fs/vfs/fs_rename: fix directory move operation.

[cederom]

Summary

• Recurrency is removed from filesystem directory rename.
• Fixes use after free in buffer that was used as output and argument.
• Patch provided by @richyliu.

Impact

fs/vfs bug fix of possible use after free.

Testing

@cederom: esp32c6-xiao:usbnsh.
@richyliu: STM32 Nucleo H743ZI + FTP.

Reviewers please double check locally if the issue is reproducible and there are no side effects after patch :-)

[richyliu]

The following is a demonstration of the use-after-free, combined with the incorrect pseudorename logic, affecting the mv command in NuttX's NuttShell (NSH).

NuttShell (NSH) NuttX-12.8.0
nsh> mkdir c
nsh> mkdir c/a
nsh> mkdir c/a/b
nsh> mkdir c/b
nsh> ls
/:
c/
dev/
nsh> mv c/b c/a
nsh> ls
/:
b/
c/
dev/
nsh>

Due to the previously incorrect logic, when moving the directory c/b to c/a, it first checks for the existence of c/a/b. Seeing that it exists, it then tries to check for c/a/b/b. However, due to the use-after-free, it actually checks for /b, where "" is garbage data from the freed chunk. Due to the internal workings of the snprintf function used, the resultant string becomes "/b", which becomes the new move target of pseudorename. This is why c/b gets moved to /b.

Let me know if there's anything else needed on my end to get this merged.