Resource leak caused by the mismatch of pcap_create and pcap_close

[PromptFuzz]

Hi,
I have found that if call pcap_close() intermediatly after the pcap_create() could cause a eventfd leak.

The example code is:

    if (pcap_findalldevs(&devs, errbuf) == -1) {
     ...
    }
    // Open first device for capturing
    handle = pcap_create(devs->name, errbuf);
    //pcap_activate(handle);
    pcap_close(handle);   

My environment :
OS: CentOS 5.4
Run with non-privileged user account

Rerpoduce:
In
poc.zip.

I have noticed that pcap_create has announced:

The returned handle must be activated with pcap_activate(3PCAP) before packets can be captured with it;

Actually, the leak was disappeared if i called pcap_activate(handle); after the pcap_create().
But, for general use, the pcap_create and pcap_close should be match, regardless whether we use or not use the returned handler.

[PromptFuzz]

I have provided a PR to fix this issue: #1235

[guyharris]

But, for general use, the pcap_create and pcap_close should be match, regardless whether we use or not use the returned handler.

Yes, the eventfd shouldn't be opened until we need it, so it should be opened in the activate routine, not the create routine. See pull request #1236.

[guyharris]

Fixed in c62d3d3.