@amritk/nish-x86_64-linux 0.15.0 → 0.16.0

package/INSTALL.md

@@ -403,8 +403,15 @@ release is expected to move it. `--stages 1` stops one link sooner.
 and `--profile` spellings as an installed `nish`, because it is the same
 program, and makes every directory in the way of the IR, a sidecar or the
 binary itself. It looks for `scripts/build.sh` and the two `runtime/*.c` files
-one level up from wherever it was invoked, then in the working directory, so
-it wants a checkout or an installed package around it the way `nish` does.
+one level up from wherever it was invoked (and one level up from the file a
+symbolic link to it names), so it wants a checkout or an installed package
+around it the way `nish` does. It falls back to the working directory only
+when the compiler itself lies inside that directory, so a checkout you merely
+`cd` into cannot hand it a `scripts/build.sh` to run. Keep `bin/nish` beside
+`scripts/`, `runtime/` and `std/`, as every install above does, and keep that
+directory's parent writable only by you: the package root is the parent of
+the compiler's directory, so a compiler at `/tmp/x/nish` would trust
+`/tmp/scripts/build.sh` (CLI-9 in [docs/security/cli.md](security/cli.md)).
 
 Because the seed is the last release, `src/` may only *use* in its own
 source the constructs that release compiles. A new construct is implemented
@@ -457,9 +464,11 @@ nish run hello.ts
 `$XDG_CACHE_HOME/nish/run` (or `~/.cache/nish/run`) when that program has not
 been linked before, and starts it with the arguments after the file. The first
 run of a new edit pays for one link, and later runs start the cached binary.
-It needs clang only for that link. It needs `HOME` or `XDG_CACHE_HOME` set,
-and refuses the run without them rather than keep a binary in a shared
-directory.
+It needs clang only for that link. It needs `HOME` or `XDG_CACHE_HOME` set
+to an absolute path (a relative one is ignored, as if it were unset), and
+refuses the run without one rather than keep a binary in a shared directory.
+The first run that builds into the cache makes its root `0700`, so no other
+user can plant a binary in it ([docs/security/cli.md](security/cli.md)).
 
 ## 4. Exit codes
 
@@ -469,7 +478,7 @@ directory.
 | 1 | the program was rejected: compile error (`file:line:col: error: ...`), missing input file, or an `-o` layout that does not fit the module count |
 | 2 | usage error: unknown flag, missing argument, no input files |
 | 3 | toolchain error: `--link` found no `clang` (`CC` overrides), or `scripts/build.sh` failed (its output is shown; the `.ll` files are still written) — or the `nish` command found no prebuilt compiler for this platform, or one that would not start. Under `--json` all of these are one `NL0002` object |
-| | `nish run` answers these codes until the program starts, and the program's own exit status (`128 + n` for a signal) after that. With neither `HOME` nor `XDG_CACHE_HOME` set it answers 3 |
+| | `nish run` answers these codes until the program starts, and the program's own exit status (`128 + n` for a signal) after that. With neither `HOME` nor `XDG_CACHE_HOME` set to an absolute path it answers 3 |
 | 70 | internal compiler error: an unexpected exception. Please report it at <https://github.com/amritk/nish/issues> with the input and command line; `NISH_DEBUG=1` prints the stack trace |
 
 ## Troubleshooting

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amritk/nish-x86_64-linux",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "The @amritk/nish native compiler for Linux on x86_64",
   "license": "MIT",
   "os": [

package/runtime/nish.h

@@ -63,6 +63,17 @@ typedef struct nish_str {
   char data[];
 } nish_str;
 
+/* The bytes of `s` as the C string a system call takes, or "" when `s` holds
+ * a NUL. The kernel reads a path to its first NUL, so `"secret\0.txt"` would
+ * pass a `.txt` check and open `secret`; "" names nothing, so each caller
+ * answers it as it answers a missing path. The one test every path, name and
+ * argument the runtime hands the OS goes through (docs/security/runtime.md,
+ * RT-3). `__builtin_strlen`, so this header needs no libc header of its own,
+ * and `unused` because a host that includes it may never call it. */
+static inline __attribute__((unused)) const char *nish_cpath(const nish_str *s) {
+  return __builtin_strlen(s->data) == s->len ? s->data : "";
+}
+
 /* ---- Arena --------------------------------------------------------------
  * One bump allocator per process, or one per thread under `-DNISH_THREADS`
  * (WP20 T0; the layout and every function below are the same either way).
@@ -139,7 +150,16 @@ nish_str *nish_str_from_i64(int64_t v);
 nish_str *nish_str_from_u64(uint64_t v);
 
