{"record":{"id":"f51affb4b17c3e7b","repo":"zed-industries/zed","slug":"path-contains-interior-nul","errorCode":null,"errorMessage":"path contains interior NUL: {}","messagePattern":"path contains interior NUL: (.+?)","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"crates/fs/src/fs.rs","lineNumber":673,"sourceCode":"    use windows::core::PCWSTR;\n\n    let source: Vec<u16> = source.as_os_str().encode_wide().chain(Some(0)).collect();\n    let target: Vec<u16> = target.as_os_str().encode_wide().chain(Some(0)).collect();\n\n    unsafe {\n        MoveFileExW(\n            PCWSTR(source.as_ptr()),\n            PCWSTR(target.as_ptr()),\n            MOVE_FILE_FLAGS::default(),\n        )\n    }\n    .map_err(|_| io::Error::last_os_error())\n}\n\n#[cfg(any(target_os = \"macos\", target_os = \"linux\"))]\nfn path_to_c_string(path: &Path) -> io::Result<CString> {\n    CString::new(path.as_os_str().as_bytes()).map_err(|_| {\n        io::Error::new(\n            io::ErrorKind::InvalidInput,\n            format!(\"path contains interior NUL: {}\", path.display()),\n        )\n    })\n}\n\n// On Unix targets, std::fs::ReadDir panics in its Drop implementation\n// when an unexpected error is returned from closedir(2). We hit this\n// condition in production; one cause seems to be macOS's FSEventStream\n// incorrectly closing fds it doesn't own, resulting in closedir returning\n// EBADF, see https://github.com/zed-industries/zed/issues/59952#issuecomment-5080178879.\n//\n// We also see occasional errors like ENXIO and ETIMEDOUT that seem to\n// come from network or other exotic filesystems.\n//\n// To avoid crashing the app in this situation, we use the rustix analogue of\n// ReadDir, which doesn't have this panic in drop.\n#[cfg(unix)]","sourceCodeStart":655,"sourceCodeEnd":691,"githubUrl":"https://github.com/zed-industries/zed/blob/9d272b036335401f339d024ea94968fd51016c40/crates/fs/src/fs.rs#L655-L691","documentation":"Returned by path_to_c_string when the path being passed to a Unix syscall contains an interior NUL byte, which C strings cannot represent. The offending path (shown with {:?}) is rejected up front instead of producing a truncated/wrong path at the syscall boundary.","triggerScenarios":"Thrown at crates/fs/src/fs.rs:628 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Strip or reject NUL bytes in user-provided paths before filesystem operations","Treat the path as invalid input and surface an error to the caller"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"9d272b036335401f339d024ea94968fd51016c40","analyzedAt":"2026-08-20T19:29:52.058Z","contentChangedAt":"2026-08-20T19:29:52.058Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}