popen-leaks

p.c

#include <stdio.h>

int main(){
	/* foo for leak */
	FILE *foo = fopen("foo", "r");
	if (!foo)
		return 1;
	char buf[256];
	/* read one byte */
	if (!fread(buf, 1, 1, foo))
		return 2;
	FILE *pipe = popen("ruby r.rb", "r");
	if (!pipe)
		return 3;
	char *s;
	while (s = fgets(buf, sizeof(buf), pipe)) {
		printf("%s", buf);
	}
	if (!feof(pipe))
		return 4;
	fclose(foo);
	pclose(pipe);
	return 0;
}

r.rb

#!/usr/bin/env ruby

# finds all open file descriptors

3.upto(4096) do |i|
  begin
    if io = IO::new(i)
      puts i
      io.close
    end
  rescue ArgumentError, Errno::EBADF
  end
end