diff --git a/src/mod_compress.c b/src/mod_compress.c
index def2be6c..6d647565 100644
--- a/src/mod_compress.c
+++ b/src/mod_compress.c
@@ -439,6 +439,9 @@ static int deflate_file_to_file(server *srv, connection *con, plugin_data *p, bu
 	}
 	
 	if (-1 == (r = write(ofd, p->b->ptr, p->b->used))) {
+		munmap(start, sce->st.st_size);	
+		close(ofd);
+		close(ifd);
 		return -1;
 	}
 	
diff --git a/src/network_linux_sendfile.c b/src/network_linux_sendfile.c
index 9939247f..d7f5e86d 100644
--- a/src/network_linux_sendfile.c
+++ b/src/network_linux_sendfile.c
@@ -146,11 +146,15 @@ int network_write_chunkqueue_linuxsendfile(server *srv, connection *con, int fd,
 			}
 		
 			/* open file if not already opened */	
-			if (-1 == c->file.fd &&
-			    -1 == (c->file.fd = open(c->file.name->ptr, O_RDONLY))) {
-				log_error_write(srv, __FILE__, __LINE__, "ss", "open failed: ", strerror(errno));
+			if (-1 == c->file.fd) {
+				if (-1 == (c->file.fd = open(c->file.name->ptr, O_RDONLY))) {
+					log_error_write(srv, __FILE__, __LINE__, "ss", "open failed: ", strerror(errno));
 				
-				return -1;
+					return -1;
+				}
+#ifdef FD_CLOEXEC
+				fcntl(c->file.fd, F_SETFD, FD_CLOEXEC);
+#endif
 			}
 			
 			/* Linux sendfile() */
diff --git a/src/network_openssl.c b/src/network_openssl.c
index 38a4e86c..9de75309 100644
--- a/src/network_openssl.c
+++ b/src/network_openssl.c
@@ -171,6 +171,7 @@ int network_write_chunkqueue_openssl(server *srv, connection *con, SSL *ssl, chu
 
 				lseek(ifd, offset, SEEK_SET);
 				if (-1 == (toSend = read(ifd, local_send_buffer, toSend))) {
+					close(ifd);
 					log_error_write(srv, __FILE__, __LINE__, "ss", "read failed: ", strerror(errno));
 					return -1;
 				}
diff --git a/src/network_write.c b/src/network_write.c
index 9e713c63..177e90b6 100644
--- a/src/network_write.c
+++ b/src/network_write.c
@@ -110,7 +110,7 @@ int network_write_chunkqueue_write(server *srv, connection *con, int fd, chunkqu
 
 			if ((r = write(fd, p + offset, toSend)) <= 0) {
 				log_error_write(srv, __FILE__, __LINE__, "ss", "write failed: ", strerror(errno));
-				
+				munmap(p, sce->st.st_size);
 				return -1;
 			}
 			
diff --git a/src/network_writev.c b/src/network_writev.c
index 86e4f1d5..1f4b5ba7 100644
--- a/src/network_writev.c
+++ b/src/network_writev.c
@@ -196,7 +196,11 @@ int network_write_chunkqueue_writev(server *srv, connection *con, int fd, chunkq
 				 *     3. use non-blocking IO for file-transfers
 				 *   */
 			
+
 				if (MAP_FAILED == (c->file.mmap.start = mmap(0, sce->st.st_size, PROT_READ, MAP_SHARED, c->file.fd, 0))) {
+					/* close it here, otherwise we'd have to set FD_CLOEXEC */
+					close(c->file.fd);
+					c->file.fd = -1;
 					log_error_write(srv, __FILE__, __LINE__, "ssbd", "mmap failed: ", 
 							strerror(errno), c->file.name,  c->file.fd);