Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions bindgen-gcc.sh
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,10 @@ echo "Extending BINDGEN_EXTRA_CLANG_ARGS with system include paths..." 2>&1
BINDGEN_EXTRA_CLANG_ARGS="${BINDGEN_EXTRA_CLANG_ARGS:-}"
export BINDGEN_EXTRA_CLANG_ARGS
include_paths=$(
echo | $NIX_CC_UNWRAPPED -v -E -x c - 2>&1 \
LC_ALL=C $NIX_CC_UNWRAPPED -v -E -x c - </dev/null 2>&1 \
| awk '/#include <...> search starts here:/{flag=1;next} \
/End of search list./{flag=0} \
flag==1 {print $1}'
)
for path in $include_paths; do
echo " - $path" 2>&1
BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS -I$path"
done
include_args=$(printf '%s\n' "$include_paths" | awk 'NF {printf " -I%s", $1; printf " - %s\n", $1 > "/dev/stderr"}')
BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS$include_args"
Comment on lines +10 to +16
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

fd -name "bindgen-gcc.sh" -type f

Repository: DeterminateSystems/nix-bindings-rust

Length of output: 311


🏁 Script executed:

fd "bindgen-gcc.sh"

Repository: DeterminateSystems/nix-bindings-rust

Length of output: 95


🏁 Script executed:

cat -n bindgen-gcc.sh

Repository: DeterminateSystems/nix-bindings-rust

Length of output: 943


🏁 Script executed:

cat > /tmp/test_pipeline.sh << 'EOF'
#!/bin/bash

# Test 1: Pipeline with failing first command, succeeding last command
echo "=== Test 1: Failed compiler, successful awk ==="
result=$( 
  (exit 1) | awk 'BEGIN { print "awk ran" }' 
)
echo "Pipeline exit code: $?"
echo "Result: '$result'"

# Test 2: Pipeline where first command produces no output
echo "=== Test 2: No output case ==="
result=$(
  (echo "" | grep "nonexistent") | awk '{ print "matched" }'
)
echo "Pipeline exit code: $?"
echo "Result: '$result'"
echo "Is result empty: [ -z '$result' ]"
[ -z "$result" ] && echo "Yes, result is empty"

# Test 3: Unquoted variable expansion
echo "=== Test 3: Unquoted variable with spaces (simulated) ==="
MY_VAR="gcc -v"
# This will try to run just "gcc" as separate command
result=$(
  LC_ALL=C $MY_VAR -E -x c - </dev/null 2>&1 | head -1
) 2>/dev/null || true
echo "Expansion behavior demonstrated"
EOF
bash /tmp/test_pipeline.sh

Repository: DeterminateSystems/nix-bindings-rust

Length of output: 370


🏁 Script executed:

cat > /tmp/test_fix.sh << 'EOF'
#!/bin/bash

# Simulate the proposed fix structure
NIX_CC_UNWRAPPED="/bin/false"  # Simulate non-existent compiler

include_paths=$(
  LC_ALL=C "${NIX_CC_UNWRAPPED:?NIX_CC_UNWRAPPED is not set}" -v -E -x c - </dev/null 2>&1 \
  | awk '/#include <...> search starts here:/{flag=1;next} \
        /End of search list./{flag=0} \
        flag==1 {print $1}'
)

echo "include_paths: '$include_paths'"

# This is the guard the review proposes
if [ -z "$include_paths" ]; then
  echo "Failed to detect GCC system include paths from \$NIX_CC_UNWRAPPED" >&2
  exit 1
fi

echo "Guard passed"
EOF
bash /tmp/test_fix.sh 2>&1 || echo "Script exited with code: $?"

Repository: DeterminateSystems/nix-bindings-rust

Length of output: 190


Fail fast when include-path discovery yields no results

Line 10's pipeline can still appear successful if the compiler probe fails (because awk is the last command), leaving include_paths empty and silently exporting incomplete BINDGEN_EXTRA_CLANG_ARGS. Quote "$NIX_CC_UNWRAPPED" to avoid unintended expansion, and add an explicit empty-result guard to catch this failure case.

🔧 Proposed fix
 include_paths=$(
-  LC_ALL=C $NIX_CC_UNWRAPPED -v -E -x c - </dev/null 2>&1 \
+  LC_ALL=C "${NIX_CC_UNWRAPPED:?NIX_CC_UNWRAPPED is not set}" -v -E -x c - </dev/null 2>&1 \
   | awk '/#include <...> search starts here:/{flag=1;next} \
         /End of search list./{flag=0} \
         flag==1 {print $1}'
 )
+if [ -z "$include_paths" ]; then
+  echo "Failed to detect GCC system include paths from \$NIX_CC_UNWRAPPED" >&2
+  exit 1
+fi
 include_args=$(printf '%s\n' "$include_paths" | awk 'NF {printf " -I%s", $1; printf " - %s\n", $1 > "/dev/stderr"}')
 BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS$include_args"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bindgen-gcc.sh` around lines 10 - 16, The include-path discovery command that
populates include_paths (the LC_ALL... $NIX_CC_UNWRAPPED -v -E ... | awk ...)
can succeed while producing no paths, and $NIX_CC_UNWRAPPED should be quoted to
avoid word-splitting; update the probe to quote "$NIX_CC_UNWRAPPED" and add an
explicit guard after computing include_paths that checks if include_paths is
empty (or contains only whitespace) and exits with a non-zero status and an
error message to stderr if so, preventing silent export of incomplete
BINDGEN_EXTRA_CLANG_ARGS; keep the subsequent include_args and
BINDGEN_EXTRA_CLANG_ARGS assignment unchanged but only run them when
include_paths is non-empty.

42 changes: 21 additions & 21 deletions flake.lock

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions nix-bindings-util/src/lib.rs
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ use std::{ffi::NulError, str::Utf8Error, string::FromUtf8Error};
use thiserror::Error;

pub mod context;
pub mod logger;
pub mod settings;
#[macro_use]
pub mod string_return;
Expand Down
Loading
Loading