 /* Process and file I/O (WP7). `nish_exit` never returns; the file functions
- * print a message to stderr and exit(1) on a fatal error. Everything from here
+ * print a message to stderr and exit(1) on a fatal error.
+ *
+ * Every function here that takes a path, a name or an argument vector refuses
+ * one holding a NUL, answering as it answers a path that does not exist: the
+ * kernel would read only the bytes before the NUL, which is a different path
+ * from the one the program checked (docs/security/runtime.md, RT-3). A file
+ * longer than 2^31 - 1 bytes is unreadable, as it is to `nish_read_file_or_null`
+ * and `nish_read_file_bytes` too, because no string or array may be longer
+ * (RT-1). The two writers refuse a symbolic link as the last component of the
+ * path rather than follow it (RT-4). Everything from here
  * to the end of the clock section below is implemented in runtime-os.c, with
  * `nish_random` and `nish_argv_init` the exceptions: neither asks the operating
  * system anything (the clock only seeds the first, and the entry point hands the
@@ -194,6 +214,11 @@ typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array
  * `elem_size` is `sizeof` one element, so for a record element type it is
  * `sizeof(struct Point)` and the block is a C array of them. */
 nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len);
+/* No array grows past 2^31 - 1 elements and no string past 2^31 - 1 bytes:
+ * `nish_array_grow`, `nish_alloc_array` and `nish_str_concat` fail as an
+ * allocation does (`nish: out of memory`, exit 1; a trap on wasm) rather than
+ * make one, because under --number-mode i32 its `length` would read back
+ * negative (docs/security/codegen.md K1-6, docs/security/runtime.md RT-2). */
 /* The cold paths compiled code calls: `push` when len == cap, a failed bounds
  * check. `nish_array_grow` moves `cap * elem_size` bytes into a fresh arena
  * block and writes `data`/`cap`, so for a record element type it relocates the
@@ -254,12 +279,12 @@ nish_array *nish_read_file_bytes(const nish_str *path);
  * `128 + n` when signal `n` killed it. -1 when `argv` is empty, when the
  * child cannot be started or waited for, and always under WASI, which has no
  * processes. The elements are `nish_str *`; the child receives their bytes,
- * so an argument containing a NUL is truncated at it. */
+ * and an argument containing a NUL is refused (-1) rather than truncated. */
 int32_t nish_spawn(const nish_array *argv);
 /* `spawnSyncTo(argv, stdoutPath, stderrPath)`: exactly `nish_spawn` — the same
  * `PATH` search, the same wait, the same status, `128 + n` and -1 — except that
  * each non-empty path receives that stream, created or truncated at 0644 as
- * `nish_write_file` would leave it. An **empty** string leaves that stream
+ * `nish_write_file` would leave it, a symbolic link at the path refused. An **empty** string leaves that stream
  * inherited, so one call can capture stdout and let stderr through to the
  * terminal. The child opens the files, so a failed open is a child that could
  * not start and answers -1 rather than leaving this process redirected. The two
@@ -275,8 +300,8 @@ int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_st
  * arena (so a later `setenv` cannot change a string the program still holds),
  * or NULL when it is unset — the language's `string | null`. An empty value
  * is a set variable and answers a zero-length string, not NULL. `name` is
- * read and never retained; a NUL inside it truncates the lookup, as it does
- * for every other path-like argument here. */
+ * read and never retained; a name holding a NUL is unset, as it is for every
+ * other path-like argument here. */
 nish_str *nish_getenv(const nish_str *name);
 
 /* ---- Symlinks (WP19 §5a item 4) -----------------------------------------
@@ -336,6 +361,15 @@ double nish_stat_mtime(const nish_str *path);
  * or a read that fails. */
 int32_t nish_signal_fd(void);
 int32_t nish_read_signal(int32_t fd);
+/* Who owns a path, and whether it runs (docs/security/runtime.md, RT-9; no
+ * builtin reaches these yet). `nish_lstat_owner_mode(path)`: `lstat`, so a
+ * symbolic link answers for itself, as the owner's uid in the high 32 bits
+ * and `st_mode` in the low 32, or exactly -1 when the path does not resolve.
+ * `nish_euid()`: the effective uid. `nish_is_executable(path)`:
+ * `access(path, X_OK)`, for the real uid. */
+int64_t nish_lstat_owner_mode(const nish_str *path);
+int64_t nish_euid(void);
+bool nish_is_executable(const nish_str *path);
 
