RTEMS | libcsupport: Fix return value and errno on duplicate open failure (!1392)

[Yang Zhang (@Chloe)]

Yang Zhang created a merge request: https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1392

Project:Branches: Chloe/rtems:fix-fcntl-uaf-on-dup-error to rtems/rtos/rtems:main
Author:   Yang Zhang



## Summary

In duplicate_iop() and duplicate2_iop(), when the open handler (open_h) returns a non-zero status (e.g. positive errno), the open descriptor was freed via rtems_libio_free(), but the non-zero status value was returned directly to fcntl()/dup2(). 

If open_h returned a positive errno value, fcntl()/dup2() would return it as a positive file descriptor even though the descriptor had been freed, leading to Use-After-Free (UAF) vulnerabilities. 

Fix this by setting errno if rv \> 0 and ensuring rv = -1 is returned on error, satisfying POSIX compliance.

## Generative AI

None

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/merge_requests/1392
You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/5-el1dl00b1u5lxrolc8vhk4zsi-1d/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260812/a457e439/attachment-0001.htm>