Use O_CLOEXEC for exec-safety in MMDB_open
Otherwise, a program which might concurrently call MMDB_open() and
fork()->exec() in different threads of execution cannot prevent the
possible leak of a copy of the temporary database filehandle to the new
child process.
@@ -375,7 +375,11 @@ LOCAL int map_file(MMDB_s *const mmdb)
ssize_t size;
int status = MMDB_SUCCESS;
- int fd = open(mmdb->filename, O_RDONLY);
+ int flags = O_RDONLY;
+#if _POSIX_VERSION >= 200809L
+ flags |= O_CLOEXEC;
+#endif
+ int fd = open(mmdb->filename, flags);
struct stat s;
if (fd < 0 || fstat(fd, &s)) {
status = MMDB_FILE_OPEN_ERROR;
