[PATCH] Fix use after free in closedir

[Federico Terraneo]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

closedir() calls _cleanupdir() on a pointer to DIR after a free().
If HAVE_DD_LOCK is defined, it also dereferences the pointer when
calling __lock_release_recursive() and __lock_close_recursive().
This was creating problems in my target.

Moreover, the previous code would not deallocate the struct if
dirp->dd_fd is -1.

Attached is a simple patch to fix the issue.

2013-11-13  Terraneo Federico  <fede.tft@hotmail.it>

	* libc/posix/closedir.c: Fix use after free and
	  memory leak if dirp->dd_fd is -1
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSg2D6AAoJECkLFtN5Xr9fp40H/R2T4R3IYV66wqmmM3FskO0U
4iyWdjzPusRh4lGbTwWGuYa5aNbG/9FP+k64/sRSAWnKtvLJNjlUR2QsGIE592Zq
MYHshpcpEL5h6TwkHS5hBkzdQs0MqbnLBZFUHAS9AGa0k6RpW9sGeAHbv0CqYFUe
/ur3a+KoslSMNpmFLEGI+dSU8It5Gm/6SCPaz7DYhjgd4xg2nrI3hbrfCDcAzCY0
yWl8AfTDSfZFrfkHHjCQzmyHaIKYRAQaCwndEJO1ZUR1Hb+vl+ft6fTWtA/ugifj
MOB4+ruHDIaata9p0E4shh9en5cp/WeL0X/ykk1svdOQq4xYVyd9uxQ5eoPXB4Y=
=7xET
-----END PGP SIGNATURE-----
-------------- next part --------------
A non-text attachment was scrubbed...
Name: closedir.patch
Type: text/x-patch
Size: 569 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/newlib/attachments/20131113/65ccdfb4/attachment.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: closedir.patch.sig
Type: application/octet-stream
Size: 287 bytes
Desc: not available
URL: <http://sourceware.org/pipermail/newlib/attachments/20131113/65ccdfb4/attachment.obj>