Mariano Abad 8ec37ed531 fix: bound the wait and the pipe reads against a group-escaping descendant ...

Two P3 hardening items from the review: a descendant that changes its
own process group escapes the deadline's group kill, and could then leak
or block the parent.

- The deadline path now also sends a pid-targeted SIGKILL to the direct
  child, so child.wait() is bounded even if the child left the group and
  the group kill missed it.

- The normal-exit path drains stdout and stderr non-blocking instead of
  read_to_string: the child has exited so its output is already
  buffered, but an escaped grandchild holding a write end would keep the
  pipe from EOF and hang a blocking read. The drain is capped so a
  descendant that keeps writing cannot spin it. first_buffered_line now
  shares that drain.

Verified: a probe child whose grandchild setpgid-escapes and holds the
pipe returns in 25 ms instead of hanging, and a direct child that
escapes and blocks is bounded to the deadline instead of its full
sleep.

2026-08-12 02:39:28 -03:00

..

wayland_probe.rs

fix: bound the wait and the pipe reads against a group-escaping descendant

2026-08-12 02:39:28 -03:00