merge 8.5 to 8.6: amend to [61c01e0edb08a9ed], more cases for increment ref-count with use-after-free prevention for interim normalized path object; provide fixes minimally invasive (if API used with fresh created path object, so decrement would not destroy it if normalized path equal original given path)

3 files changed, 30 insertions, 9 deletions

diff --git a/generic/tclIOUtil.c b/generic/tclIOUtil.c
index 23d25b4..ea0eb4b 100644
--- a/generic/tclIOUtil.c
+++ b/generic/tclIOUtil.c
@@ -2981,6 +2981,7 @@ Tcl_FSChdir(
 	    Tcl_SetErrno(ENOENT);
 	    return -1;
 	}
+	if (normDirName != pathPtr) { Tcl_IncrRefCount(normDirName); }
 
 	if (fsPtr == &tclNativeFilesystem) {
 	    /*
@@ -3022,6 +3023,7 @@ Tcl_FSChdir(
 	if (oldFsPtr != NULL && fsPtr != oldFsPtr) {
 	    Tcl_FSMountsChanged(NULL);
 	}
+	if (normDirName != pathPtr) { Tcl_DecrRefCount(normDirName); }
     }
 
     return retVal;
diff --git a/win/tclWinFCmd.c b/win/tclWinFCmd.c
index 0bf21dd..ba76b5e 100644
--- a/win/tclWinFCmd.c
+++ b/win/tclWinFCmd.c
@@ -906,10 +906,16 @@ TclpObjCopyDirectory(
     int ret;
 
     normSrcPtr = Tcl_FSGetNormalizedPath(NULL,srcPathPtr);
+    if (normSrcPtr == NULL) {
+	return TCL_ERROR;
+    }
+    if (normSrcPtr != srcPathPtr) { Tcl_IncrRefCount(normSrcPtr); }
     normDestPtr = Tcl_FSGetNormalizedPath(NULL,destPathPtr);
-    if ((normSrcPtr == NULL) || (normDestPtr == NULL)) {
+    if (normDestPtr == NULL) {
+	if (normSrcPtr != srcPathPtr) { Tcl_DecrRefCount(normSrcPtr); }
 	return TCL_ERROR;
     }
+    if (normDestPtr != destPathPtr) { Tcl_IncrRefCount(normDestPtr); }
 
     Tcl_WinUtfToTChar(Tcl_GetString(normSrcPtr), -1, &srcString);
     Tcl_WinUtfToTChar(Tcl_GetString(normDestPtr), -1, &dstString);
@@ -930,6 +936,9 @@ TclpObjCopyDirectory(
 	Tcl_DStringFree(&ds);
 	Tcl_IncrRefCount(*errorPtr);
     }
+
+    if (normSrcPtr != srcPathPtr) { Tcl_DecrRefCount(normSrcPtr); }
+    if (normDestPtr != destPathPtr) { Tcl_DecrRefCount(normDestPtr); }
     return ret;
 }
 
@@ -984,6 +993,7 @@ TclpObjRemoveDirectory(
 	if (normPtr == NULL) {
 	    return TCL_ERROR;
 	}
+	if (normPtr != pathPtr) { Tcl_IncrRefCount(normPtr); }
 	Tcl_WinUtfToTChar(Tcl_GetString(normPtr), -1, &native);
 	ret = DoRemoveDirectory(&native, recursive, &ds);
 	Tcl_DStringFree(&native);
@@ -1003,6 +1013,7 @@ TclpObjRemoveDirectory(
 	}
 	Tcl_DStringFree(&ds);
     }
+    if (normPtr && normPtr != pathPtr) { Tcl_DecrRefCount(normPtr); }
 
     return ret;
 }
diff --git a/win/tclWinFile.c b/win/tclWinFile.c
index 9087361..eeb48b7 100644
--- a/win/tclWinFile.c
+++ b/win/tclWinFile.c
@@ -943,12 +943,15 @@ TclpMatchInDirectory(
 	    int len;
 	    DWORD attr;
 	    WIN32_FILE_ATTRIBUTE_DATA data;
-	    const char *str = Tcl_GetStringFromObj(norm,&len);
+	    const char *str;
 
