From 8656b130ea6defe6a7ef04b564ff391caa64a450 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 29 Aug 2021 19:31:52 +0200
Subject: [PATCH] Fix use after free with vImportedDrvToDerivation

---
 src/libexpr/eval.hh    |  1 +
 src/libexpr/primops.cc | 11 +++++------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/libexpr/eval.hh b/src/libexpr/eval.hh
index 22b0a584b..03dcfcf21 100644
--- a/src/libexpr/eval.hh
+++ b/src/libexpr/eval.hh
@@ -101,6 +101,7 @@ public:
     const ref<Store> buildStore;
 
     RootValue vCallFlake = nullptr;
+    RootValue vImportedDrvToDerivation = nullptr;
 
 private:
     SrcToStore srcToStore;
diff --git a/src/libexpr/primops.cc b/src/libexpr/primops.cc
index bfe41c9fa..0a4bce1d7 100644
--- a/src/libexpr/primops.cc
+++ b/src/libexpr/primops.cc
@@ -160,16 +160,15 @@ static void import(EvalState & state, const Pos & pos, Value & vPath, Value * vS
         }
         w.attrs->sort();
 
-        static RootValue fun;
-        if (!fun) {
-            fun = allocRootValue(state.allocValue());
+        if (!state.vImportedDrvToDerivation) {
+            state.vImportedDrvToDerivation = allocRootValue(state.allocValue());
             state.eval(state.parseExprFromString(
                 #include "imported-drv-to-derivation.nix.gen.hh"
-                , "/"), **fun);
+                , "/"), **state.vImportedDrvToDerivation);
         }
 
-        state.forceFunction(**fun, pos);
-        mkApp(v, **fun, w);
+        state.forceFunction(**state.vImportedDrvToDerivation, pos);
+        mkApp(v, **state.vImportedDrvToDerivation, w);
         state.forceAttrs(v, pos);
     }