io.c: keep fptr read-closed

* io.c (rb_io_close_read): keep fptr in write_io to be discarded, to
  fix freed pointer access when it is in use by other threads, and get
  rid of potential memory/fd leak.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@43112 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

ChangeLog

@@ -1,3 +1,9 @@
+Wed Oct  2 14:18:56 2013  Nobuyoshi Nakada  <nobu@ruby-lang.org>
+
+	* io.c (rb_io_close_read): keep fptr in write_io to be discarded, to
+	  fix freed pointer access when it is in use by other threads, and get
+	  rid of potential memory/fd leak.
+
 Tue Oct  1 23:44:00 2013  Charlie Somerville  <charliesome@ruby-lang.org>
 
 	* vm_core.h: use __attribute__((unused)) in UNINTIALIZED_VAR on clang

io.c

@@ -4432,11 +4432,14 @@ rb_io_close_read(VALUE io)
     write_io = GetWriteIO(io);
     if (io != write_io) {
 	rb_io_t *wfptr;
-        rb_io_fptr_cleanup(fptr, FALSE);
 	GetOpenFile(write_io, wfptr);
         RFILE(io)->fptr = wfptr;
-        RFILE(write_io)->fptr = NULL;
-        rb_io_fptr_finalize(fptr);
+	/* bind to write_io temporarily to get rid of memory/fd leak */
+	fptr->tied_io_for_writing = 0;
+	fptr->mode &= ~FMODE_DUPLEX;
+	RFILE(write_io)->fptr = fptr;
+	rb_io_fptr_cleanup(fptr, FALSE);
+	/* should not finalize fptr because another thread may be reading it */
         return Qnil;
     }