Another problem exists when storing to a non-writable directory
pointed by TANAKA Hirosachi <c1995207@uhura.nit.ac.jp>.

This is one more revised fix.

Index: ftpd.c
===================================================================
RCS file: /usr/local/libdata/cvs/netbsd/libexec/ftpd/ftpd.c,v
retrieving revision 1.1.1.16
diff -u -r1.1.1.16 ftpd.c
--- ftpd.c	2000/03/05 16:17:02	1.1.1.16
+++ ftpd.c	2000/03/19 06:21:21
@@ -1087,7 +1087,6 @@
 	timersub(&finish, &start, &td);
 	tdp = &td;
 	data = -1;
-	pdata = -1;
 done:
 	if (log)
 		logcmd("get", byte_count, name, NULL, tdp, NULL);
@@ -1124,6 +1123,10 @@
 		reply(226, "Transfer complete.");
 	}
  cleanupretrieve:
+	if (pdata >= 0) {
+		(void) close(pdata);
+	}
+	pdata = -1;
 	if (stderrfd != -1)
 		(void)close(stderrfd);
 	if (isconversion)
@@ -1145,7 +1148,7 @@
 	if (unique && stat(name, &st) == 0 &&
 	    (name = gunique(name)) == NULL) {
 		logcmd(desc, -1, name, NULL, NULL, "cannot create unique file");
-		return;
+		goto cleanup;
 	}
 
 	if (restart_point)
@@ -1156,7 +1159,7 @@
 	if (fout == NULL) {
 		perror_reply(553, name);
 		logcmd(desc, -1, name, NULL, NULL, strerror(errno));
-		return;
+		goto cleanup;
 	}
 	byte_count = -1;
 	if (restart_point) {
@@ -1202,10 +1205,14 @@
 	timersub(&finish, &start, &td);
 	tdp = &td;
 	data = -1;
-	pdata = -1;
 done:
 	logcmd(desc, byte_count, name, NULL, tdp, NULL);
 	(*closefunc)(fout);
+cleanup:
+	if (pdata >= 0) {
+		(void) close(pdata);
+	}
+	pdata = -1;
 }
 
 static FILE *
@@ -2588,6 +2595,10 @@
 	transflag = 0;
 	if (dout != NULL)
 		(void) fclose(dout);
+	else {
+		if (pdata >= 0)
+			(void) close(pdata);
+	}
 	data = -1;
 	pdata = -1;
 out:


--
Takahiro Kambe <taca@sky.yamashina.kyoto.jp>