Ticket #13131: 0001-VFS-Fix-CID-702320-1397511-USE_AFTER_FREE.patch

src/tools/fs_shell/vfs.cpp

@@ -1054 +1054 @@
     if (status < 0)
         return status;
 
-    return vnode_path_to_vnode(directory, clonedName, false, 0, _vnode, NULL);
+    inc_vnode_ref_count(directory);
+        // increment directory ref_count before calling vnode_path_to_vnode()
+    status = vnode_path_to_vnode(directory, clonedName, false, 0, _vnode, NULL);
+        // vnode_path_to_vnode() decrements directory ref_count
+    put_vnode(directory);
+        // decrement directory ref_count again, freeing it but not _vnode
+
+    return status;
 }
 
 
@@ -2631 +2638 @@
     // if the leaf is "." or "..", we directly get the correct directory
     // vnode and ignore the leaf later
     bool isDir = (fssh_strcmp(leaf, ".") == 0 || fssh_strcmp(leaf, "..") == 0);
-    if (isDir)
+    if (isDir) {
+        inc_vnode_ref_count(dirNode);
         error = vnode_path_to_vnode(dirNode, leaf, false, 0, &dirNode, NULL);
-    if (error != FSSH_B_OK) {
-        TRACE(("vfs_normalize_path(): failed to get dir vnode for \".\" or \"..\": %s\n",
-            strerror(error)));
-        return error;
+            // vnode_path_to_vnode() decrements dirNode ref_count
+        if (error != FSSH_B_OK) {
+            TRACE(("vfs_normalize_path(): failed to get dir vnode for \".\" or "
+                "\"..\": %s\n", strerror(error)));
+            return error;
+        }
     }
 
     // get the directory path