[Bug] HttpServer double-closes accepted socket fd per request, causing unintended close of another thread's fd #747

#include <quickfix/SessionSettings.h>
#include <quickfix/HttpServer.h>
#include <chrono>
#include <cstdio>
#include <cstring>
#include <sstream>
#include <thread>
#include <arpa/inet.h>
#include <csignal>
#include <netinet/in.h>
#include <sys/socket.h>
#include <unistd.h>

int main() {
    signal(SIGPIPE, SIG_IGN);
    constexpr int HTTP_PORT = 18080;

    // 1. Start HttpServer
    std::stringstream cfg;
    cfg << "[DEFAULT]\n";
    cfg << "HttpAcceptPort=" << HTTP_PORT << "\n";
    FIX::SessionSettings settings(cfg);
    FIX::HttpServer::startGlobal(settings);
    fprintf(stderr, "[PROOF] HttpServer started on port %d\n", HTTP_PORT);
    std::this_thread::sleep_for(std::chrono::milliseconds(200));

    // 2. Send a single HTTP GET request
    fprintf(stderr, "[PROOF] Sending 1 HTTP request...\n");
    int fd = socket(AF_INET, SOCK_STREAM, 0);
    sockaddr_in a{};
    a.sin_family = AF_INET;
    a.sin_port = htons(HTTP_PORT);
    a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
    if (connect(fd, reinterpret_cast<sockaddr*>(&a), sizeof(a)) == 0) {
        const char* req = "GET / HTTP/1.0\r\n\r\n";
        write(fd, req, strlen(req));
        char buf[256];
        // Read the full response
        while (read(fd, buf, sizeof(buf)) > 0) {}
    }
    close(fd);
    fprintf(stderr, "[PROOF] HTTP request done.\n");

    // Wait for HttpServer thread to finish processing
    std::this_thread::sleep_for(std::chrono::milliseconds(500));
    FIX::HttpServer::stopGlobal();
    return 0;
}

// Demonstrates that HttpServer's double-close can destroy unrelated file descriptors.
//
// Thread A: Sends HTTP requests to HttpServer (triggers the double-close bug)
// Thread B: Creates pipe() fds and checks if they remain valid
// If HttpServer's stale close hits a pipe fd, fcntl() will return EBADF.
//
// A pipe fd has nothing to do with HttpServer — if it becomes invalid,
// the only explanation is that something else closed it.

#include <quickfix/SessionSettings.h>
#include <quickfix/HttpServer.h>

#include <atomic>
#include <chrono>
#include <cstdio>
#include <cstring>
#include <sstream>
#include <thread>

#include <arpa/inet.h>
#include <csignal>
#include <fcntl.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <unistd.h>

static std::atomic<bool> g_stop{false};
static std::atomic<long> g_stolen{0};
static std::atomic<long> g_checked{0};
static constexpr int HTTP_PORT = 18080;

static bool fd_alive(int fd) { return fcntl(fd, F_GETFD) != -1; }

// Thread A: Send HTTP requests to trigger HttpServer::onConnect -> double-close
static void http_hammer() {
    while (!g_stop.load()) {
        int fd = socket(AF_INET, SOCK_STREAM, 0);
        if (fd < 0) continue;
        sockaddr_in a{};
        a.sin_family = AF_INET;
        a.sin_port = htons(HTTP_PORT);
        a.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
        if (connect(fd, reinterpret_cast<sockaddr*>(&a), sizeof(a)) == 0) {
            write(fd, "GET / HTTP/1.0\r\n\r\n", 18);
            char buf[64];
            read(fd, buf, sizeof(buf));
        }
        close(fd);
    }
}

// Thread B: Create pipe fds and check if they get stolen
static void pipe_victim() {
    while (!g_stop.load()) {
        int pipefd[2];
        if (pipe(pipefd) != 0) continue;

        g_checked.fetch_add(1);

        // Brief hold — check if our pipe fd was closed by someone else
        for (int i = 0; i < 32; i++) {
            if (!fd_alive(pipefd[0]) || !fd_alive(pipefd[1])) {
                g_stolen.fetch_add(1);
                break;
            }
        }

        // Clean up (only if still valid)
        if (fd_alive(pipefd[0])) close(pipefd[0]);
        if (fd_alive(pipefd[1])) close(pipefd[1]);
    }
}

int main() {
    signal(SIGPIPE, SIG_IGN);

    // Start HttpServer
    std::stringstream cfg;
    cfg << "[DEFAULT]\nHttpAcceptPort=" << HTTP_PORT << "\n";
    FIX::SessionSettings settings(cfg);
    FIX::HttpServer::startGlobal(settings);
    std::this_thread::sleep_for(std::chrono::milliseconds(100));

    // Start threads
    std::thread hammers[4];
    for (auto& t : hammers) t = std::thread(http_hammer);

    std::thread victims[4];
    for (auto& t : victims) t = std::thread(pipe_victim);

    // Run for 8 seconds
    std::this_thread::sleep_for(std::chrono::seconds(8));
    g_stop.store(true);

    long stolen = g_stolen.load();
    long checked = g_checked.load();

    fprintf(stderr, "Checked %ld pipe fds. Stolen: %ld\n", checked, stolen);
    if (stolen > 0) {
        fprintf(stderr, "FAIL: %ld pipe fd(s) were closed by HttpServer (fd theft)\n", stolen);
        _exit(1);
    } else {
        fprintf(stderr, "PASS: no fd theft detected\n");
        _exit(0);
    }
}