summaryrefslogtreecommitdiff
path: root/nix/libstore
diff options
context:
space:
mode:
authorLudovic Courtès <ludo@gnu.org>2015-05-11 22:21:31 +0200
committerLudovic Courtès <ludo@gnu.org>2015-05-11 23:01:20 +0200
commit1303a4a4517260def862ce7fe97e6b28dd8005e1 (patch)
tree1aa55bda57bd4ff8f951bf4aa5a84045eae220f5 /nix/libstore
parent2320ea1a51ce707ca19967f50e6fbedefafe14c4 (diff)
downloadpatches-1303a4a4517260def862ce7fe97e6b28dd8005e1.tar
patches-1303a4a4517260def862ce7fe97e6b28dd8005e1.tar.gz
daemon: Fix possible use-after-free.
This is essentially a backport of <https://github.com/NixOS/nix/commit/f52b6c944e90b3e35925122779175705fdc02e12> by Eelco Dolstra <eelco.dolstra@logicblox.com>. The use-after-free bug would typically manifest when building with GCC 5.1.
Diffstat (limited to 'nix/libstore')
-rw-r--r--nix/libstore/build.cc29
1 files changed, 7 insertions, 22 deletions
diff --git a/nix/libstore/build.cc b/nix/libstore/build.cc
index f38cd29940..b3c994d6de 100644
--- a/nix/libstore/build.cc
+++ b/nix/libstore/build.cc
@@ -401,18 +401,6 @@ static void commonChildInit(Pipe & logPipe)
}
-/* Convert a string list to an array of char pointers. Careful: the
- string list should outlive the array. */
-const char * * strings2CharPtrs(const Strings & ss)
-{
- const char * * arr = new const char * [ss.size() + 1];
- const char * * p = arr;
- foreach (Strings::const_iterator, i, ss) *p++ = i->c_str();
- *p = 0;
- return arr;
-}
-
-
/* Restore default handling of SIGPIPE, otherwise some programs will
randomly say "Broken pipe". */
static void restoreSIGPIPE()
@@ -2135,11 +2123,7 @@ void DerivationGoal::initChild()
Strings envStrs;
foreach (Environment::const_iterator, i, env)
envStrs.push_back(rewriteHashes(i->first + "=" + i->second, rewritesToTmp));
- const char * * envArr = strings2CharPtrs(envStrs);
-
- Path program = drv.builder.c_str();
- std::vector<const char *> args; /* careful with c_str()! */
- string user; /* must be here for its c_str()! */
+ std::vector<const char *> envArr = stringsToCharPtrs(envStrs);
/* If we are running in `build-users' mode, then switch to the
user we allocated above. Make sure that we drop all root
@@ -2165,17 +2149,18 @@ void DerivationGoal::initChild()
}
/* Fill in the arguments. */
+ Strings args;
string builderBasename = baseNameOf(drv.builder);
args.push_back(builderBasename.c_str());
foreach (Strings::iterator, i, drv.args)
- args.push_back(rewriteHashes(*i, rewritesToTmp).c_str());
- args.push_back(0);
+ args.push_back(rewriteHashes(*i, rewritesToTmp));
+ std::vector<const char *> argArr = stringsToCharPtrs(args);
restoreSIGPIPE();
/* Execute the program. This should not return. */
inSetup = false;
- execve(program.c_str(), (char * *) &args[0], (char * *) envArr);
+ execve(drv.builder.c_str(), (char * *) &argArr[0], (char * *) &envArr[0]);
throw SysError(format("executing `%1%'") % drv.builder);
@@ -2778,7 +2763,7 @@ void SubstitutionGoal::tryToRun()
args.push_back("--substitute");
args.push_back(storePath);
args.push_back(destPath);
- const char * * argArr = strings2CharPtrs(args);
+ std::vector<const char *> argArr = stringsToCharPtrs(args);
/* Fork the substitute program. */
pid = maybeVfork();
@@ -2796,7 +2781,7 @@ void SubstitutionGoal::tryToRun()
if (dup2(outPipe.writeSide, STDOUT_FILENO) == -1)
throw SysError("cannot dup output pipe into stdout");
- execv(sub.c_str(), (char * *) argArr);
+ execv(sub.c_str(), (char * *) &argArr[0]);
throw SysError(format("executing `%1%'") % sub);