From 3a8da53d02d252b6c3403190af8bbcb030259bd4 Mon Sep 17 00:00:00 2001
From: Thomas Zimmermann <tdz@users.sourceforge.net>
Date: Wed, 1 Oct 2014 10:50:33 +0200
Subject: [PATCH] Bug 1074419: Close received socket file descriptors on
 errors, r=shawnjohnjr

---
 dom/bluetooth/bluedroid/BluetoothSocket.cpp              | 5 ++++-
 dom/bluetooth/bluedroid/BluetoothSocketHALInterface.cpp  | 5 +++++
 dom/bluetooth2/bluedroid/BluetoothSocket.cpp             | 5 ++++-
 dom/bluetooth2/bluedroid/BluetoothSocketHALInterface.cpp | 5 +++++
 4 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/dom/bluetooth/bluedroid/BluetoothSocket.cpp b/dom/bluetooth/bluedroid/BluetoothSocket.cpp
index 4b89d23c17d..1be128eafd7 100644
--- a/dom/bluetooth/bluedroid/BluetoothSocket.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothSocket.cpp
@@ -363,6 +363,8 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
+    mozilla::ScopedClose fd(aFd); // Close received socket fd on error
+
     if (mImpl->IsShutdownOnMainThread()) {
       BT_LOGD("mConsumer is null, aborting receive!");
       return;
@@ -374,7 +376,8 @@ public:
     }
 
     mImpl->mConsumer->SetAddress(aBdAddress);
-    XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new AcceptTask(mImpl, aFd));
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+                                     new AcceptTask(mImpl, fd.forget()));
   }
 
   void OnError(BluetoothStatus aStatus) MOZ_OVERRIDE
diff --git a/dom/bluetooth/bluedroid/BluetoothSocketHALInterface.cpp b/dom/bluetooth/bluedroid/BluetoothSocketHALInterface.cpp
index a024dd79420..fcfc6f8b98b 100644
--- a/dom/bluetooth/bluedroid/BluetoothSocketHALInterface.cpp
+++ b/dom/bluetooth/bluedroid/BluetoothSocketHALInterface.cpp
@@ -9,6 +9,7 @@
 #include <unistd.h>
 #include <sys/socket.h>
 #include "BluetoothHALHelpers.h"
+#include "mozilla/FileUtils.h"
 #include "nsClassHashtable.h"
 #include "nsXULAppAPI.h"
 
@@ -485,6 +486,10 @@ public:
 
   void Proceed(BluetoothStatus aStatus) MOZ_OVERRIDE
   {
+    if ((aStatus != STATUS_SUCCESS) && (GetClientFd() != -1)) {
+      mozilla::ScopedClose(GetClientFd()); // Close received socket fd on error
+    }
+
     DispatchBluetoothSocketHALResult(
       GetResultHandler(), &BluetoothSocketResultHandler::Accept,
       GetClientFd(), GetBdAddress(), GetConnectionStatus(), aStatus);
diff --git a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
index 4991f0d6292..f63ccb9b6f6 100644
--- a/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothSocket.cpp
@@ -363,6 +363,8 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
+    mozilla::ScopedClose fd(aFd); // Close received socket fd on error
+
     if (mImpl->IsShutdownOnMainThread()) {
       BT_LOGD("mConsumer is null, aborting receive!");
       return;
@@ -374,7 +376,8 @@ public:
     }
 
     mImpl->mConsumer->SetAddress(aBdAddress);
-    XRE_GetIOMessageLoop()->PostTask(FROM_HERE, new AcceptTask(mImpl, aFd));
+    XRE_GetIOMessageLoop()->PostTask(FROM_HERE,
+                                     new AcceptTask(mImpl, fd.forget()));
   }
 
   void OnError(BluetoothStatus aStatus) MOZ_OVERRIDE
diff --git a/dom/bluetooth2/bluedroid/BluetoothSocketHALInterface.cpp b/dom/bluetooth2/bluedroid/BluetoothSocketHALInterface.cpp
index eb2cb5c019f..e0bb66bf6de 100644
--- a/dom/bluetooth2/bluedroid/BluetoothSocketHALInterface.cpp
+++ b/dom/bluetooth2/bluedroid/BluetoothSocketHALInterface.cpp
@@ -9,6 +9,7 @@
 #include <sys/socket.h>
 #include <unistd.h>
 #include "BluetoothHALHelpers.h"
+#include "mozilla/FileUtils.h"
 #include "nsClassHashtable.h"
 #include "nsXULAppAPI.h"
 
@@ -485,6 +486,10 @@ public:
 
   void Proceed(BluetoothStatus aStatus) MOZ_OVERRIDE
   {
+    if ((aStatus != STATUS_SUCCESS) && (GetClientFd() != -1)) {
+      mozilla::ScopedClose(GetClientFd()); // Close received socket fd on error
+    }
+
     DispatchBluetoothSocketHALResult(
       GetResultHandler(), &BluetoothSocketResultHandler::Accept,
       GetClientFd(), GetBdAddress(), GetConnectionStatus(), aStatus);