Merge pull request #186889 from McSinyx/zig-rpath

pkgs/development/compilers/zig/default.nix

@@ -18,6 +18,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-x2c4c9RSrNWGqEngio4ArW7dJjW0gg+8nqBwPcR721k=";
   };
 
+  # Fix index out of bounds reading RPATH (cherry-picked from 0.10-dev)
+  patches = [ ./rpath.patch ];
+
   nativeBuildInputs = [
     cmake
     llvmPackages.llvm.dev

pkgs/development/compilers/zig/rpath.patch

@@ -0,0 +1,39 @@
+commit ebcdbd9b3c9d437780aee4d6af76bbd2ab32ea06
+Author: LeRoyce Pearson <contact@leroycepearson.dev>
+Date:   2022-07-17 16:01:22 -0600
+
+    Read dynstr starting at rpath offset
+    
+    Since we know the offset, we may as well read starting there. Still expects
+    rpath to fit in 4096 bytes; that might be worth fixing in the future.
+    
+    Fixes issue #12112
+
+diff --git a/lib/std/zig/system/NativeTargetInfo.zig b/lib/std/zig/system/NativeTargetInfo.zig
+index af41fc790579..ad0b6d5ce1e1 100644
+--- a/lib/std/zig/system/NativeTargetInfo.zig
++++ b/lib/std/zig/system/NativeTargetInfo.zig
+@@ -652,14 +652,19 @@ pub fn abiAndDynamicLinkerFromFile(
+             } else null;
+ 
+             if (dynstr) |ds| {
+-                const strtab_len = std.math.min(ds.size, strtab_buf.len);
+-                const strtab_read_len = try preadMin(file, &strtab_buf, ds.offset, strtab_len);
+-                const strtab = strtab_buf[0..strtab_read_len];
+                 // TODO this pointer cast should not be necessary
+                 const rpoff_usize = std.math.cast(usize, rpoff) catch |err| switch (err) {
+                     error.Overflow => return error.InvalidElfFile,
+                 };
+-                const rpath_list = mem.sliceTo(std.meta.assumeSentinel(strtab[rpoff_usize..].ptr, 0), 0);
++                if (rpoff_usize > ds.size) return error.InvalidElfFile;
++                const rpoff_file = ds.offset + rpoff_usize;
++                const rp_max_size = ds.size - rpoff_usize;
++
++                const strtab_len = std.math.min(rp_max_size, strtab_buf.len);
++                const strtab_read_len = try preadMin(file, &strtab_buf, rpoff_file, strtab_len);
++                const strtab = strtab_buf[0..strtab_read_len];
++
++                const rpath_list = mem.sliceTo(std.meta.assumeSentinel(strtab.ptr, 0), 0);
+                 var it = mem.tokenize(u8, rpath_list, ":");
+                 while (it.next()) |rpath| {
+                     var dir = fs.cwd().openDir(rpath, .{}) catch |err| switch (err) {