 /* ---- The network (WP34 N5), runtime/runtime-net.c, `nish:net` ------------
  * Every call answers an `int32_t`: `>= 0` on success (a descriptor, a byte

package/runtime/runtime-host.c

@@ -1,7 +1,8 @@
 /* Nish runtime, the host half: the wall clock, entropy, a file's modification
  * time and a descriptor that becomes readable when SIGTERM or SIGINT arrives
  * (WP34 N3) — the four facts a program that runs for days asks of the machine
- * it runs on.
+ * it runs on — and who owns a path and whether it runs, which a driver asks
+ * before it trusts one.
  *
  * A translation unit of its own for the reason runtime-os.c is one: each file
  * carries its own measured `.text*` ceiling in tests/run.js. runtime-os.c had
@@ -33,6 +34,7 @@ typedef int nish_host_unused;
 #include <signal.h>
 #include <stdint.h>
 #include <stdio.h>
+#include <string.h>
 #include <sys/stat.h>
 #include <time.h>
 #include <unistd.h>
@@ -98,7 +100,7 @@ void nish_random_fill(nish_array *bytes) {
    digits. `stat` follows a symbolic link, as `fs.statSync` does. */
 double nish_stat_mtime(const nish_str *path) {
   struct stat st;
-  if (stat(path->data, &st) != 0) return __builtin_nan("");
+  if (stat(nish_cpath(path), &st) != 0) return __builtin_nan("");
 #if defined(__APPLE__)
   struct timespec t = st.st_mtimespec;
 #else
@@ -107,6 +109,31 @@ double nish_stat_mtime(const nish_str *path) {
   return (double)t.tv_sec * 1e3 + (double)t.tv_nsec / 1e6;
 }
 
+/* ---- Who owns a path, and whether it runs (docs/security/runtime.md, RT-9)
+ *
+ * The primitives a driver needs before it trusts a directory or a program it
+ * found on its own. `nish_lstat_owner_mode` answers for the path itself, a
+ * symbolic link included, rather than for what it names: the owner's uid in
+ * the high 32 bits and `st_mode` in the low 32, or exactly -1 when the path
+ * does not resolve or holds a NUL. `nish_euid` is the user to compare the
+ * owner with, and `nish_is_executable` is `access(X_OK)`: whether the real
+ * user may run the file, which is what tells an executable `PATH` entry from
+ * one that is only readable. Nothing in the language reaches them yet: `src/` may call
+ * a runtime function only once the last release declares it, so they are here
+ * for the change after the next release (docs/security/cli.md, CLI-7 and
+ * CLI-9). */
+int64_t nish_lstat_owner_mode(const nish_str *path) {
+  struct stat st;
+  if (lstat(nish_cpath(path), &st) != 0) return -1;
+  return (int64_t)((uint64_t)(uint32_t)st.st_uid << 32 | (uint32_t)st.st_mode);
+}
+
+int64_t nish_euid(void) { return (int64_t)geteuid(); }
+
+_Bool nish_is_executable(const nish_str *path) {
+  return access(nish_cpath(path), X_OK) == 0;
+}
+
 /* ---- Signals: `signalFd()` and `readSignal(fd)`
  *
  * A descriptor rather than a handler in the language, because a handler would

package/runtime/runtime-net.c

@@ -229,18 +229,24 @@ int32_t nish_tcp_listen(const nish_str *host, int32_t port, int32_t backlog) {
   return nish_net_bound(host, port, SOCK_STREAM, backlog);
 }
 
