Commit 4f8a44cd0f

Andrew Kelley <andrew@ziglang.org>
2023-12-25 05:50:37
compiler: fix UAF when writing builtin.zig
1 parent 44e2dbe
Changed files (2)
src/Builtin.zig
@@ -279,7 +279,8 @@ pub fn populateFile(comp: *Compilation, mod: *Module, file: *File) !void {
 }
 
 fn writeFile(file: *File, mod: *Module) !void {
-    var af = try mod.root.atomicFile(mod.root_src_path, .{ .make_path = true });
+    var buf: [std.fs.MAX_PATH_BYTES]u8 = undefined;
+    var af = try mod.root.atomicFile(mod.root_src_path, .{ .make_path = true }, &buf);
     defer af.deinit();
     try af.file.writeAll(file.source);
     try af.finish();
src/Package.zig
@@ -88,10 +88,10 @@ pub const Path = struct {
         p: Path,
         sub_path: []const u8,
         options: fs.Dir.AtomicFileOptions,
+        buf: *[fs.MAX_PATH_BYTES]u8,
     ) !fs.AtomicFile {
-        var buf: [fs.MAX_PATH_BYTES]u8 = undefined;
         const joined_path = if (p.sub_path.len == 0) sub_path else p: {
-            break :p std.fmt.bufPrint(&buf, "{s}" ++ fs.path.sep_str ++ "{s}", .{
+            break :p std.fmt.bufPrint(buf, "{s}" ++ fs.path.sep_str ++ "{s}", .{
                 p.sub_path, sub_path,
             }) catch return error.NameTooLong;
         };