fix fd leak in tmpfile when the fdopen operation fails

this condition could only happen due to malloc failure.

the fdopen operation is also moved to take place after the unlink to
minimize the window during which a link to the file exists in the
directory table.

1 files changed, 2 insertions, 1 deletions

diff --git a/src/stdio/tmpfile.c b/src/stdio/tmpfile.c
index a7d0000a..525090aa 100644
--- a/src/stdio/tmpfile.c
+++ b/src/stdio/tmpfile.c
@@ -16,12 +16,13 @@ FILE *tmpfile(void)
 		__randname(s+13);
 		fd = sys_open(s, O_RDWR|O_CREAT|O_EXCL, 0600);
 		if (fd >= 0) {
-			f = __fdopen(fd, "w+");
 #ifdef SYS_unlink
 			__syscall(SYS_unlink, s);
 #else
 			__syscall(SYS_unlinkat, AT_FDCWD, s, 0);
 #endif
+			f = __fdopen(fd, "w+");
+			if (!f) __syscall(SYS_close, fd);
 			return f;
 		}
 	}