fixup: make ItemHandle own a ref<Item> to prevent UAF on failed transfers

Author: cole-h

src/libstore/filetransfer.cc

@@ -962,7 +962,7 @@ struct curlFileTransfer : public FileTransfer
         writeFull(wakeupPipe.writeSide.get(), " ");
 #endif
 
-        return ItemHandle(static_cast<Item &>(*item));
+        return ItemHandle(ref<Item>(std::move(item)));
     }
 
     ItemHandle
@@ -977,7 +977,7 @@ struct curlFileTransfer : public FileTransfer
                 return enqueueItem(item);
             } catch (const nix::Error & e) {
                 item->fail(e);
-                return ItemHandle(static_cast<Item &>(*item));
+                return ItemHandle(ref<Item>(std::move(item)));
             }
         }
 
@@ -986,7 +986,7 @@ struct curlFileTransfer : public FileTransfer
             return enqueueItem(item);
         } catch (const nix::Error & e) {
             item->fail(e);
-            return ItemHandle(static_cast<Item &>(*item));
+            return ItemHandle(ref<Item>(std::move(item)));
         }
     }
 
@@ -1001,7 +1001,7 @@ struct curlFileTransfer : public FileTransfer
 
     void unpauseTransfer(ItemHandle handle) override
     {
-        unpauseTransfer(ref{static_cast<TransferItem &>(handle.item.get()).shared_from_this()});
+        unpauseTransfer(ref{static_cast<TransferItem &>(*handle.item).shared_from_this()});
     }
 };
 

src/libstore/include/nix/store/filetransfer.hh

@@ -262,11 +262,11 @@ public:
      */
     struct ItemHandle
     {
-        std::reference_wrapper<Item> item;
+        ref<Item> item;
         friend struct FileTransfer;
 
-        ItemHandle(Item & item)
-            : item(item)
+        explicit ItemHandle(ref<Item> item)
+            : item(std::move(item))
         {
         }
     };