about summary refs log tree commit diff
path: root/src/libexpr
diff options
context:
space:
mode:
authorTuomas Tynkkynen <tuomas@tuxera.com>2018-02-19T15·52+0200
committerTuomas Tynkkynen <tuomas@tuxera.com>2018-02-19T21·20+0200
commit4ea9707591beceacf9988b3c185faf50da238403 (patch)
tree638c7c3572b6fd3801191aa318e4a86655071000 /src/libexpr
parent1d0e42879fa687a7b6856b1a63070e44bd8ed5c4 (diff)
libexpr: Fix prim_replaceStrings() to work on an empty source string
Otherwise, running e.g.

nix-instantiate --eval -E --strict 'builtins.replaceStrings [""] ["X"] "abc"'

would just hang in an infinite loop.

Found by afl-fuzz.
Diffstat (limited to 'src/libexpr')
-rw-r--r--src/libexpr/primops.cc11
1 files changed, 8 insertions, 3 deletions
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index a800d24290ae..ab9351f11858 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -1913,21 +1913,26 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
     auto s = state.forceString(*args[2], context, pos);
 
     string res;
-    for (size_t p = 0; p < s.size(); ) {
+    // Loops one past last character to handle the case where 'from' contains an empty string.
+    for (size_t p = 0; p <= s.size(); ) {
         bool found = false;
         auto i = from.begin();
         auto j = to.begin();
         for (; i != from.end(); ++i, ++j)
             if (s.compare(p, i->size(), *i) == 0) {
                 found = true;
-                p += i->size();
                 res += j->first;
+                if (i->empty()) {
+                    res += s[p++];
+                } else {
+                    p += i->size();
+                }
                 for (auto& path : j->second)
                     context.insert(path);
                 j->second.clear();
                 break;
             }
-        if (!found) res += s[p++];
+        if (!found && p < s.size()) res += s[p++];
     }
 
     mkString(v, res, context);