diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/default.nix index 62187827423d..caba470b9a12 100644 --- a/pkgs/development/compilers/zig/default.nix +++ b/pkgs/development/compilers/zig/default.nix @@ -18,6 +18,9 @@ stdenv.mkDerivation rec { hash = "sha256-x2c4c9RSrNWGqEngio4ArW7dJjW0gg+8nqBwPcR721k="; }; + # Fix index out of bounds reading RPATH (cherry-picked from 0.10-dev) + patches = [ ./rpath.patch ]; + nativeBuildInputs = [ cmake llvmPackages.llvm.dev diff --git a/pkgs/development/compilers/zig/rpath.patch b/pkgs/development/compilers/zig/rpath.patch new file mode 100644 index 000000000000..70633193f944 --- /dev/null +++ b/pkgs/development/compilers/zig/rpath.patch @@ -0,0 +1,39 @@ +commit ebcdbd9b3c9d437780aee4d6af76bbd2ab32ea06 +Author: LeRoyce Pearson +Date: 2022-07-17 16:01:22 -0600 + + Read dynstr starting at rpath offset + + Since we know the offset, we may as well read starting there. Still expects + rpath to fit in 4096 bytes; that might be worth fixing in the future. + + Fixes issue #12112 + +diff --git a/lib/std/zig/system/NativeTargetInfo.zig b/lib/std/zig/system/NativeTargetInfo.zig +index af41fc790579..ad0b6d5ce1e1 100644 +--- a/lib/std/zig/system/NativeTargetInfo.zig ++++ b/lib/std/zig/system/NativeTargetInfo.zig +@@ -652,14 +652,19 @@ pub fn abiAndDynamicLinkerFromFile( + } else null; + + if (dynstr) |ds| { +- const strtab_len = std.math.min(ds.size, strtab_buf.len); +- const strtab_read_len = try preadMin(file, &strtab_buf, ds.offset, strtab_len); +- const strtab = strtab_buf[0..strtab_read_len]; + // TODO this pointer cast should not be necessary + const rpoff_usize = std.math.cast(usize, rpoff) catch |err| switch (err) { + error.Overflow => return error.InvalidElfFile, + }; +- const rpath_list = mem.sliceTo(std.meta.assumeSentinel(strtab[rpoff_usize..].ptr, 0), 0); ++ if (rpoff_usize > ds.size) return error.InvalidElfFile; ++ const rpoff_file = ds.offset + rpoff_usize; ++ const rp_max_size = ds.size - rpoff_usize; ++ ++ const strtab_len = std.math.min(rp_max_size, strtab_buf.len); ++ const strtab_read_len = try preadMin(file, &strtab_buf, rpoff_file, strtab_len); ++ const strtab = strtab_buf[0..strtab_read_len]; ++ ++ const rpath_list = mem.sliceTo(std.meta.assumeSentinel(strtab.ptr, 0), 0); + var it = mem.tokenize(u8, rpath_list, ":"); + while (it.next()) |rpath| { + var dir = fs.cwd().openDir(rpath, .{}) catch |err| switch (err) {