[NaCl SDK] nacl_io: Fix use-after-free bug in html5fs

native_client_sdk/src/libraries/nacl_io/html5fs/html5_fs.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "nacl_io/html5fs/html5_fs.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <stdlib.h>
 #include <string.h>
@@ skipping 27 matching lines @@
   }
   return hash;
 }
 
 ino_t Html5Fs::HashPath(const Path& path) {
   // Prime the DJB2a hash
   ino_t hash = 5381;
 
   // Apply a running DJB2a to each part of the path
   for (size_t segment = 0; segment < path.Size(); segment++) {
-    const char *ptr = path.Part(segment).c_str();
-    size_t len = path.Part(segment).length();
-    hash = HashPathSegment(hash, ptr, len);
+    std::string part = path.Part(segment);
+    hash = HashPathSegment(hash, part.c_str(), part.length());
   }
   return hash;
 }
 
 
 // For HTML5, the INO should be the one used by the system, however PPAPI
 // does not provide access to the real INO.  Instead, since HTML5 does not
 // suport links, we assume that files are unique based on path to the base
 // of the mount.
 void Html5Fs::OnNodeCreated(Node* node) {
   node->stat_.st_dev = dev_;
 }
 
 void Html5Fs::OnNodeDestroyed(Node* node) {}
 
 
 Error Html5Fs::OpenWithMode(const Path& path, int open_flags, mode_t mode,
                             ScopedNode* out_node) {
   out_node->reset(NULL);
   Error error = BlockUntilFilesystemOpen();
   if (error)
     return error;
 
+  std::string full_path(GetFullPath(path).Join());
   PP_Resource fileref = file_ref_iface_->Create(
-      filesystem_resource_, GetFullPath(path).Join().c_str());
+      filesystem_resource_, full_path.c_str());
   if (!fileref)
     return ENOENT;
 
   ScopedNode node(new Html5FsNode(this, fileref));
   error = node->Init(open_flags);
 
   // Set the INO based on the path
   node->stat_.st_ino = HashPath(path);
 
   if (error)
@@ skipping 21 matching lines @@
 Error Html5Fs::Mkdir(const Path& path, int permissions) {
   Error error = BlockUntilFilesystemOpen();
   if (error)
     return error;
 
   // FileRef returns PP_ERROR_NOACCESS which is translated to EACCES if you
   // try to create the root directory. EEXIST is a better errno here.
   if (path.IsRoot())
     return EEXIST;
 
+  std::string full_path(GetFullPath(path).Join());
   ScopedResource fileref_resource(
       ppapi(),
-      file_ref_iface_->Create(filesystem_resource_,
-                              GetFullPath(path).Join().c_str()));
+      file_ref_iface_->Create(filesystem_resource_, full_path.c_str()));
   if (!fileref_resource.pp_resource())
     return ENOENT;
 
   int32_t result = file_ref_iface_->MakeDirectory(
       fileref_resource.pp_resource(), PP_FALSE, PP_BlockUntilComplete());
   if (result != PP_OK)
     return PPErrorToErrno(result);
 
   return 0;
 }
 
 Error Html5Fs::Rmdir(const Path& path) {
   return RemoveInternal(path, REMOVE_DIR);
 }
 
 Error Html5Fs::Remove(const Path& path) {
   return RemoveInternal(path, REMOVE_ALL);
 }
 
 Error Html5Fs::RemoveInternal(const Path& path, int remove_type) {
   Error error = BlockUntilFilesystemOpen();
   if (error)
     return error;
 
+  std::string full_path(GetFullPath(path).Join());
   ScopedResource fileref_resource(
       ppapi(),
-      file_ref_iface_->Create(filesystem_resource_,
-                              GetFullPath(path).Join().c_str()));
+      file_ref_iface_->Create(filesystem_resource_, full_path.c_str()));
   if (!fileref_resource.pp_resource())
     return ENOENT;
 
   // Check file type
   if (remove_type != REMOVE_ALL) {
     PP_FileInfo file_info;
     int32_t query_result = file_ref_iface_->Query(
         fileref_resource.pp_resource(), &file_info, PP_BlockUntilComplete());
     if (query_result != PP_OK) {
       if (query_result == PP_ERROR_FILENOTFOUND) {
@@ skipping 180 matching lines @@
 }
 
 void Html5Fs::FilesystemOpenCallback(int32_t result) {
   AUTO_LOCK(filesysem_open_lock_);
   filesystem_open_has_result_ = true;
   filesystem_open_error_ = PPErrorToErrno(result);
   pthread_cond_signal(&filesystem_open_cond_);
 }
 
 }  // namespace nacl_io