IssueTracker

https://android.googlesource.com/platform/libcore/+/master/luni/src/main/native/libcore_io_Linux.cpp

static jobject Linux_open(JNIEnv* env, jobject, jstring javaPath, jint flags, jint mode) {
    ScopedUtfChars path(env, javaPath);
    if (path.c_str() == NULL) {
        return NULL;
    }
    int fd = throwIfMinusOne(env, "open", TEMP_FAILURE_RETRY(open(path.c_str(), flags, mode)));
    return fd != -1 ? jniCreateFileDescriptor(env, fd) : NULL; // <=======
}

My understanding is that jniCreateFileDescriptor() (https://android.googlesource.com/platform/libnativehelper/+/master/JNIHelp.cpp) may return NULL if out-of-memory occurs and then `fd' is leaked. This might also happen in other places where jniCreateFileDescriptor() is called.

I have never encountered this in the field, but I happened to notice this in the code because Android O changed ParcelFileDescriptor.openInternal() to call android.system.Os.open() which ends up calling Linux_open(). Previously, ParcelFileDescriptor.openInternal() used to call android_os_Parcel_openFileDescriptor() which didn't have this (theoretical) issue.

https://android.googlesource.com/platform/frameworks/base/+/master/core/jni/android_os_Parcel.cpp

static jobject android_os_Parcel_openFileDescriptor(JNIEnv* env, jclass clazz,
                                                    jstring name, jint mode)
{
...
    int fd = open(name8.c_str(), flags, realMode);
    if (fd < 0) {
        jniThrowException(env, "java/io/FileNotFoundException", strerror(errno));
        return NULL;
    }
    jobject object = jniCreateFileDescriptor(env, fd);
    if (object == NULL) {
        close(fd);        // <================== closed in case jniCreateFileDescriptor() fails
    }
    return object;
}

This was formerly reported as https://issuetracker.google.com/issues/65423997