[NaCl SDK] nacl_io: Fix use-after-free bug in html5fs

native_client_sdk/src/libraries/nacl_io/fusefs/fuse_fs.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "nacl_io/fusefs/fuse_fs.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <string.h>
 
@@ skipping 125 matching lines @@
   *out_node = node;
   return 0;
 }
 
 Error FuseFs::Unlink(const Path& path) {
   if (!fuse_ops_->unlink) {
     LOG_TRACE("fuse_ops_->unlink is NULL.");
     return ENOSYS;
   }
 
-  int result = fuse_ops_->unlink(path.Join().c_str());
+  std::string path_str = path.Join();
+  int result = fuse_ops_->unlink(path_str.c_str());
   if (result < 0)
     return -result;
 
   return 0;
 }
 
 Error FuseFs::Mkdir(const Path& path, int perm) {
   if (!fuse_ops_->mkdir) {
     LOG_TRACE("fuse_ops_->mkdir is NULL.");
     return ENOSYS;
   }
 
-  int result = fuse_ops_->mkdir(path.Join().c_str(), perm);
+  std::string path_str = path.Join();
+  int result = fuse_ops_->mkdir(path_str.c_str(), perm);
   if (result < 0)
     return -result;
 
   return 0;
 }
 
 Error FuseFs::Rmdir(const Path& path) {
   if (!fuse_ops_->rmdir) {
     LOG_TRACE("fuse_ops_->rmdir is NULL.");
     return ENOSYS;
   }
 
-  int result = fuse_ops_->rmdir(path.Join().c_str());
+  std::string path_str = path.Join();
+  int result = fuse_ops_->rmdir(path_str.c_str());
   if (result < 0)
     return -result;
 
   return 0;
 }
 
 Error FuseFs::Remove(const Path& path) {
   ScopedNode node;
   Error error = Open(path, O_RDONLY, &node);
   if (error)
@@ skipping 12 matching lines @@
     return Unlink(path);
   }
 }
 
 Error FuseFs::Rename(const Path& path, const Path& newpath) {
   if (!fuse_ops_->rename) {
     LOG_TRACE("fuse_ops_->rename is NULL.");
     return ENOSYS;
   }
 
-  int result = fuse_ops_->rename(path.Join().c_str(), newpath.Join().c_str());
+  std::string path_str = path.Join();
+  std::string newpath_str = newpath.Join();
+  int result = fuse_ops_->rename(path_str.c_str(), newpath_str.c_str());
   if (result < 0)
     return -result;
 
   return 0;
 }
 
 FuseFsNode::FuseFsNode(Filesystem* filesystem,
                        struct fuse_operations* fuse_ops,
                        struct fuse_file_info& info,
                        const std::string& path)
@@ skipping 274 matching lines @@
   } else {
     fill_info->getdents->AddDirent(ino, name, strlen(name));
     fill_info->num_bytes -= sizeof(dirent);
     // According to the docs, we can never return 1 (buffer full) when the
     // offset is zero (the user is probably ignoring the result anyway).
     return 0;
   }
 }
 
 }  // namespace nacl_io