
 > Error executing formatting or display command
 > system command exited with status 512
 > No manual entry for mount_mfs
 > Read access denied for file /usr/share/man/man8/mount_msdos.8.gz
 > No manual entry for mount_msdos
 > No manual entry for mount_nfs
 > ...
 > 
 > The permissions on /usr/share/man/man8/mount_msdos.8.gz are 0444.
 > 
 > >Fix:
 > 	
 -- 
 Mike Pritchard
 mpp@FreeBSD.org
 "Go that way.  Really fast.  If something gets in your way, turn"
State-Changed-From-To: open->closed 
State-Changed-By: mpp 
State-Changed-When: Thu Jan 9 06:50:47 PST 1997 
State-Changed-Why:  
Revised patches from author applied. 
>Unformatted:
