From 6eb257e5c731c691eb137fca94e916ca73941a5a Mon Sep 17 00:00:00 2001

From: Michael Catanzaro <mcatanzaro@gnome.org>

Date: Fri, 31 Jul 2020 15:21:53 -0500

Subject: [PATCH] parser: limit recursion in block and any productions

If we don't have any limits, we can recurse forever and overflow the

stack.

Fixes #8

---

 src/cr-parser.c | 44 +++++++++++++++++++++++++++++---------------

 1 file changed, 29 insertions(+), 15 deletions(-)

diff --git a/src/cr-parser.c b/src/cr-parser.c

index 18c9a01..f4a62e3 100644

--- a/src/cr-parser.c

+++ b/src/cr-parser.c

@@ -136,6 +136,8 @@ struct _CRParserPriv {

 #define CHARS_TAB_SIZE 12

+#define RECURSIVE_CALLERS_LIMIT 100

+

 /**

  * IS_NUM:

  *@a_char: the char to test.

@@ -344,9 +346,11 @@ static enum CRStatus cr_parser_parse_selector_core (CRParser * a_this);

 static enum CRStatus cr_parser_parse_declaration_core (CRParser * a_this);

-static enum CRStatus cr_parser_parse_any_core (CRParser * a_this);

+static enum CRStatus cr_parser_parse_any_core (CRParser * a_this,

+                                               guint      n_calls);

-static enum CRStatus cr_parser_parse_block_core (CRParser * a_this);

+static enum CRStatus cr_parser_parse_block_core (CRParser * a_this,

+                                                 guint      n_calls);

 static enum CRStatus cr_parser_parse_value_core (CRParser * a_this);

@@ -784,7 +788,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)

         cr_parser_try_to_skip_spaces_and_comments (a_this);

         do {

-                status = cr_parser_parse_any_core (a_this);

+                status = cr_parser_parse_any_core (a_this, 0);

         } while (status == CR_OK);

         status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr,

@@ -795,7 +799,7 @@ cr_parser_parse_atrule_core (CRParser * a_this)

                 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, 

                                       token);

                 token = NULL;

-                status = cr_parser_parse_block_core (a_this);

+                status = cr_parser_parse_block_core (a_this, 0);

                 CHECK_PARSING_STATUS (status,

                                       FALSE);

                 goto done;

@@ -930,11 +934,11 @@ cr_parser_parse_selector_core (CRParser * a_this)

         RECORD_INITIAL_POS (a_this, &init_pos);

-        status = cr_parser_parse_any_core (a_this);

+        status = cr_parser_parse_any_core (a_this, 0);

         CHECK_PARSING_STATUS (status, FALSE);

         do {

-                status = cr_parser_parse_any_core (a_this);

+                status = cr_parser_parse_any_core (a_this, 0);

         } while (status == CR_OK);

@@ -956,10 +960,12 @@ cr_parser_parse_selector_core (CRParser * a_this)

  *in chapter 4.1 of the css2 spec.

  *block ::= '{' S* [ any | block | ATKEYWORD S* | ';' ]* '}' S*;

  *@param a_this the current instance of #CRParser.

+ *@param n_calls used to limit recursion depth

  *FIXME: code this function.

  */

 static enum CRStatus

-cr_parser_parse_block_core (CRParser * a_this)

+cr_parser_parse_block_core (CRParser * a_this,

+                            guint      n_calls)

 {

         CRToken *token = NULL;

         CRInputPos init_pos;

@@ -967,6 +973,9 @@ cr_parser_parse_block_core (CRParser * a_this)

         g_return_val_if_fail (a_this && PRIVATE (a_this), CR_BAD_PARAM_ERROR);

+        if (n_calls > RECURSIVE_CALLERS_LIMIT)

+                return CR_ERROR;

+

         RECORD_INITIAL_POS (a_this, &init_pos);

         status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token);

@@ -996,13 +1005,13 @@ cr_parser_parse_block_core (CRParser * a_this)

         } else if (token->type == CBO_TK) {

                 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);

                 token = NULL;

-                status = cr_parser_parse_block_core (a_this);

+                status = cr_parser_parse_block_core (a_this, n_calls + 1);

                 CHECK_PARSING_STATUS (status, FALSE);

                 goto parse_block_content;

         } else {

                 cr_tknzr_unget_token (PRIVATE (a_this)->tknzr, token);

                 token = NULL;

-                status = cr_parser_parse_any_core (a_this);

+                status = cr_parser_parse_any_core (a_this, n_calls + 1);

                 CHECK_PARSING_STATUS (status, FALSE);

                 goto parse_block_content;

         }

@@ -1109,7 +1118,7 @@ cr_parser_parse_value_core (CRParser * a_this)

                 status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,

                                                token);

                 token = NULL;

-                status = cr_parser_parse_block_core (a_this);

+                status = cr_parser_parse_block_core (a_this, 0);

                 CHECK_PARSING_STATUS (status, FALSE);

                 ref++;

                 goto continue_parsing;

@@ -1123,7 +1132,7 @@ cr_parser_parse_value_core (CRParser * a_this)

                 status = cr_tknzr_unget_token (PRIVATE (a_this)->tknzr,

                                                token);

                 token = NULL;

-                status = cr_parser_parse_any_core (a_this);

+                status = cr_parser_parse_any_core (a_this, 0);

                 if (status == CR_OK) {

                         ref++;

                         goto continue_parsing;

@@ -1162,10 +1171,12 @@ cr_parser_parse_value_core (CRParser * a_this)

  *        | FUNCTION | DASHMATCH | '(' any* ')' | '[' any* ']' ] S*;

  *

  *@param a_this the current instance of #CRParser.

+ *@param n_calls used to limit recursion depth

  *@return CR_OK upon successfull completion, an error code otherwise.

  */

 static enum CRStatus

-cr_parser_parse_any_core (CRParser * a_this)

+cr_parser_parse_any_core (CRParser * a_this,

+                          guint      n_calls)

 {

         CRToken *token1 = NULL,

                 *token2 = NULL;

@@ -1174,6 +1185,9 @@ cr_parser_parse_any_core (CRParser * a_this)

         g_return_val_if_fail (a_this, CR_BAD_PARAM_ERROR);

+        if (n_calls > RECURSIVE_CALLERS_LIMIT)

+                return CR_ERROR;

+

         RECORD_INITIAL_POS (a_this, &init_pos);

         status = cr_tknzr_get_next_token (PRIVATE (a_this)->tknzr, &token1);

@@ -1212,7 +1226,7 @@ cr_parser_parse_any_core (CRParser * a_this)

                  *We consider parameter as being an "any*" production.

                  */

                 do {

-                        status = cr_parser_parse_any_core (a_this);

+                        status = cr_parser_parse_any_core (a_this, n_calls + 1);

                 } while (status == CR_OK);

                 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);

@@ -1237,7 +1251,7 @@ cr_parser_parse_any_core (CRParser * a_this)

                 }

                 do {

-                        status = cr_parser_parse_any_core (a_this);

+                        status = cr_parser_parse_any_core (a_this, n_calls + 1);

                 } while (status == CR_OK);

                 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);

@@ -1265,7 +1279,7 @@ cr_parser_parse_any_core (CRParser * a_this)

                 }

                 do {

-                        status = cr_parser_parse_any_core (a_this);

+                        status = cr_parser_parse_any_core (a_this, n_calls + 1);

                 } while (status == CR_OK);

                 ENSURE_PARSING_COND (status == CR_PARSING_ERROR);

-- 

GitLab