fix(tvix/eval): allow negative substring lengths r/6267

Nix uses string::substr without checking the sign of the length[1].
The NixOS testing infrastructure relies on this[2], and on the
implicit conversion of that to the maximum possible value for a
size_t.

[1]: https://github.com/NixOS/nix/blob/ecae62020b64914d9859a71ce197d03688c6133c/src/libexpr/primops.cc#L3597
[2]: https://github.com/NixOS/nixpkgs/blob/c7c298471676ac1c7789ab3c424fbcebecaa6791/nixos/lib/testing/driver.nix#L29

Change-Id: I6d0caf6830b6bda3fdf44c40c81de6a1befeca7b
Reviewed-on: https://cl.tvl.fyi/c/depot/+/8746
Reviewed-by: flokli <flokli@flokli.de>
Tested-by: BuildkiteCI

1 files changed, 5 insertions, 6 deletions

diff --git a/tvix/eval/src/builtins/mod.rs b/tvix/eval/src/builtins/mod.rs
index 53ad6f3f8e..b5c7931768 100644
--- a/tvix/eval/src/builtins/mod.rs
+++ b/tvix/eval/src/builtins/mod.rs
@@ -869,12 +869,11 @@ mod pure_builtins {
             return Ok(Value::String("".into()));
         }
 
-        if len < 0 {
-            return Err(ErrorKind::NegativeLength { length: len });
-        }
-
-        let len = len as usize;
-        let end = cmp::min(beg + len, x.as_str().len());
+        let end = if len < 0 {
+            x.as_str().len() as usize
+        } else {
+            cmp::min(beg + (len as usize), x.as_str().len())
+        };
 
         Ok(Value::String(x.as_str()[beg..end].into()))
     }