-/* A socket address into the caller's 18-byte form. An IPv4 peer is written
-   mapped, and the port is already in network order, which is the form's
-   big-endian. */
-static void nish_net_put(nish_array *out, const nish_sockaddr *s) {
+/* A socket address of `n` bytes into the caller's 18-byte form. An IPv4 peer
+   is written mapped, and the port is already in network order, which is the
+   form's big-endian. Anything else -- no address at all, which is what
+   `recvmsg` reports on a connected or Unix socket, or a family that is not
+   IP -- is eighteen zeros: those bytes of `s` were never written, and copying
+   them handed the caller whatever the stack held (docs/security/runtime.md,
+   RT-6). */
+static void nish_net_put(nish_array *out, const nish_sockaddr *s, socklen_t n) {
   unsigned char *p = (unsigned char *)out->data;
-  uint16_t port = s->v6.sin6_port;
-  if (s->sa.sa_family == AF_INET) {
+  uint16_t port = 0;
+  memset(p, 0, NISH_ADDR_BYTES);
+  if (n >= sizeof s->v4 && s->sa.sa_family == AF_INET) {
     memcpy(p, nish_mapped_prefix, 12);
     memcpy(p + 12, &s->v4.sin_addr, 4);
     port = s->v4.sin_port;
-  } else {
+  } else if (n >= sizeof s->v6 && s->sa.sa_family == AF_INET6) {
     memcpy(p, &s->v6.sin6_addr, 16);
+    port = s->v6.sin6_port;
   }
   memcpy(p + 16, &port, 2);
 }
@@ -259,7 +265,7 @@ int32_t nish_tcp_accept(int32_t fd, nish_array *peer) {
   int c = nish_net_setup(accept(fd, &s.sa, &n));
 #endif
   if (c < 0) return nish_net_fail();
-  nish_net_put(peer, &s);
+  nish_net_put(peer, &s, n);
   return c;
 }
 
@@ -399,7 +405,7 @@ int32_t nish_udp_recv_from(int32_t fd, nish_array *buf, int64_t off, int64_t len
   }
 #endif
   memcpy(meta->data, info, sizeof info);
-  nish_net_put(from, &s);
+  nish_net_put(from, &s, m.msg_namelen);
   return (int32_t)got;
 }
 

package/runtime/runtime-os.c

@@ -52,6 +52,14 @@ extern char **environ;
 
 #include "nish.h"
 
+/* Darwin's <fcntl.h> declares `O_NOFOLLOW` only at its full C level, and the
+   strict level the two macros above select is the one that binds the right
+   `realpath`, so the flag is spelled here with Darwin's own value
+   (<sys/fcntl.h>: 0x00000100). Linux and WASI declare it at POSIX 2008. */
+#if defined(__APPLE__) && !defined(O_NOFOLLOW)
+#define O_NOFOLLOW 0x00000100
+#endif
+
 /* The same spelling runtime.c uses for its own cold paths: a function that
    reports and exits is never on a path worth optimising for. */
 #define NISH_COLD __attribute__((noreturn, cold, noinline))
@@ -63,6 +71,12 @@ static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
   _exit(1);
 }
 
+/* The longest string or array a read hands back: 2^31 - 1, the same limit
+   runtime.c's `NISH_ARRAY_MAX` puts on a push. Under --number-mode i32
+   `length` is an `i32`, so one byte more reads back negative and bounds-check
+   elimination trusts it (docs/security/runtime.md, RT-1). */
+#define NISH_LENGTH_MAX 2147483647
+
 /* `readFileSyncOrNull(path)`: null rather than a message, so a program can
    turn a missing file into its own diagnostic and carry on.
  *
@@ -84,11 +98,16 @@ static NISH_COLD void nish_io_fail(const char *what, const nish_str *path) {
  * rather than `stat` on the path, so the answer is about the file that was
  * opened and not about whatever the name means a moment later. */
 nish_str *nish_read_file_or_null(const nish_str *path) {
-  int fd = open(path->data, O_RDONLY);
+  int fd = open(nish_cpath(path), O_RDONLY);
   if (fd < 0) return 0;
   struct stat st;
   off_t len = fstat(fd, &st) == 0 && !S_ISDIR(st.st_mode) ? lseek(fd, 0, SEEK_END) : -1;
-  if (len < 0) {
+  /* A file longer than a length can say is refused before anything is
+     allocated, as an unreadable one is: null here, null from
+     `readFileBytesSync`, and `cannot read` from `readFileSync`. The bytes read
+     below are never more than `len`, so a file that grows meanwhile cannot
+     pass the limit either. */
+  if (len < 0 || len > NISH_LENGTH_MAX) {
     close(fd);
     return 0;
   }
@@ -123,8 +142,14 @@ nish_str *nish_read_file(const nish_str *path) {
   return s;
 }
 
