From 3fb7481e64fc22313211c6c4ea79ac314457f81b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 24 Nov 2024 11:17:17 +0100
Subject: [PATCH] source-accessor: fix case where normalization goes beyond
 root

fixes https://github.com/NixOS/nix/issues/11936
---
 src/libutil/source-accessor.cc | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/libutil/source-accessor.cc b/src/libutil/source-accessor.cc
index e797951c7..d3e304f74 100644
--- a/src/libutil/source-accessor.cc
+++ b/src/libutil/source-accessor.cc
@@ -84,9 +84,10 @@ CanonPath SourceAccessor::resolveSymlinks(
         todo.pop_front();
         if (c == "" || c == ".")
             ;
-        else if (c == "..")
-            res.pop();
-        else {
+        else if (c == "..") {
+            if (!res.isRoot())
+                res.pop();
+        } else {
             res.push(c);
             if (mode == SymlinkResolution::Full || !todo.empty()) {
                 if (auto st = maybeLstat(res); st && st->type == SourceAccessor::tSymlink) {