+	    if (norm != pathPtr) { Tcl_IncrRefCount(norm); }
+	    str = TclGetStringFromObj(norm, &len);
 	    native = (WCHAR *)Tcl_FSGetNativePath(pathPtr);
 
 	    if (GetFileAttributesExW(native,
 		    GetFileExInfoStandard, &data) != TRUE) {
+		if (norm != pathPtr) { Tcl_DecrRefCount(norm); }
 		return TCL_OK;
 	    }
 	    attr = data.dwFileAttributes;
@@ -956,6 +959,7 @@ TclpMatchInDirectory(
 	    if (NativeMatchType(WinIsDrive(str,len), attr, native, types)) {
 		Tcl_ListObjAppendElement(interp, resultPtr, pathPtr);
 	    }
+	    if (norm != pathPtr) { Tcl_DecrRefCount(norm); }
 	}
 	return TCL_OK;
     } else {
@@ -981,7 +985,8 @@ TclpMatchInDirectory(
 	if (fileNamePtr == NULL) {
 	    return TCL_ERROR;
 	}
-	Tcl_IncrRefCount(fileNamePtr); /* ensure it'd be alive, while used. */
+	/* Ensure it'd be alive, while used. */
+	if (fileNamePtr != pathPtr) { Tcl_IncrRefCount(fileNamePtr); }
 
 	/*
 	 * Verify that the specified path exists and is actually a directory.
@@ -989,14 +994,14 @@ TclpMatchInDirectory(
 
 	native = (const WCHAR *)Tcl_FSGetNativePath(pathPtr);
 	if (native == NULL) {
-	    Tcl_DecrRefCount(fileNamePtr);
+	    if (fileNamePtr != pathPtr) { Tcl_DecrRefCount(fileNamePtr); }
 	    return TCL_OK;
 	}
 	attr = GetFileAttributesW(native);
 
 	if ((attr == INVALID_FILE_ATTRIBUTES)
 	    || ((attr & FILE_ATTRIBUTE_DIRECTORY) == 0)) {
-	    Tcl_DecrRefCount(fileNamePtr);
+	    if (fileNamePtr != pathPtr) { Tcl_DecrRefCount(fileNamePtr); }
 	    return TCL_OK;
 	}
 
@@ -1014,7 +1019,7 @@ TclpMatchInDirectory(
 	    TclDStringAppendLiteral(&dsOrig, "/");
 	    dirLength++;
 	}
-	Tcl_DecrRefCount(fileNamePtr);
+	if (fileNamePtr != pathPtr) { Tcl_DecrRefCount(fileNamePtr); }
 	dirName = Tcl_DStringValue(&dsOrig);
 
 	/*
@@ -2412,18 +2417,21 @@ TclpObjLink(
 	int res;
 	const WCHAR *LinkTarget;
 	const WCHAR *LinkSource = (const WCHAR *)Tcl_FSGetNativePath(pathPtr);
-	Tcl_Obj *normalizedToPtr = Tcl_FSGetNormalizedPath(NULL, toPtr);
+	Tcl_Obj *normToPtr = Tcl_FSGetNormalizedPath(NULL, toPtr);
 
-	if (normalizedToPtr == NULL) {
+	if (normToPtr == NULL) {
 	    return NULL;
 	}
+	if (normToPtr != toPtr) { Tcl_IncrRefCount(normToPtr); }
 
-	LinkTarget = (const WCHAR *)Tcl_FSGetNativePath(normalizedToPtr);
+	LinkTarget = (const WCHAR *)Tcl_FSGetNativePath(normToPtr);
 
 	if (LinkSource == NULL || LinkTarget == NULL) {
+	    if (normToPtr != toPtr) { Tcl_DecrRefCount(normToPtr); }
 	    return NULL;
 	}
 	res = WinLink(LinkSource, LinkTarget, linkAction);
+	if (normToPtr != toPtr) { Tcl_DecrRefCount(normToPtr); }
 	if (res == 0) {
 	    return toPtr;
 	} else {