+/* `O_NOFOLLOW` (docs/security/runtime.md, RT-4): a symbolic link as the last
+   component of the path is refused, as an unwritable file is, rather than
+   followed to whatever file it names. `nish file.ts` writes `file.ll` beside
+   its source, so a link planted at that name in a checkout would otherwise
+   truncate any file the user can write. A link among the directories on the
+   way is still followed. */
 static void nish_put_file(const nish_str *path, const nish_str *data, int flags) {
-  int fd = open(path->data, O_WRONLY | O_CREAT | flags, 0644);
+  int fd = open(nish_cpath(path), O_WRONLY | O_CREAT | O_NOFOLLOW | flags, 0644);
   if (fd < 0) nish_io_fail("write ", path);
   for (uint64_t done = 0; done < data->len;) {
     ssize_t n = write(fd, data->data + done, data->len - done);
@@ -149,14 +174,14 @@ void nish_append_file(const nish_str *path, const nish_str *data) { nish_put_fil
    answer to that question. */
 _Bool nish_is_dir(const nish_str *path) {
   struct stat st;
-  return stat(path->data, &st) == 0 && S_ISDIR(st.st_mode);
+  return stat(nish_cpath(path), &st) == 0 && S_ISDIR(st.st_mode);
 }
 
 /* One directory, not recursive. The retry is the `stat` above rather than
    `errno == EEXIST` so that a plain file at the path answers false, which is
    what the promise "a directory is there afterwards" means. */
 _Bool nish_mkdir(const nish_str *path) {
-  return mkdir(path->data, 0777) == 0 || nish_is_dir(path);
+  return mkdir(nish_cpath(path), 0777) == 0 || nish_is_dir(path);
 }
 
 /* `posix_spawnp` is one libc call where fork/execvp/waitpid would be three,
@@ -168,7 +193,7 @@ _Bool nish_mkdir(const nish_str *path) {
    two arguments answered differently, so the argv vector, the wait and the
    signal convention are written once; it is `static`, so a program that spawns
    nothing still loses all three to `--gc-sections`. */
-static int32_t nish_spawn_impl(const nish_array *argv, const char *out, const char *err) {
+static int32_t nish_spawn_impl(const nish_array *argv, const nish_str *out, const nish_str *err) {
 #ifdef __wasi__
   (void)argv;
   (void)out;
@@ -181,18 +206,27 @@ static int32_t nish_spawn_impl(const nish_array *argv, const char *out, const ch
      path out of here has anything to free. */
   char **v = nish_alloc_struct((argv->len + 1) * sizeof *v);
   uint64_t i = 0;
-  for (; i < argv->len; i++) v[i] = s[i]->data;
+  /* An argument holding a NUL is refused rather than cut short at it, which
+     would run a different command line from the one the program built: it is
+     the one whose C string is not its own bytes. */
+  for (; i < argv->len; i++) {
+    v[i] = (char *)nish_cpath(s[i]);
+    if (v[i] != s[i]->data) return -1;
+  }
   v[i] = 0;
   posix_spawn_file_actions_t fa;
   posix_spawn_file_actions_t *fap = 0;
-  if (out || err) {
-    if (posix_spawn_file_actions_init(&fa)) return -1;
-    fap = &fa;
+  const nish_str *to[2] = { out, err };
+  for (int k = 0; k < 2; k++) {
+    if (!to[k]) continue;
+    if (!fap) {
+      if (posix_spawn_file_actions_init(&fa)) return -1;
+      fap = &fa;
+    }
     /* The child opens the file, not this process: a redirect that this process
        performed would have to be undone afterwards, and a failed open would
        leave its own stdout pointing at the file. */
-    if (out) posix_spawn_file_actions_addopen(fap, 1, out, O_WRONLY | O_CREAT | O_TRUNC, 0644);
-    if (err) posix_spawn_file_actions_addopen(fap, 2, err, O_WRONLY | O_CREAT | O_TRUNC, 0644);
+    posix_spawn_file_actions_addopen(fap, k + 1, nish_cpath(to[k]), O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW, 0644);
   }
   pid_t pid;
   int status;
@@ -210,14 +244,15 @@ int32_t nish_spawn(const nish_array *argv) { return nish_spawn_impl(argv, 0, 0);
    to a file, which is what comparing a program's output against a golden needs
    — `nish_spawn` answers a status and the output is gone. An **empty** path
    leaves that stream inherited, so one call can capture stdout and let stderr
-   through to the terminal. Each file is created or truncated at 0644, as
-   `writeFileSync` does.
+   through to the terminal. Each file is created or truncated at 0644 and a
+   symbolic link at its name is refused, as `writeFileSync` does; the child
+   then fails to start, and the answer is -1.
 
