3 files changed, 22 insertions, 10 deletions

diff --git a/etc/net/nolocal.net b/etc/net/nolocal.net
index 8955f740d..0eb9f9784 100644
--- a/etc/net/nolocal.net
+++ b/etc/net/nolocal.net
@@ -32,5 +32,5 @@
 -A OUTPUT -d 172.16.0.0/12 -j DROP
 
 # drop multicast traffic
--A OUTPUT -d 244.0.0.0/4 -j DROP
+-A OUTPUT -d 224.0.0.0/4 -j DROP
 COMMIT
diff --git a/etc/profile-m-z/meld.profile b/etc/profile-m-z/meld.profile
index 84db8b785..385700648 100644
--- a/etc/profile-m-z/meld.profile
+++ b/etc/profile-m-z/meld.profile
@@ -70,6 +70,7 @@ private-cache
 private-dev
 # Uncomment the next line (or put it into your meld.local) if you don't need to compare in /etc.
 #private-etc alternatives,ca-certificates,crypto-policies,fonts,hostname,hosts,pki,resolv.conf,ssl,subversion
+# Comment the next line (or add 'ignore private-tmp to your meld.local') if you want to use it as a difftool (#3551)
 private-tmp
 
 read-only ${HOME}/.ssh
diff --git a/src/firejail/util.c b/src/firejail/util.c
index 6bfc80903..3aa0584d6 100644
--- a/src/firejail/util.c
+++ b/src/firejail/util.c
@@ -957,16 +957,27 @@ int remove_overlay_directory(void) {
         return 0;
 }
 
+// flush stdin if it is connected to a tty and has input
 void flush_stdin(void) {
-        if (isatty(STDIN_FILENO)) {
-                int cnt = 0;
-                int rv = ioctl(STDIN_FILENO, FIONREAD, &cnt);
-                if (rv == 0 && cnt) {
-                        fwarning("removing %d bytes from stdin\n", cnt);
-                        rv = ioctl(STDIN_FILENO, TCFLSH, TCIFLUSH);
-                        (void) rv;
-                }
-        }
+        if (!isatty(STDIN_FILENO))
+                return;
+
+        int cnt = 0;
+        int rv = ioctl(STDIN_FILENO, FIONREAD, &cnt);
+        if (rv != 0 || cnt == 0)
+                return;
+
+        fwarning("removing %d bytes from stdin\n", cnt);
+
+        // If this process is backgrounded, below ioctl() will trigger
+        // SIGTTOU and stop us. We avoid this by ignoring SIGTTOU for
+        // the duration of the ioctl.
+        sighandler_t hdlr = signal(SIGTTOU, SIG_IGN);
+        rv = ioctl(STDIN_FILENO, TCFLSH, TCIFLUSH);
+        signal(SIGTTOU, hdlr);
+
+        if (rv)
+                fwarning("Flushing stdin failed: %s\n", strerror(errno));
 }
 
 // return 1 if new directory was created, else return 0