diff options
author | Robert Hensing <robert@roberthensing.nl> | 2022-01-06 01:20:12 +0100 |
---|---|---|
committer | Robert Hensing <robert@roberthensing.nl> | 2022-01-19 15:21:56 +0100 |
commit | d038a67bd3c6ed0d6452d595cf0af3115e14c48f (patch) | |
tree | 38d423aa4332d1050a466adeb1b21af194cb36fc /tests/big-derivation-attr.nix | |
parent | bc443511eb65420b51d10708e25427fe50de37a8 (diff) |
Fix segfault or stack overflow caused by large derivation fields
This removes a dynamic stack allocation, making the derivation
unparsing logic robust against overflows when large strings are
added to a derivation.
Overflow behavior depends on the platform and stack configuration.
For instance, x86_64-linux/glibc behaves as (somewhat) expected:
$ (ulimit -s 20000; nix-instantiate tests/lang/eval-okay-big-derivation-attr.nix)
error: stack overflow (possible infinite recursion)
$ (ulimit -s 40000; nix-instantiate tests/lang/eval-okay-big-derivation-attr.nix)
error: expression does not evaluate to a derivation (or a set or list of those)
However, on aarch64-darwin:
$ nix-instantiate big-attr.nix ~
zsh: segmentation fault nix-instantiate big-attr.nix
This indicates a slight flaw in the single stack protection page
approach that is not encountered with normal stack frames.
Diffstat (limited to 'tests/big-derivation-attr.nix')
-rw-r--r-- | tests/big-derivation-attr.nix | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/tests/big-derivation-attr.nix b/tests/big-derivation-attr.nix new file mode 100644 index 000000000..35c1187f6 --- /dev/null +++ b/tests/big-derivation-attr.nix @@ -0,0 +1,13 @@ +let + sixteenBytes = "0123456789abcdef"; + times16 = s: builtins.concatStringsSep "" [s s s s s s s s s s s s s s s s]; + exp = n: x: if n == 1 then x else times16 (exp (n - 1) x); + sixteenMegabyte = exp 6 sixteenBytes; +in +assert builtins.stringLength sixteenMegabyte == 16777216; +derivation { + name = "big-derivation-attr"; + builder = "/x"; + system = "y"; + bigAttr = sixteenMegabyte; +} |