Fix binwalk (and entropy) file descriptor leak

ofrak_core/CHANGELOG.md

@@ -37,6 +37,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Fix bug in Segment Injector: favor regions with data when injecting data ([#682](https://github.com/redballoonsecurity/ofrak/pull/682))
 - Pass `usedforsecurity=False` to non-cryptographic `hashlib` calls to prevent failures when Python links against FIPS OpenSSL ([#744](https://github.com/redballoonsecurity/ofrak/pull/744))
 - Fix `chdir` in UEFI components causing failing tests. ([#747](https://github.com/redballoonsecurity/ofrak/pull/747))
+- Fix binwalk file descriptor leak. ([#749](https://github.com/redballoonsecurity/ofrak/pull/749))
 
 ## [3.3.0](https://github.com/redballoonsecurity/ofrak/compare/ofrak-v3.2.0...ofrak-v3.3.0) - 2025-10-03
 

ofrak_core/src/ofrak/core/binwalk.py

@@ -67,17 +67,18 @@ def __init__(
         resource_service: ResourceServiceInterface,
     ):
         super().__init__(resource_factory, data_service, resource_service)
-        self.pool = ProcessPoolExecutor()
 
     async def analyze(self, resource: Resource, config=None) -> BinwalkAttributes:
         if not BINWALK_INSTALLED:
             raise ComponentMissingDependencyError(self, BINWALK_TOOL)
+        pool = ProcessPoolExecutor()
         async with resource.temp_to_disk() as temp_path:
             # Should errors be handled the way they are in the `DataSummaryAnalyzer`? Likely to be
             # overkill here.
             offsets = await asyncio.get_running_loop().run_in_executor(
-                self.pool, _run_binwalk_on_file, temp_path
+                pool, _run_binwalk_on_file, temp_path
             )
+        pool.shutdown(wait=True, cancel_futures=True)
         return BinwalkAttributes(offsets)
 
 

ofrak_core/tests/components/test_binwalk_component.py

@@ -79,3 +79,32 @@ async def test_binwalk_component(ofrak_context, test_case):
     if test_case.number_of_results is not None:
         assert len(binwalk_offsets) == test_case.number_of_results
     assert test_case.subset_of_results.items() <= binwalk_offsets.items()
+
+
+@pytest.mark.skipif(
+    not os.path.isdir(f"/proc/{os.getpid()}/fd"),
+    reason="Requires /proc/<pid>/fd (Linux only)",
+)
+@pytest.mark.skipif_missing_deps([BinwalkAnalyzer])
+async def test_binwalk_does_not_leak_fds(ofrak_context):
+    """
+    Regression test for the ProcessPoolExecutor FD leak in BinwalkAnalyzer.
+    """
+    fd_dir = f"/proc/{os.getpid()}/fd"
+    asset_path = os.path.join(BINWALK_ASSETS_PATH, "dirtraversal.tar")
+
+    root_resource = await ofrak_context.create_root_resource_from_file(asset_path)
+    before = len(os.listdir(fd_dir))
+    await root_resource.analyze(BinwalkAttributes)
+
+    iterations = 5
+    for _ in range(iterations):
+        root_resource = await ofrak_context.create_root_resource_from_file(asset_path)
+        await root_resource.analyze(BinwalkAttributes)
+    after = len(os.listdir(fd_dir))
+
+    delta = after - before
+    assert delta < 10, (
+        f"BinwalkAnalyzer leaked {delta} FDs across {iterations} iterations "
+        f"({before} -> {after})."
+    )