* `nix-env -e' corrupts memory due to incorrect use of iterators.

  Reported by Rob Vermaas.

1 files changed, 6 insertions, 2 deletions

diff --git a/src/nix-env/main.cc b/src/nix-env/main.cc
index 4676f0131ab0..96bbce5cf0dd 100644
--- a/src/nix-env/main.cc
+++ b/src/nix-env/main.cc
@@ -584,23 +584,27 @@ static void uninstallDerivations(Globals & globals, DrvNames & selectors,
     Path & profile)
 {
     UserEnvElems installedElems = queryInstalled(globals.state, profile);
+    UserEnvElems newElems;
 
     for (UserEnvElems::iterator i = installedElems.begin();
          i != installedElems.end(); ++i)
     {
         DrvName drvName(i->second.name);
+        bool found = false;
         for (DrvNames::iterator j = selectors.begin();
              j != selectors.end(); ++j)
             if (j->matches(drvName)) {
                 printMsg(lvlInfo,
                     format("uninstalling `%1%'") % i->second.name);
-                installedElems.erase(i);
+                found = true;
+                break;
             }
+        if (!found) newElems.insert(*i);
     }
 
     if (globals.dryRun) return;
 
-    createUserEnv(globals.state, installedElems,
+    createUserEnv(globals.state, newElems,
         profile, globals.keepDerivations);
 }