From a114a890d83885d44be99beca2e2d8384ef7b3fb Mon Sep 17 00:00:00 2001
From: Eric Fischer <enf@pobox.com>
Date: Wed, 7 Dec 2016 11:25:42 -0800
Subject: [PATCH] Keep from leaking other pipe file descriptors to unrelated
 children

---
 plugin.cpp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/plugin.cpp b/plugin.cpp
index d95011a..e4b5c79 100644
--- a/plugin.cpp
+++ b/plugin.cpp
@@ -6,6 +6,7 @@
 #include <map>
 #include <pthread.h>
 #include <unistd.h>
+#include <fcntl.h>
 #include <cmath>
 #include <sys/types.h>
 #include <sys/wait.h>
@@ -281,6 +282,14 @@ mvt_layer filter_layer(const char *filter, mvt_layer &layer, unsigned z, unsigne
 			perror("close filter-side writer");
 			exit(EXIT_FAILURE);
 		}
+		if (fcntl(pipe_orig[1], F_SETFD, FD_CLOEXEC) != 0) {
+			perror("cloxec output to filter");
+			exit(EXIT_FAILURE);
+		}
+		if (fcntl(pipe_filtered[0], F_SETFD, FD_CLOEXEC) != 0) {
+			perror("cloxec input from filter");
+			exit(EXIT_FAILURE);
+		}
 
 		if (pthread_mutex_unlock(&pipe_lock) != 0) {
 			perror("pthread_mutex_unlock (pipe_lock)");