Close the metadata file in the child process

This prevents the submission from writing to the metadata
file, which allows it to e.g. override runtime and whether
the time limit was hit.

Thanks Atsutoshi Kikuchi for reporting.

(cherry picked from commit 935bea5)

Author: eldering

ChangeLog

@@ -1,5 +1,9 @@
 DOMjudge Programming Contest Judging System
 
+Version 8.2.3DEV
+----------------
+ - [security] Close metadata file descriptor for the child in runguard.
+
 Version 8.2.2 - 20 October 2023
 -------------------------------
  - Bugfix to prevent errors when running a bare-install or deleting all

judge/runguard.c

@@ -1242,6 +1242,13 @@ int main(int argc, char **argv)
 		}
 		verbose("pipes closed in child");
 
+		if ( outputmeta ) {
+			if ( fclose(metafile)!=0 ) {
+				error(errno,"closing file `%s'",metafilename);
+			}
+			verbose("metafile closed in child");
+		}
+
 		/* And execute child command. */
 		execvp(cmdname,cmdargs);
 		error(errno,"cannot start `%s'",cmdname);