git: 7dd39ef4e0d5 - main - comm: close a race condition when comm is fed from stdin

From: Allan Jude <allanjude_at_FreeBSD.org>
Date: Thu, 06 Jun 2024 17:06:43 UTC
The branch main has been updated by allanjude:

URL: https://cgit.FreeBSD.org/src/commit/?id=7dd39ef4e0d56b213445754a189d204b70a77a00

commit 7dd39ef4e0d56b213445754a189d204b70a77a00
Author:     Cosimo Cecchi <cosimo@apple.com>
AuthorDate: 2024-06-06 16:51:43 +0000
Commit:     Allan Jude <allanjude@FreeBSD.org>
CommitDate: 2024-06-06 17:04:38 +0000

    comm: close a race condition when comm is fed from stdin
    
    If one of the files has ended, we won't show the column, but we still
    need to drain the file pointer to avoid potentially hitting a pipe
    failure.
    
    This commit moves the NULL offset checks inside show() so that getline()
    and ferror() are still called on fp.
    
    Reviewed by:    allanjude
    Sponsored by:   Apple Inc.
    Differential Revision:  https://reviews.freebsd.org/D45440
---
 usr.bin/comm/comm.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/usr.bin/comm/comm.c b/usr.bin/comm/comm.c
index 2f305e23ce8f..4dcd7cc9a2dd 100644
--- a/usr.bin/comm/comm.c
+++ b/usr.bin/comm/comm.c
@@ -129,12 +129,12 @@ main(int argc, char *argv[])
 
 		/* if one file done, display the rest of the other file */
 		if (n1 < 0) {
-			if (n2 >= 0 && col2 != NULL)
+			if (n2 >= 0)
 				show(fp2, argv[1], col2, &line2, &line2len);
 			break;
 		}
 		if (n2 < 0) {
-			if (n1 >= 0 && col1 != NULL)
+			if (n1 >= 0)
 				show(fp1, argv[0], col1, &line1, &line1len);
 			break;
 		}
@@ -206,10 +206,12 @@ show(FILE *fp, const char *fn, const char *offset, char **bufp, size_t *buflenp)
 	ssize_t n;
 
 	do {
-		(void)printf("%s%s\n", offset, *bufp);
+		/* offset is NULL when draining fp, not printing */
+		if (offset != NULL)
+			(void)printf("%s%s\n", offset, *bufp);
 		if ((n = getline(bufp, buflenp, fp)) < 0)
 			break;
-		if (n > 0 && (*bufp)[n - 1] == '\n')
+		if (n > 0 && offset != NULL && (*bufp)[n - 1] == '\n')
 			(*bufp)[n - 1] = '\0';
 	} while (1);
 	if (ferror(fp))