Fix NUL byte crash in resolver (#9640)

parcel-bundler · Oct 14, 2024 · 96d8814 · 96d8814
1 parent 0bebfa6
commit 96d8814
Showing 1 changed file with 6 additions and 9 deletions.
diff --git a/packages/utils/node-resolver-rs/src/path.rs b/packages/utils/node-resolver-rs/src/path.rs
@@ -66,7 +66,7 @@ pub fn canonicalize(path: &Path, cache: &FileSystemRealPathCache) -> std::io::Re
   let mut seen_links = 0;
   let mut queue = VecDeque::new();
 
-  queue.push_back(path);
+  queue.push_back(path.to_path_buf());
 
   while let Some(cur_path) = queue.pop_front() {
     let mut components = cur_path.components();
@@ -84,11 +84,9 @@ pub fn canonicalize(path: &Path, cache: &FileSystemRealPathCache) -> std::io::Re
           ret.push(c);
 
           // First, check the cache for the path up to this point.
-          let link: &Path = if let Some(cached) = cache.get(&ret) {
+          let link = if let Some(cached) = cache.get(&ret) {
             if let Some(link) = &*cached {
-              // SAFETY: Keys are never removed from the cache or mutated
-              // and PathBuf has a stable address for path data even when moved.
-              unsafe { &*(link.as_path() as *const _) }
+              link.clone()
             } else {
               continue;
             }
@@ -100,9 +98,8 @@ pub fn canonicalize(path: &Path, cache: &FileSystemRealPathCache) -> std::io::Re
             }
 
             let link = std::fs::read_link(&ret)?;
-            let ptr = unsafe { &*(link.as_path() as *const _) };
-            cache.insert(ret.clone(), Some(link));
-            ptr
+            cache.insert(ret.clone(), Some(link.clone()));
+            link
           };
 
           seen_links += 1;
@@ -124,7 +121,7 @@ pub fn canonicalize(path: &Path, cache: &FileSystemRealPathCache) -> std::io::Re
 
           let remaining = components.as_path();
           if !remaining.as_os_str().is_empty() {
-            queue.push_front(remaining);
+            queue.push_front(remaining.to_path_buf());
           }
           queue.push_front(link);
           break;