[NaCl SDK] nacl_io: Fix use-after-free bug in html5fs

native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc

Index: native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc
diff --git a/native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc b/native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc
index 5f0f7c281a6bc67bc6bb8f1bbdfa57bc0ecddfe8..6ce5cc85d9616b938745a1e24b3fe7f2c628723e 100644
--- a/native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc
+++ b/native_client_sdk/src/libraries/nacl_io/jsfs/js_fs.cc
@@ -411,10 +411,9 @@ Error JsFs::OpenWithMode(const Path& path, int open_flags, mode_t t,
                          ScopedNode* out_node) {
   out_node->reset(NULL);
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%d",
-                          "cmd", "open",
-                          "path", path.Join().c_str(),
-                          "oflag", open_flags)) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s%d", "cmd", "open", "path",
+                          path_str.c_str(), "oflag", open_flags)) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
@@ -436,8 +435,9 @@ Error JsFs::OpenWithMode(const Path& path, int open_flags, mode_t t,
 
 Error JsFs::Unlink(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "unlink", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "unlink", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
@@ -447,10 +447,9 @@ Error JsFs::Unlink(const Path& path) {
 
 Error JsFs::Mkdir(const Path& path, int perm) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%d",
-                          "cmd", "mkdir",
-                          "path", path.Join().c_str(),
-                          "mode", perm)) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s%d", "cmd", "mkdir", "path",
+                          path_str.c_str(), "mode", perm)) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
@@ -460,8 +459,9 @@ Error JsFs::Mkdir(const Path& path, int perm) {
 
 Error JsFs::Rmdir(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "rmdir", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "rmdir", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
@@ -471,8 +471,9 @@ Error JsFs::Rmdir(const Path& path) {
 
 Error JsFs::Remove(const Path& path) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(
-          &response, "%s%s", "cmd", "remove", "path", path.Join().c_str())) {
+  std::string path_str = path.Join();
+  if (!SendRequestAndWait(&response, "%s%s", "cmd", "remove", "path",
+                          path_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }
@@ -482,10 +483,10 @@ Error JsFs::Remove(const Path& path) {
 
 Error JsFs::Rename(const Path& path, const Path& newpath) {
   ScopedVar response(ppapi_);
-  if (!SendRequestAndWait(&response, "%s%s%s",
-                          "cmd", "rename",
-                          "old", path.Join().c_str(),
-                          "new", newpath.Join().c_str())) {
+  std::string path_str = path.Join();
+  std::string newpath_str = newpath.Join();
+  if (!SendRequestAndWait(&response, "%s%s%s", "cmd", "rename", "old",
+                          path_str.c_str(), "new", newpath_str.c_str())) {
     LOG_ERROR("Failed to send request.");
     return EINVAL;
   }