CompressStream double-closes the blobgen.Writer causing potential errors #28

New Issue

clawbot · 2026-02-08T21:01:09+01:00

clawbot commented

2026-02-08 21:01:09 +01:00

Bug

In internal/blobgen/compress.go, CompressStream has both a defer w.Close() and an explicit w.Close() call:

func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipients []string) (written int64, hash string, err error) {
    w, err := NewWriter(dst, compressionLevel, recipients)
    if err != nil {
        return 0, "", ...
    }
    defer func() { _ = w.Close() }()  // <-- will always run

    if _, err := io.Copy(w, src); err != nil {
        return 0, "", ...
    }

    if err := w.Close(); err != nil {  // <-- explicit close
        return 0, "", ...
    }
    // defer runs AGAIN here, double-closing
    return w.BytesWritten(), ...
}

The Writer.Close() calls compressor.Close() then encryptor.Close(). The second close on the zstd encoder returns an error ("use after close"), and the age encryptor close may write duplicate finalization bytes to the output, corrupting the stream.

Fix

Use a writerClosed flag pattern (already used in snapshot.go compressFile) or remove the defer.

## Bug In `internal/blobgen/compress.go`, `CompressStream` has both a `defer w.Close()` and an explicit `w.Close()` call: ```go func CompressStream(dst io.Writer, src io.Reader, compressionLevel int, recipients []string) (written int64, hash string, err error) { w, err := NewWriter(dst, compressionLevel, recipients) if err != nil { return 0, "", ... } defer func() { _ = w.Close() }() // <-- will always run if _, err := io.Copy(w, src); err != nil { return 0, "", ... } if err := w.Close(); err != nil { // <-- explicit close return 0, "", ... } // defer runs AGAIN here, double-closing return w.BytesWritten(), ... } ``` The `Writer.Close()` calls `compressor.Close()` then `encryptor.Close()`. The second close on the zstd encoder returns an error ("use after close"), and the age encryptor close may write duplicate finalization bytes to the output, corrupting the stream. ## Fix Use a `writerClosed` flag pattern (already used in `snapshot.go` `compressFile`) or remove the defer.

clawbot self-assigned this 2026-02-08 21:01:09 +01:00

clawbot referenced a pull request that will close this issue

2026-02-08 21:05:07 +01:00

Prevent double-close of blobgen.Writer in CompressStream (closes #28) #33

sneak closed this issue

2026-02-16 06:04:33 +01:00

sneak referenced this issue from a commit

2026-02-16 06:04:35 +01:00

Merge pull request 'Prevent double-close of blobgen.Writer in CompressStream (closes #28)' (#33) from fix/issue-28 into main

clawbot referenced this issue

2026-02-16 06:08:39 +01:00

Add regression test for CompressStream double-close fix (#28) #35