[NaCl SDK] nacl_io: Fix use-after-free bug in html5fs

native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "nacl_io/jsfs/js_fs.h"
 
 #include <assert.h>
 #include <errno.h>
 #include <fcntl.h>
 #include <limits.h>
@@ skipping 393 matching lines @@
     }
 
     pthread_cond_wait(&response_cond_, lock_.mutex());
   }
 }
 
 Error JsFs::OpenWithMode(const Path& path, int open_flags, mode_t t,
                          ScopedNode* out_node) {
   out_node->reset(NULL);
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%d",
-                          "cmd", "open",
-                          "path", path.Join().c_str(),
-                          "oflag", open_flags)) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s%d", "cmd", "open", "path",
+                          path_str.c_str(), "oflag", open_flags)) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   int32_t error;
   int32_t fd;
   int result = ScanVar(response.pp_var(), "%d%d", "error", &error, "fd", &fd);
   if (result >= 1 && error)
     return error;
 
   if (result != 2) {
     LOG_ERROR("Expected \"error\" and \"fd\" fields in response.");
     return EINVAL;
   }
 
   out_node->reset(new JsFsNode(this, fd));
   return 0;
 }
 
 Error JsFs::Unlink(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "unlink", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "unlink", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   return ErrorFromResponse(response);
 }
 
 Error JsFs::Mkdir(const Path& path, int perm) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%d",
-                          "cmd", "mkdir",
-                          "path", path.Join().c_str(),
-                          "mode", perm)) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s%d", "cmd", "mkdir", "path",
+                          path_str.c_str(), "mode", perm)) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   return ErrorFromResponse(response);
 }
 
 Error JsFs::Rmdir(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "rmdir", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "rmdir", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   return ErrorFromResponse(response);
 }
 
 Error JsFs::Remove(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "remove", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "remove", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   return ErrorFromResponse(response);
 }
 
 Error JsFs::Rename(const Path& path, const Path& newpath) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%s",
-                          "cmd", "rename",
-                          "old", path.Join().c_str(),
-                          "new", newpath.Join().c_str())) {
+  std::string path_str = path.Join();
+  std::string newpath_str = newpath.Join();
+  if (!SendRequestAndWait(&response, "%s%s%s", "cmd", "rename", "old",
+                          path_str.c_str(), "new", newpath_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
 
   return ErrorFromResponse(response);
 }
 
 Error JsFs::Filesystem_VIoctl(int request, va_list args) {
   if (request != NACL_IOC_HANDLEMESSAGE) {
     LOG_ERROR("Unknown ioctl: %#x", request);
     return EINVAL;
   }
 
   PP_Var response = *va_arg(args, PP_Var*);
 
   AUTO_LOCK(lock_);
 
   RequestId response_id;
   if (ScanVar(response, "%d", "id", &response_id) != 1) {
     LOG_TRACE("ioctl with no \"id\", ignoring.\n");
     return EINVAL;
   }
 
   responses_.insert(ResponseMap_t::value_type(response_id, response));
   pthread_cond_broadcast(&response_cond_);
   return 0;
 }
 
 }  // namespace nacl_io