From 4498948fcf2c37bd2752df34513f59b96bad8658 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois=20Revol?= <revol@free.fr>
Date: Tue, 27 Mar 2018 23:14:32 +0200
Subject: [PATCH] recover: Work around use-after-free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Inode::_FindPath() always deletes the inode it uses regardless
the source, including when it's from the HashtableInodeSource.

But the later returned the inode object directly from the hashtable
when it's inside, so it gets deleted bu _FindPath… then reused later on
when searching the hashtable again.

I'm not sure it's the correct solution but at least malloc_debug doesn't
complain anymore.
---
 src/bin/bfs_tools/recover.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/bin/bfs_tools/recover.cpp b/src/bin/bfs_tools/recover.cpp
index d70ef9a23e..ad4f60b19a 100644
--- a/src/bin/bfs_tools/recover.cpp
+++ b/src/bin/bfs_tools/recover.cpp
@@ -185,10 +185,10 @@ public:
 	{
 		Inode *inode;
 		if ((inode = gLogged.Get(run)) != NULL)
-			return inode;
+			return Inode::Factory(&fDisk, inode, false);
 
 		if ((inode = gMissing.Get(run)) != NULL)
-			return inode;
+			return Inode::Factory(&fDisk, inode, false);
 
 		if (gMainInodes.find(run) == gMainInodes.end())
 			return NULL;