Fix undefined behavior in package extraction code

ziglang · Nov 7, 2024 · d89cfe7 · d89cfe7
1 parent 59c3678
commit d89cfe7
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/src/Package/Fetch.zig b/src/Package/Fetch.zig
@@ -1730,7 +1730,7 @@ const HashedFile = struct {
 fn stripRoot(fs_path: []const u8, root_dir: []const u8) []const u8 {
     if (root_dir.len == 0 or fs_path.len <= root_dir.len) return fs_path;
 
-    if (std.mem.eql(u8, fs_path[0..root_dir.len], root_dir) and fs_path[root_dir.len] == fs.path.sep) {
+    if (std.mem.eql(u8, fs_path[0..root_dir.len], root_dir) and fs.path.isSep(fs_path[root_dir.len])) {
         return fs_path[root_dir.len + 1 ..];
     }
 
@@ -1845,8 +1845,8 @@ const FileHeader = struct {
     }
 
     pub fn isExecutable(self: *FileHeader) bool {
-        return std.mem.eql(u8, self.header[0..shebang.len], shebang) or
-            std.mem.eql(u8, self.header[0..elf_magic.len], elf_magic);
+        return std.mem.eql(u8, self.header[0..@min(self.bytes_read, shebang.len)], shebang) or
+            std.mem.eql(u8, self.header[0..@min(self.bytes_read, elf_magic.len)], elf_magic);
     }
 };
 
@@ -2128,7 +2128,7 @@ test "tarball with duplicate paths" {
 
     try fb.expectFetchErrors(1,
         \\error: unable to unpack tarball
-        \\    note: unable to create file 'duplicate_paths/dir1/file1': PathAlreadyExists
+        \\    note: unable to create file 'dir1/file1': PathAlreadyExists
         \\
     );
 }