From d6c411e737d001f431dcbd7b56a547c40f58b6f5 Mon Sep 17 00:00:00 2001
From: Fei Deng <duke8253@gmail.com>
Date: Wed, 23 Aug 2023 10:59:06 -0400
Subject: [PATCH] make sure open() and read() succeeded

---
 plugins/experimental/ssl_session_reuse/src/config.cc  |  3 +--
 .../experimental/ssl_session_reuse/src/ssl_init.cc    | 11 +++++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/plugins/experimental/ssl_session_reuse/src/config.cc b/plugins/experimental/ssl_session_reuse/src/config.cc
index 7d8c5cd9c88..72e133be5e6 100644
--- a/plugins/experimental/ssl_session_reuse/src/config.cc
+++ b/plugins/experimental/ssl_session_reuse/src/config.cc
@@ -82,12 +82,11 @@ Config::loadConfig(const std::string &filename)
       }
     }
 
-    close(fd);
-
     m_noConfig      = false;
     success         = true;
     m_alreadyLoaded = true;
   }
+  close(fd);
 
   return success;
 }
diff --git a/plugins/experimental/ssl_session_reuse/src/ssl_init.cc b/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
index afc88fffeb0..c0a7da47060 100644
--- a/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
+++ b/plugins/experimental/ssl_session_reuse/src/ssl_init.cc
@@ -106,7 +106,7 @@ get_redis_auth_key(char *retKeyBuff, int buffSize)
   if (ssl_param.redis_auth_key_file.length()) {
     int fd = open(ssl_param.redis_auth_key_file.c_str(), O_RDONLY);
     struct stat info;
-    if (0 == fstat(fd, &info)) {
+    if (fd >= 0 && 0 == fstat(fd, &info)) {
       size_t n = info.st_size;
       std::string key_data;
       key_data.resize(n);
@@ -115,10 +115,13 @@ get_redis_auth_key(char *retKeyBuff, int buffSize)
       while (read_len > 1 && key_data[read_len - 1] == '\n') {
         --read_len;
       }
-      memset(retKeyBuff, 0, buffSize);
-      strncpy(retKeyBuff, key_data.c_str(), read_len);
-      retval = key_data.length();
+      if (read_len > 0 && read_len <= buffSize && static_cast<size_t>(read_len) <= key_data.length()) {
+        memset(retKeyBuff, 0, buffSize);
+        strncpy(retKeyBuff, key_data.c_str(), read_len);
+        retval = read_len;
+      }
     }
+    close(fd);
   } else {
     TSError("Can not get redis auth key.");
   }