libexpr: Fix prim_replaceStrings() to work on an empty source string

Otherwise, running e.g.

nix-instantiate --eval -E --strict 'builtins.replaceStrings [""] ["X"] "abc"'

would just hang in an infinite loop.

Found by afl-fuzz.
This commit is contained in:
Tuomas Tynkkynen 2018-02-19 17:52:33 +02:00
parent 1d0e42879f
commit 4ea9707591
3 changed files with 11 additions and 4 deletions

View file

@ -1913,21 +1913,26 @@ static void prim_replaceStrings(EvalState & state, const Pos & pos, Value * * ar
auto s = state.forceString(*args[2], context, pos);
string res;
for (size_t p = 0; p < s.size(); ) {
// Loops one past last character to handle the case where 'from' contains an empty string.
for (size_t p = 0; p <= s.size(); ) {
bool found = false;
auto i = from.begin();
auto j = to.begin();
for (; i != from.end(); ++i, ++j)
if (s.compare(p, i->size(), *i) == 0) {
found = true;
p += i->size();
res += j->first;
if (i->empty()) {
res += s[p++];
} else {
p += i->size();
}
for (auto& path : j->second)
context.insert(path);
j->second.clear();
break;
}
if (!found) res += s[p++];
if (!found && p < s.size()) res += s[p++];
}
mkString(v, res, context);

View file

@ -1 +1 @@
[ "faabar" "fbar" "fubar" "faboor" "fubar" ]
[ "faabar" "fbar" "fubar" "faboor" "fubar" "XaXbXcX" "X" ]

View file

@ -5,4 +5,6 @@ with builtins;
(replaceStrings ["oo"] ["u"] "foobar")
(replaceStrings ["oo" "a"] ["a" "oo"] "foobar")
(replaceStrings ["oo" "oo"] ["u" "i"] "foobar")
(replaceStrings [""] ["X"] "abc")
(replaceStrings [""] ["X"] "")
]