libdpkg: Fix file triggers/Unincorp descriptor leak on subprocesses

Regression introduced in commit 10440009b68f59eeed4cb1b56547e3cf356aa540,
with the initial triggers implementation.

Closes: #751021

debian/changelog

@@ -12,6 +12,9 @@ dpkg (1.17.11) UNRELEASED; urgency=low
   * Use SELinux setexecfilecon() if available in dpkg instead of ad-hoc code.
   * Replace obsolete <sys/fcntl.h> with <fcntl.h>, which fixes compilation on
     Android. Thanks to Fredrik Fornwall <fredrik@fornwall.net>. Closes: #752036
+  * Fix file triggers/Unincorp descriptor leak on subprocesses. Regression
+    introduced with the initial triggers implementation in dpkg 1.14.17.
+    Closes: #751021
 
   [ Updated programs translations ]
   * Danish (Joe Dalton). Closes: #754127

lib/dpkg/trigdeferred.l

@@ -161,6 +161,8 @@ trigdef_update_start(enum trigdef_update_flags uf)
 		struct stat stab;
 		int rc;
 
+		setcloexec(fileno(old_deferred), fn.buf);
+
 		rc = fstat(fileno(old_deferred), &stab);
 		if (rc < 0)
 			ohshite(_("unable to stat triggers deferred file `%.250s'"),
@@ -180,6 +182,8 @@ trigdef_update_start(enum trigdef_update_flags uf)
 		if (!trig_new_deferred)
 			ohshite(_("unable to open/create new triggers deferred file `%.250s'"),
 			        newfn.buf);
+
+		setcloexec(fileno(trig_new_deferred), newfn.buf);
 	}
 
 	if (!old_deferred)