    Two streams must not name one path: each would be opened separately, with
    its own offset, and the two would overwrite each other rather than
    interleave. Capturing them apart and concatenating is the way to merge. */
 int32_t nish_spawn_to(const nish_array *argv, const nish_str *out, const nish_str *err) {
-  return nish_spawn_impl(argv, out->len ? out->data : 0, err->len ? err->data : 0);
+  return nish_spawn_impl(argv, out->len ? out : 0, err->len ? err : 0);
 }
 
 /* `readdirSync(path)`: the listing a driver needs to discover its own inputs.
@@ -240,7 +275,7 @@ nish_array *nish_readdir(const nish_str *path) {
   (void)path;
   return 0;
 #else
-  DIR *d = opendir(path->data);
+  DIR *d = opendir(nish_cpath(path));
   if (!d) return 0;
   nish_array *a = nish_alloc_struct(sizeof *a);
   *a = (nish_array){ 0, 0, 0 };
@@ -252,15 +287,30 @@ nish_array *nish_readdir(const nish_str *path) {
     ((nish_str **)a->data)[a->len++] = nish_str_new(n, strlen(n));
   }
   closedir(d);
-  /* Insertion sort over pointers: a directory is short, and `qsort` would cost
-     a comparator symbol and its unwind entry for a call that is never hot. */
+  /* Heapsort over pointers, in place. It was an insertion sort, on the theory
+     that a directory is short, but whoever fills the directory decides that:
+     100,000 names took 2.5 billion compares and 12.5 s, where this takes 3.0
+     million and 0.07 s (docs/security/runtime.md, RT-5). It needs no scratch
+     memory, and unlike `qsort` costs no comparator symbol or unwind entry. */
   nish_str **v = (nish_str **)a->data;
-  for (uint64_t i = 1; i < a->len; i++) {
-    nish_str *s = v[i];
-    uint64_t j = i;
-    while (j && strcmp(v[j - 1]->data, s->data) > 0) {
-      v[j] = v[j - 1];
-      j--;
+  /* Each pass sifts one name down the max-heap `v[0, end)`: first every
+     parent from the middle up, which builds the heap, then the name the
+     largest is swapped out for, which shrinks the heap by one. */
+  uint64_t i = a->len / 2, end = a->len;
+  while (end > 1) {
+    nish_str *s;
+    if (i) {
+      s = v[--i];
+    } else {
+      s = v[--end];
+      v[end] = v[0];
+    }
+    uint64_t j = i, c;
+    while ((c = 2 * j + 1) < end) {
+      if (c + 1 < end && strcmp(v[c]->data, v[c + 1]->data) < 0) c++;
+      if (strcmp(s->data, v[c]->data) >= 0) break;
+      v[j] = v[c];
+      j = c;
     }
     v[j] = s;
   }
@@ -290,13 +340,8 @@ int64_t nish_monotonic_nanos(void) {
    string with the lifetime every other one has. NULL for an unset variable,
    which is the language's `string | null`. Contract: nish.h. */
 nish_str *nish_getenv(const nish_str *name) {
-  const char *v = getenv(name->data);
-  if (!v) return 0;
-  uint64_t len = strlen(v);
-  nish_str *s = nish_alloc_struct(8 + len + 1);
-  s->len = len;
-  memcpy(s->data, v, len + 1);
-  return s;
+  const char *v = getenv(nish_cpath(name));
+  return v ? nish_str_new(v, strlen(v)) : 0;
 }
 
 /* ---- Symlinks (WP19 §5a item 4): `realpathSync(path)`, the one path
@@ -321,12 +366,7 @@ nish_str *nish_getenv(const nish_str *name) {
    it resolves. Contract: nish.h. */
 nish_str *nish_realpath(const nish_str *path) {
   char buf[PATH_MAX];
-  if (!realpath(path->data, buf)) return 0;
-  uint64_t len = strlen(buf);
-  nish_str *s = nish_alloc_struct(8 + len + 1);
-  s->len = len;
-  memcpy(s->data, buf, len + 1);
-  return s;
+  return realpath(nish_cpath(path), buf) ? nish_str_new(buf, strlen(buf)) : 0;
 }
 
 /* ---- What machine this is (WP14 §7a): `process.platform` and `process.arch`,

package/runtime/runtime-parallel.c

@@ -109,7 +109,11 @@ void nish_parallel_range(nish_par_body body, void *ctx, int64_t len, int64_t gra
   if (grain < 1) grain = 1;
   /* Never more threads than there is work for at the requested granularity,
    * and never more than the machine has. */
-  int64_t chunks = (len + grain - 1) / grain;
+  /* Rounded up without `len + grain - 1`, which overflows -- undefined
+     behaviour, and in practice a negative count that ran the whole range on
+     one thread -- once `len` is within `grain` of 2^63
+     (docs/security/runtime.md, RT-8). */
+  int64_t chunks = len / grain + (len % grain != 0);
   int64_t n = nish_cpu_count();
   if (n > NISH_PAR_MAX) n = NISH_PAR_MAX;
   if (chunks < n) n = chunks;

package/runtime/runtime-wasm.c

@@ -40,7 +40,14 @@ _Static_assert(offsetof(struct nish_arena, chunks) == 24, "arena layout is ABI")
 extern unsigned char __heap_base;
 #define NISH_PAGE ((uint64_t)65536)
 
