Subject: Re: [PATCH] fix(tvix/eval): allow negative substring lengths

From: sternenseemann <[email-masked]>
Date: Fri, 2 Jun 2023 15:02:10 +0200

On 6/1/23 21:22, Linus Heckemann wrote:
> Nix uses string::substr without checking the sign of the length[1].
> The NixOS testing infrastructure relies on this[2], and on the
> implicit conversion of that to the maximum possible value for a
> size_t.
> 
> [1]: https://github.com/NixOS/nix/blob/ecae62020b64914d9859a71ce197d03688c6133c/src/libexpr/primops.cc#L3597
> [2]: https://github.com/NixOS/nixpkgs/blob/c7c298471676ac1c7789ab3c424fbcebecaa6791/nixos/lib/testing/driver.nix#L29

Proposed as <https://cl.tvl.fyi/8692> and added my comments there. You 
should be able to sign in with GitHub (at least according to 
https://github.com/keycloak/keycloak/issues/9429#issuecomment-1568241222) 
and comment there.