[BUG] fuse-overlayfs can be tricked to omit directories with same inode

[fancywins]

Reproduction

mkdir lower upper work merged
mkdir -p lower/a/b lower/b
mount -B lower/a/b lower/b
fuse-overlayfs -o lowerdir=lower,upperdir=upper,workdir=work merged
ls lower
>> a  b
ls merged
>> a

Expected result

merged should contain both directories.

The problem

When a new node has the same inode, this code checks if it's a directory, frees it if so, and returns the existing node:

fuse-overlayfs/main.c

Lines 1194 to 1206 in 84240e9

	ino = hash_lookup (lo->inodes, &key);
	if (ino)
	{
	struct ovl_node *it;
	for (it = ino->node; it; it = it->next_link)
	{
	if (node_dirp (it) || strcmp (n->path, it->path) == 0)
	{
	node_free (n);
	return it;
	}
	}

This is clearly way too dangerous. However, the problem goes away if the node_dirp (it) condition is removed.