1 files changed, 14 insertions, 1 deletions
diff --git a/tvix/nix-compat/src/nar/writer/mod.rs b/tvix/nix-compat/src/nar/writer/mod.rs
index 9f9640e273bb..f24b69883876 100644
--- a/tvix/nix-compat/src/nar/writer/mod.rs
+++ b/tvix/nix-compat/src/nar/writer/mod.rs
@@ -28,7 +28,11 @@
 //! # Ok::<(), std::io::Error>(())
 //! ```
 
-use std::io::{self, BufRead, ErrorKind::UnexpectedEof, Write};
+use std::io::{
+    self, BufRead,
+    ErrorKind::{InvalidInput, UnexpectedEof},
+    Write,
+};
 
 mod wire;
 
@@ -108,6 +112,15 @@ impl<'a, 'w> Node<'a, 'w> {
             reader.consume(n);
         }
 
+        // bail if there's still data left in the passed reader.
+        // This uses the same code as [BufRead::has_data_left] (unstable).
+        if reader.fill_buf().map(|b| !b.is_empty())? {
+            return Err(io::Error::new(
+                InvalidInput,
+                "reader contained more data than specified size",
+            ));
+        }
+
         self.pad(size)?;
         self.write(&wire::TOK_PAR)?;