From 2e5096e4f0959cb2974a17fe50ad5ad891b2384f Mon Sep 17 00:00:00 2001
From: Yorick van Pelt <yorick@yorickvanpelt.nl>
Date: Fri, 11 Aug 2023 12:00:31 +0200
Subject: FileTransfer::download: fix use-after-move

std::move(state->data) and data.empty() were called in a loop, and
could run with no other threads intervening. Accessing moved objects
is undefined behavior, and could cause a crash.
---
 src/libstore/filetransfer.cc | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src/libstore/filetransfer.cc')

diff --git a/src/libstore/filetransfer.cc b/src/libstore/filetransfer.cc
index 38b691279..a283af5a2 100644
--- a/src/libstore/filetransfer.cc
+++ b/src/libstore/filetransfer.cc
@@ -863,6 +863,8 @@ void FileTransfer::download(FileTransferRequest && request, Sink & sink)
             }
 
             chunk = std::move(state->data);
+            /* Reset state->data after the move, since we check data.empty() */
+            state->data = "";
 
             state->request.notify_one();
         }
-- 
cgit v1.2.3