No description
Find a file
Jade Lovelace 492715c0bb diff-closures: fix a use after free
Found by looking for interesting asan reports from the test suite.

What happened here is that name got overwritten, but it was what
actually held the backing memory for the thing it got overwritten by,
which was a by-reference value coming out of std::regex.

Due to absurd reasons I cannot seem to use a string_view iterator here,
so I just copy the string with a longer lifetime instead. idk lol

==3796364==ERROR: AddressSanitizer: heap-use-after-free on address 0x503000014c61 at pc 0x74843523bf1d bp 0x7ffc68351330 sp 0x7ffc68350af0
READ of size 3 at 0x503000014c61 thread T0
    0 0x74843523bf1c in __asan_memcpy (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x159f1c)
    1 0x6403cf6cbff4 in std::char_traits<char>::copy(char*, char const*, unsigned long) /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/char_traits.h:445:33
    <...>
    7 0x6403cf6cbff4 in std::__cxx11::sub_match<__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::str() const /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/regex.h:966:6
    8 0x6403cf6cbff4 in std::__cxx11::sub_match<__gnu_cxx::__normal_iterator<char const*, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>>>::operator std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>() const /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/regex.h:955:16
    9 0x6403cf6cbff4 in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:37:26
    10 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
    11 0x6403cf873331 in CmdProfileDiffClosures::run(nix::ref<nix::Store>) /home/jade/lix/lix2/build/src/nix/profile.cc:479:17
    <...>

0x503000014c61 is located 17 bytes inside of 21-byte region [0x503000014c50,0x503000014c65)
freed by thread T0 here:
    0 0x748435250470 in operator delete(void*) (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x16e470)
    <...>
    6 0x6403cf6cbda2 in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::~basic_string() /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/basic_string.h:792:9
    7 0x6403cf6cbda2 in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:36:13
    8 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
    <...>

previously allocated by thread T0 here:
    0 0x74843524fa38 in operator new(unsigned long) (/nix/store/mzhqknx2mc94jdz4n320hn1lml86398y-clang-wrapper-17.0.6/resource-root/lib/linux/libclang_rt.asan-x86_64.so+0x16da38)
    <...>
    9 0x6403cf6cb68c in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char>>::basic_string<std::basic_string_view<char, std::char_traits<char>>, void>(std::basic_string_view<char, std::char_traits<char>> const&, std::allocator<char> const&) /nix/store/14c6s4xzhy14i2b05s00rjns2j93gzz4-gcc-13.2.0/include/c++/13.2.0/bits/basic_string.h:784:4
    10 0x6403cf6cb68c in nix::getClosureInfo[abi:cxx11](nix::ref<nix::Store>, nix::StorePath const&) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:33:21
    11 0x6403cf6cd70c in nix::printClosureDiff(nix::ref<nix::Store>, nix::StorePath const&, nix::StorePath const&, std::basic_string_view<char, std::char_traits<char>>) /home/jade/lix/lix2/build/src/nix/diff-closures.cc:54:25
    12 0x6403cf873331 in CmdProfileDiffClosures::run(nix::ref<nix::Store>) /home/jade/lix/lix2/build/src/nix/profile.cc:479:17
    <...>

(cherry-picked from b9b1bbd22f)
2024-07-25 21:41:31 +02:00
.github Merge remote-tracking branch 'origin/master' into flake-regressions 2024-07-22 16:03:45 +02:00
build-utils-meson add werror=suggest-override 2024-07-25 07:41:12 +02:00
config Remove and gitignore the autoreconf generated files 2024-03-02 10:18:47 +01:00
contrib function-trace: always show the trace 2019-09-18 23:23:21 +02:00
doc/manual Fix reference to experimental features docs 2024-07-25 21:41:31 +02:00
m4 Build a minimized Nix with MinGW 2024-04-17 12:26:10 -04:00
maintainers Rename pre-commit-hooks -> git-hooks-nix 2024-07-24 15:55:57 +02:00
misc lint: fix shellcheck for misc/systemv/nix-daemon 2024-07-14 19:56:03 -07:00
mk Change skipped test error code from 99 to 77 2024-07-24 22:36:43 -04:00
packaging Deduplicate our many package.nix a bit (#11175) 2024-07-25 03:12:39 +00:00
scripts Merge remote-tracking branch 'origin/master' into flake-regressions 2024-07-22 16:03:45 +02:00
src diff-closures: fix a use after free 2024-07-25 21:41:31 +02:00
tests Merge pull request #11131 from rhendric/rhendric/pipe-operators 2024-07-25 16:58:43 +02:00
.clang-format .clang-format: Remove duplicated key 2024-06-03 18:38:56 +02:00
.clang-tidy Add .clang-tidy 2024-02-01 01:01:39 +01:00
.dir-locals.el .dir-locals.el: Set c-block-comment-prefix 2020-07-10 11:21:06 +02:00
.editorconfig No global eval settings in libnixexpr 2024-06-24 12:15:16 -04:00
.gitignore Stop vendoring toml11 2024-06-26 22:27:13 -04:00
.shellcheckrc housekeeping: shellcheck for tests/functional/ca/build-cache.sh 2024-06-12 17:41:16 -04:00
.version Bump version 2024-06-12 14:57:40 +02:00
CITATION.cff chore: PhD thesis as reference in CITATION.cff 2024-05-18 20:05:22 +02:00
configure.ac Add S3 opt dep to Meson, and simplify build 2024-07-22 11:11:38 -04:00
CONTRIBUTING.md manual: Contributing -> Development, Hacking -> Building (#9014) 2024-07-25 02:53:06 +00:00
COPYING * Change this to LGPL to keep the government happy. 2006-04-25 16:41:06 +00:00
default.nix add flake-compat to flake.nix and use sha256 in default.nix 2023-03-06 21:11:24 +01:00
docker.nix fix "add an option to include flake-registry..." 2023-05-16 14:35:31 +02:00
flake.lock Rename pre-commit-hooks -> git-hooks-nix 2024-07-24 15:55:57 +02:00
flake.nix Rename pre-commit-hooks -> git-hooks-nix 2024-07-24 15:55:57 +02:00
local.mk local.mk: Solve warnings 2024-04-17 15:37:14 +02:00
Makefile Merge pull request #11180 from Mic92/override-warnings 2024-07-25 03:00:50 -04:00
Makefile.config.in Port C API docs to Meson (#10936) 2024-06-19 22:43:54 +02:00
meson.build Progress on Wine CI support, MinGW dev shell with Meson (#10975) 2024-07-21 22:03:04 +00:00
package.nix Put unit tests back in old build system for now 2024-07-02 09:26:22 -04:00
precompiled-headers.h Build a minimized Nix with MinGW 2024-04-17 12:26:10 -04:00
README.md manual: Contributing -> Development, Hacking -> Building (#9014) 2024-07-25 02:53:06 +00:00
shell.nix Remove url literals 2022-01-24 13:28:21 +01:00

Nix

Open Collective supporters Test

Nix is a powerful package manager for Linux and other Unix systems that makes package management reliable and reproducible. Please refer to the Nix manual for more details.

Installation and first steps

Visit nix.dev for installation instructions and beginner tutorials.

Full reference documentation can be found in the Nix manual.

Building and developing

Follow instructions in the Nix reference manual to set up a development environment and build Nix from source.

Contributing

Check the contributing guide if you want to get involved with developing Nix.

Additional resources

Nix was created by Eelco Dolstra and developed as the subject of his PhD thesis The Purely Functional Software Deployment Model, published 2006. Today, a world-wide developer community contributes to Nix and the ecosystem that has grown around it.

License

Nix is released under the LGPL v2.1.