wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-06-25 06:31:14 +02:00
Code Activity

Fix flake-c out of bounds access

Browse source 
The explicit include is needed for clangd to not get confused somehow,
which is also what threw me off initially and made me pick the wrong
constructor.
The (pointer, number, number) constructor first constructs a C string
and then takes a substring from that, but we didn't specify that the
buffer needs to be NUL-terminated, and then what would be the point of
the size argument anyway...

basic_string.h:

>	basic_string(const _Tp& __t, size_type __pos, size_type __n,
>		     const _Alloc& __a = _Alloc())
>	: basic_string(_S_to_string_view(__t).substr(__pos, __n), __a) { }

Valgrind on nixops4/rust/nix-flake tests:

==1344422== Conditional jump or move depends on uninitialised value(s)
==1344422==    at 0x48513E8: strlen (vg_replace_strmem.c:505)
==1344422==    by 0x488E941: UnknownInlinedFun (char_traits.h:391)
==1344422==    by 0x488E941: UnknownInlinedFun (string_view:141)
==1344422==    by 0x488E941: UnknownInlinedFun (basic_string.h:790)
==1344422==    by 0x488E941: nix_flake_reference_and_fragment_from_string (nix_api_flake.cc:81)
==1344422==    by 0x127332: nix_flake::FlakeReference::parse_with_fragment (lib.rs:123)
This commit is contained in:
Robert Hensing 2025-04-25 17:03:44 +02:00
parent 876f676d90
commit 94916136dc
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/libflake-c/nix_api_flake.cc
View file

@ -1,3 +1,5 @@
#include <string>
#include "nix_api_flake.h"
#include "nix_api_flake_internal.hh"
#include "nix_api_util.h"
@ -78,7 +80,7 @@ nix_err nix_flake_reference_and_fragment_from_string(
nix_clear_err(context);
*flakeReferenceOut = nullptr;
try {
std::string str(strData, 0, strSize);
std::string str(strData, strSize);
auto [flakeRef, fragment] =
nix::parseFlakeRefWithFragment(*fetchSettings->settings, str, parseFlags->baseDirectory, true);