[PATCH] fix(tvix/eval): allow negative substring lengths

[PATCH] fix(tvix/eval): allow negative substring lengths

[Linus Heckemann]

Nix uses string::substr without checking the sign of the length[1].
The NixOS testing infrastructure relies on this[2], and on the
implicit conversion of that to the maximum possible value for a
size_t.

[1]: https://github.com/NixOS/nix/blob/ecae62020b64914d9859a71ce197d03688c6133c/src/libexpr/primops.cc#L3597
[2]: https://github.com/NixOS/nixpkgs/blob/c7c298471676ac1c7789ab3c424fbcebecaa6791/nixos/lib/testing/driver.nix#L29
---
 tvix/eval/src/builtins/mod.rs | 10 +++++-----
 tvix/eval/src/errors.rs       | 15 ---------------
 2 files changed, 5 insertions(+), 20 deletions(-)

diff --git a/tvix/eval/src/builtins/mod.rs b/tvix/eval/src/builtins/mod.rs
index 53ad6f3f8..ab19ca5ea 100644
--- a/tvix/eval/src/builtins/mod.rs
+++ b/tvix/eval/src/builtins/mod.rs
@@ -869,11 +869,11 @@ mod pure_builtins {
             return Ok(Value::String("".into()));
         }
 
-        if len < 0 {
-            return Err(ErrorKind::NegativeLength { length: len });
-        }
-
-        let len = len as usize;
+        let len = if len < 0 {
+            x.as_str().len() as usize
+        } else {
+            len as usize
+        };
         let end = cmp::min(beg + len, x.as_str().len());
 
         Ok(Value::String(x.as_str()[beg..end].into()))
diff --git a/tvix/eval/src/errors.rs b/tvix/eval/src/errors.rs
index 2fbb6496c..76f55d681 100644
--- a/tvix/eval/src/errors.rs
+++ b/tvix/eval/src/errors.rs
@@ -108,11 +108,6 @@ pub enum ErrorKind {
     /// An error occurred when parsing an integer
     ParseIntError(ParseIntError),
 
-    /// A negative integer was used as a value representing length.
-    NegativeLength {
-        length: i64,
-    },
-
     // Errors specific to nested attribute sets and merges thereof.
     /// Nested attributes can not be merged with an inherited value.
     UnmergeableInherit {
@@ -396,14 +391,6 @@ to a missing value in the attribute set(s) included via `with`."#,
                 write!(f, "invalid integer: {}", err)
             }
 
-            ErrorKind::NegativeLength { length } => {
-                write!(
-                    f,
-                    "cannot use a negative integer, {}, for a value representing length",
-                    length
-                )
-            }
-
             ErrorKind::UnmergeableInherit { name } => {
                 write!(
                     f,
@@ -765,7 +752,6 @@ impl Error {
             | ErrorKind::NotCoercibleToString { .. }
             | ErrorKind::NotAnAbsolutePath(_)
             | ErrorKind::ParseIntError(_)
-            | ErrorKind::NegativeLength { .. }
             | ErrorKind::UnmergeableInherit { .. }
             | ErrorKind::UnmergeableValue
             | ErrorKind::ImportParseError { .. }
@@ -808,7 +794,6 @@ impl Error {
             ErrorKind::IndexOutOfBounds { .. } => "E019",
             ErrorKind::NotAnAbsolutePath(_) => "E020",
             ErrorKind::ParseIntError(_) => "E021",
-            ErrorKind::NegativeLength { .. } => "E022",
             ErrorKind::TailEmptyList { .. } => "E023",
             ErrorKind::UnmergeableInherit { .. } => "E024",
             ErrorKind::UnmergeableValue => "E025",
-- 
2.40.1

Re: [PATCH] fix(tvix/eval): allow negative substring lengths

[sternenseemann]

On 6/1/23 21:22, Linus Heckemann wrote:
> Nix uses string::substr without checking the sign of the length[1].
> The NixOS testing infrastructure relies on this[2], and on the
> implicit conversion of that to the maximum possible value for a
> size_t.
> 
> [1]: https://github.com/NixOS/nix/blob/ecae62020b64914d9859a71ce197d03688c6133c/src/libexpr/primops.cc#L3597
> [2]: https://github.com/NixOS/nixpkgs/blob/c7c298471676ac1c7789ab3c424fbcebecaa6791/nixos/lib/testing/driver.nix#L29

Proposed as <https://cl.tvl.fyi/8692> and added my comments there. You 
should be able to sign in with GitHub (at least according to 
https://github.com/keycloak/keycloak/issues/9429#issuecomment-1568241222) 
and comment there.

Re: [PATCH] fix(tvix/eval): allow negative substring lengths

[Vincent Ambo]

Imported as https://cl.tvl.fyi/8692