From 1465e390a2e8538fe4064f724b2f91d16b2a8517 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Mon, 19 May 2025 10:03:40 +0200
Subject: [PATCH] EventTraceMgr: Move fclose() to destructor

Coverity complains about a missing fclose() in a non-existing
destructor. Also sprinkle in a strerror() call for fopen() to
provide a bit of a hint what might have gone wrong.
---
 src/EventTrace.cc | 14 +++++++++++---
 src/EventTrace.h  |  2 ++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/EventTrace.cc b/src/EventTrace.cc
index 09eda0cb5e..b240334c30 100644
--- a/src/EventTrace.cc
+++ b/src/EventTrace.cc
@@ -955,7 +955,17 @@ bool ValTraceMgr::IsUnsupported(const Val* v) const {
 EventTraceMgr::EventTraceMgr(const std::string& trace_file) {
     f = fopen(trace_file.c_str(), "w");
     if ( ! f )
-        reporter->FatalError("can't open event trace file %s", trace_file.c_str());
+        reporter->FatalError("can't open event trace file %s: %s", trace_file.c_str(), strerror(errno));
+}
+
+EventTraceMgr::~EventTraceMgr() {
+    if ( f ) {
+        if ( fclose(f) )
+            // Not fatal, won't do anything with it anymore anyhow.
+            reporter->Error("failed to close event trace file: %s", strerror(errno));
+
+        f = nullptr;
+    }
 }
 
 void EventTraceMgr::Generate() {
@@ -999,8 +1009,6 @@ void EventTraceMgr::Generate() {
         for ( auto& c : c_t )
             fprintf(f, "#\t%s\n", c.c_str());
     }
-
-    fclose(f);
 }
 
 void EventTraceMgr::StartEvent(const ScriptFunc* ev, const zeek::Args* args) {
diff --git a/src/EventTrace.h b/src/EventTrace.h
index 710f2680b7..8474733f77 100644
--- a/src/EventTrace.h
+++ b/src/EventTrace.h
@@ -441,6 +441,8 @@ class EventTraceMgr {
 public:
     EventTraceMgr(const std::string& trace_file);
 
+    ~EventTraceMgr();
+
     // Generates the trace upon exit.
     void Generate();