-/* Slow path of the inlined allocator (`size` is already 8-byte rounded). */
+/* Slow path of the inlined allocator (`size` is already 8-byte rounded).
+ *
+ * `need` has to fit the 32-bit address space, and is checked before anything
+ * is grown (docs/security/runtime.md, RT-7). Without that, an `off + size` that
+ * wrapped 2^64 looked small and moved the offset backwards, and a page count
+ * past 2^32 truncated to the `uintptr_t` `memory.grow` takes: a request of
+ * 2^48 bytes grew nothing, claimed 2^48 bytes of capacity, and the next block
+ * landed at `buf + off` reduced mod 2^32, on top of live data. */
 void *nish_arena_grow(uint64_t size) {
   if (!nish_arena.buf) {
     uintptr_t base = ((uintptr_t)&__heap_base + 7) & ~(uintptr_t)7;
@@ -48,6 +55,7 @@ void *nish_arena_grow(uint64_t size) {
     nish_arena.cap = (uint64_t)__builtin_wasm_memory_size(0) * NISH_PAGE - base;
   }
   uint64_t need = nish_arena.off + size;
+  if (need < size || need > (uintptr_t)-1 - (uintptr_t)nish_arena.buf) __builtin_trap();
   if (need > nish_arena.cap) {
     uint64_t pages = (need - nish_arena.cap + NISH_PAGE - 1) / NISH_PAGE;
     if (__builtin_wasm_memory_grow(0, (uintptr_t)pages) == (uintptr_t)-1) __builtin_trap();
@@ -58,9 +66,12 @@ void *nish_arena_grow(uint64_t size) {
   return p;
 }
 
+/* `size <= cap - off` rather than `off + size <= cap`, which a size near 2^64
+   wraps into a yes; a size that rounding wraps to 0 is trapped the same way. */
 void *nish_alloc_struct(uint64_t size) {
+  if (size > (uint64_t)-8) __builtin_trap();
   size = (size + 7) & ~(uint64_t)7;
-  if (nish_arena.buf && nish_arena.off + size <= nish_arena.cap) {
+  if (nish_arena.buf && size <= nish_arena.cap - nish_arena.off) {
     void *p = nish_arena.buf + nish_arena.off;
     nish_arena.off += size;
     return p;
@@ -77,7 +88,15 @@ void nish_arena_release(uint64_t mark) { nish_arena.off = mark ? mark - (uintptr
 /* ---- Arrays: %struct.nish_array = type { i64, i64, i8* } */
 typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
 
+/* The length limit runtime.c's `nish_array_grow` and `nish_alloc_array` keep:
+   2^31 - 1 elements, so an i32-mode `length` is never negative. Past it the
+   wasm runtime traps, as it does for every other failure. */
+#define NISH_ARRAY_MAX 2147483647u
+
 nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
+  /* With `len` in range, `len * elem_size` cannot wrap for any element
+     smaller than 8 GiB, and a product past 4 GiB traps in the grow. */
+  if (len > NISH_ARRAY_MAX) __builtin_trap();
   nish_array *a = (nish_array *)nish_alloc_struct(sizeof *a);
   a->len = a->cap = len;
   a->data = (char *)nish_alloc_struct(len * elem_size);
@@ -86,6 +105,10 @@ nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
 
 void nish_array_grow(nish_array *a, uint64_t elem_size) {
   uint64_t cap = a->cap ? a->cap * 2 : 4;
+  if (cap > NISH_ARRAY_MAX) {
+    if (a->len >= NISH_ARRAY_MAX) __builtin_trap();
+    cap = NISH_ARRAY_MAX;
+  }
   char *data = (char *)nish_alloc_struct(cap * elem_size);
   if (a->len) __builtin_memcpy(data, a->data, (uintptr_t)(a->len * elem_size)); /* memory.copy (-mbulk-memory) */
   a->data = data;

package/runtime/runtime.c

@@ -83,7 +83,13 @@ static NISH_COLD void nish_die(const char *msg) {
   (void)!write(2, msg, strlen(msg));
   _exit(1);
 }
-#define nish_oom() nish_die("nish: out of memory\n")
+/* A function rather than a macro around `nish_die`: seven call sites each
+   loading the message's address cost more than one more symbol does. */
+static NISH_COLD void nish_oom(void) { nish_die("nish: out of memory\n"); }
+
+/* The most elements an array and the most bytes a string may hold: see
+   `nish_array_grow` and `nish_str_concat`. */
+#define NISH_ARRAY_MAX 2147483647u
 
