Close the file and parent on every failed open

[rtissera]

Fixes #193.

chd_open_core_file_callbacks() closes the caller's file and parent on a failed open, through chd_close() on the half-built handle. Two exits before that handle exists skipped it: an invalid parent, and a failed malloc of the chd_file. Depending on where the open failed, the same call either consumed its arguments or leaked them.

This PR closes them on those two exits too, and documents the contract in chd.h: once passed, the file and the parent belong to libchdr, whether the open succeeds or not.

Why not the other way round

#193 proposed the opposite: leave the file to the caller on failure. That would break existing callers:

• One consumer wraps its file in an object that its fclose callback deletes. It relies on libchdr calling that on failure, and it retries a child that returned CHDERR_REQUIRES_PARENT with a new wrapper.
• No consumer I checked closes the parent after a failed open. They depend on libchdr having done it.

chd_open_file() is unaffected either way, since its fclose callback does nothing.

What changes for callers

• The behaviour changes on two rare paths, from leaking to closing. There is no ABI change and no SOVERSION bump.
• A caller that closes the file again after a failure is now wrong on those two paths. It was already closing it twice on every other failure path.
• contrib/esp32p4/chd/chd_esp_vfs.c was such a caller: it did fclose(f) after a failed open, which is a double fclose() and undefined behaviour. It and the FatFs bridge now leave the close to libchdr.

Test

tests/open_ownership.c builds one-hunk CHDv5 images in memory, so it runs without the generated corpus. It counts fclose calls for these cases:

• success (closed once by chd_close())
• bad header
• truncated file
• a parent that is not a chd_file
• CHDERR_REQUIRES_PARENT followed by a retry with the parent
• a mismatched parent (both files closed once)
• NULL callbacks

For chd_open(), which opens its own FILE, the test checks on POSIX that the file descriptor was released. LeakSanitizer cannot see this, because glibc keeps every open FILE reachable.

• Without the fix, the test fails on the invalid-parent exit, through both the counting callback and the descriptor check.
• With it, the whole test suite passes under ASan+UBSan in 7 build configurations: default, LOWRAM_TARGET, system zlib, no subcode/raw sectors, no block CRC, micro-flac, and LOWRAM_TARGET with micro-flac.
• The failed-malloc exit is not covered by a test.

Follow-ups

• FatFs bridges: build a cluster link map on open #194 edits the same lines of chd_fatfs_open(). It will be rebased onto this and drop its close-on-failure.

🤖 Generated with Claude Code