Plug a file descriptor leak.

When sed is asked to inline-edit files, it forgets to close the temporary
file and runs out of descriptors for long command lines (assuming you reset
kern.maxfilesperproc to something sane that's less than the number of files
passed to sed).

1 files changed, 13 insertions, 7 deletions

diff --git a/usr.bin/sed/main.c b/usr.bin/sed/main.c
index 77c89ae..bb5ffec 100644
--- a/usr.bin/sed/main.c
+++ b/usr.bin/sed/main.c
@@ -327,15 +327,21 @@ mf_fgets(SPACE *sp, enum e_spflag spflag)
 		}
 		if (infile != NULL) {
 			fclose(infile);
-			if (*oldfname != '\0' &&
-			    rename(fname, oldfname) != 0) {
-				warn("rename()");
-				unlink(tmpfname);
-				exit(1);
+			if (*oldfname != '\0') {
+				if (rename(fname, oldfname) != 0) {
+					warn("rename()");
+					unlink(tmpfname);
+					exit(1);
+				}
+				*oldfname = '\0';
 			}
-			if (*tmpfname != '\0')
+			if (*tmpfname != '\0') {
+				if (outfile != NULL && outfile != stdout)
+					fclose(outfile);
+				outfile = NULL;
 				rename(tmpfname, fname);
-			*tmpfname = *oldfname = '\0';
+				*tmpfname = '\0';
+			}
 			outfname = NULL;
 		}
 		if (firstfile == 0)