From cea85e79ee04d428717d76d9f2cab3d5372fa718 Mon Sep 17 00:00:00 2001 From: Sergei Zimmerman Date: Fri, 15 Aug 2025 16:39:28 +0300 Subject: [PATCH] libstore: Fix dangling pointers in DerivationGoal constructors This leads to a use-after free, because staticOutputHashes returns a temporary object that dies before we can do a `return *mOutputHash`. This is most likely the cause for random failures in Hydra [1]. [1]: https://hydra.nixos.org/build/305091330/nixlog/2 --- src/libstore/build/derivation-goal.cc | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/libstore/build/derivation-goal.cc b/src/libstore/build/derivation-goal.cc index 30a247777..e8523569d 100644 --- a/src/libstore/build/derivation-goal.cc +++ b/src/libstore/build/derivation-goal.cc @@ -34,11 +34,10 @@ DerivationGoal::DerivationGoal( , drvPath(drvPath) , wantedOutput(wantedOutput) , outputHash{[&] { - if (auto * mOutputHash = get(staticOutputHashes(worker.evalStore, drv), wantedOutput)) + auto outputHashes = staticOutputHashes(worker.evalStore, drv); + if (auto * mOutputHash = get(outputHashes, wantedOutput)) return *mOutputHash; - else - throw Error( - "derivation '%s' does not have output '%s'", worker.store.printStorePath(drvPath), wantedOutput); + throw Error("derivation '%s' does not have output '%s'", worker.store.printStorePath(drvPath), wantedOutput); }()} , buildMode(buildMode) {