 /* Slow path (size 8-byte rounded): push a chunk (>= 64 KB), bump from it. */
 void *nish_arena_grow(uint64_t size) {
@@ -196,9 +202,16 @@ nish_str *nish_str_new(const char *bytes, uint64_t len) {
   return s;
 }
 
+/* A string never passes 2^31 - 1 bytes, for the reason an array never passes
+   that many elements (`NISH_ARRAY_MAX`, below): under --number-mode i32 a
+   longer one's `length` reads back negative and bounds-check elimination
+   trusts it (docs/security/runtime.md, RT-2). `a + b` past it fails as an
+   allocation does. */
 nish_str *nish_str_concat(const nish_str *a, const nish_str *b) {
-  nish_str *s = nish_alloc_struct(8 + a->len + b->len + 1);
-  s->len = a->len + b->len;
+  uint64_t len = a->len + b->len;
+  if (len > NISH_ARRAY_MAX) nish_oom();
+  nish_str *s = nish_alloc_struct(8 + len + 1);
+  s->len = len;
   memcpy(s->data, a->data, a->len);
   memcpy(s->data + a->len, b->data, b->len);
   s->data[s->len] = 0;
@@ -1106,8 +1119,12 @@ double nish_random(void) {
 /* ---- Arrays: %struct.nish_array = type { i64, i64, i8* }, cold paths */
 typedef struct nish_array { uint64_t len; uint64_t cap; char *data; } nish_array;
 
-/* Host entry (WP8): `len` uninitialised elements, len == cap */
+/* Host entry (WP8): `len` uninitialised elements, len == cap. A `len` past
+   `NISH_ARRAY_MAX` fails as an allocation does, which also keeps
+   `len * elem_size` from wrapping into a short block behind a long header
+   (docs/security/runtime.md, RT-7). */
 nish_array *nish_alloc_array(uint64_t elem_size, uint64_t len) {
+  if (len > NISH_ARRAY_MAX) nish_oom();
   nish_array *a = nish_alloc_struct(sizeof *a);
   *a = (nish_array){ len, len, nish_alloc_struct(len * elem_size) };
   return a;
@@ -1160,9 +1177,26 @@ double nish_parse_number(const nish_str *s, int32_t mode) {
  * `sizeof` one element, which for a record element type (WP15 section 2a) is
  * the whole struct, so this relocates the elements themselves rather than a
  * block of pointers to them. Compiled code may therefore hold no pointer into
- * `data` across a push, and the checker refuses the programs that would. */
-void nish_array_grow(nish_array *a, uint64_t elem_size) {
+ * `data` across a push, and the checker refuses the programs that would.
+ *
+ * A push never takes an array past 2^31 - 1 elements (docs/security/codegen.md,
+ * K1-6). Under --number-mode i32 `length` is an `i32`, and one element more
+ * read back as a negative or a short length everywhere, a hash or a tag
+ * compare included. This file cannot tell which mode compiled its caller, so
+ * the limit holds in both, and the push past it fails as an allocation does,
+ * through `nish_oom`. `new Array(n)` checks its own `n` in the IR.
+ *
+ * `noinline`: under LTO the grown body was inlined into every push site, and
+ * the extra compare moved register allocation in the hot loops around them
+ * (+0.2% to +2% instructions over bench/instructions.json's map rows). Out of
+ * line, every one of those rows runs fewer instructions than it did before, and
+ * the call costs nothing on a path that runs once per doubling. */
+__attribute__((noinline)) void nish_array_grow(nish_array *a, uint64_t elem_size) {
   uint64_t cap = a->cap ? a->cap * 2 : 4;
+  if (cap > NISH_ARRAY_MAX) {
+    if (a->len >= NISH_ARRAY_MAX) nish_oom();
+    cap = NISH_ARRAY_MAX;
+  }
   char *data = nish_alloc_struct(cap * elem_size);
   if (a->len) memcpy(data, a->data, a->len * elem_size);
   a->data = data;