The result of vfs_canon() must be freed. So g_free(mpath); before first return -1; is missed in this patch.
Fixed in git, please review.
Patch is correct.
4.6.2-alt5.pre1