From aed1bf71de2d644767e8b1c0f57fa56828ec712c Mon Sep 17 00:00:00 2001
From: Alcor <alcor@tilde.club>
Date: Mon, 18 May 2026 18:36:41 +0200
Subject: [PATCH 17/19] drop any emulated/anonymous file descriptors if given
 as keys

---
 irc.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/irc.c b/irc.c
index 28e557b..a0e28a7 100644
--- a/irc.c
+++ b/irc.c
@@ -46,6 +46,16 @@
 static struct tls *client;
 static struct tls_config *config;
 
+static void drop(const char *path) {
+	int fd = -1;
+	pid_t pid;
+	if (sscanf(path, "/proc/%d/fd/%d", &pid, &fd) == 2 && pid == getpid()) goto success;
+	if (sscanf(path, "/proc/self/fd/%d", &fd) == 1) goto success;
+	if (sscanf(path, "/dev/fd/%d", &fd) == 1) goto success;
+success:
+	if (fd >= 0) close(fd);
+}
+
 void ircConfig(
 	bool insecure, const char *trust, const char *cert, const char *priv
 ) {
@@ -63,7 +73,7 @@ void ircConfig(
 		tls_config_insecure_noverifyname(config);
 		for (int i = 0; configPath(buf, sizeof(buf), trust, i); ++i) {
 			error = tls_config_set_ca_file(config, buf);
-			if (!error) break;
+			if (!error) { drop(buf); break; }
 		}
 		if (error) errx(1, "%s: %s", trust, tls_config_error(config));
 	}
@@ -76,6 +86,7 @@ void ircConfig(
 		const char *ca = tls_default_ca_cert_file();
 		error = tls_config_set_ca_file(config, ca);
 		if (error) errx(1, "%s: %s", ca, tls_config_error(config));
+		drop(ca);
 	}
 #endif
 
@@ -86,14 +97,14 @@ void ircConfig(
 			} else {
 				error = tls_config_set_keypair_file(config, buf, buf);
 			}
-			if (!error) break;
+			if (!error) { drop(buf); break; }
 		}
 		if (error) errx(1, "%s: %s", cert, tls_config_error(config));
 	}
 	if (priv) {
 		for (int i = 0; configPath(buf, sizeof(buf), priv, i); ++i) {
 			error = tls_config_set_key_file(config, buf);
-			if (!error) break;
+			if (!error) { drop(buf); break;}
 		}
 		if (error) errx(1, "%s: %s", priv, tls_config_error(config));
 	}
-- 
2.47.3

