diff options
| author | Caolán McNamara <caolanm@redhat.com> | 2018-05-24 11:25:06 +0100 |
|---|---|---|
| committer | Caolán McNamara <caolanm@redhat.com> | 2018-05-24 15:54:52 +0200 |
| commit | 68f182066a8e2efa6d70abb1f568775fc48c608a (patch) | |
| tree | c9128f3e8975a18849fde31960dbc89861ab50d7 | |
| parent | 4b42fd7e9516fbbd8a92d97680524f32dd260fb2 (diff) | |
ofz#8490 stack exhaustion
a linear loop builds a recursive structure, if it gets too deep then later
processing, e.g. releasing the tree, can exhaust stack
Change-Id: I4421b9bae62ac2b6ffe32531d1167a482103bfde
Reviewed-on: https://gerrit.libreoffice.org/54762
Tested-by: Jenkins <ci@libreoffice.org>
Reviewed-by: Caolán McNamara <caolanm@redhat.com>
Tested-by: Caolán McNamara <caolanm@redhat.com>
| -rw-r--r-- | starmath/inc/parse.hxx | 4 | ||||
| -rw-r--r-- | starmath/source/parse.cxx | 9 |
2 files changed, 12 insertions, 1 deletions
diff --git a/starmath/inc/parse.hxx b/starmath/inc/parse.hxx index c49f0f6ff9cf..17e20b4cdaea 100644 --- a/starmath/inc/parse.hxx +++ b/starmath/inc/parse.hxx @@ -29,6 +29,8 @@ #include "error.hxx" #include "node.hxx" +#define DEPTH_LIMIT 1024 + class SmParser { OUString m_aBufferString; @@ -53,7 +55,7 @@ class SmParser { ++m_rParseDepth; } - bool TooDeep() const { return m_rParseDepth > 1024; } + bool TooDeep() const { return m_rParseDepth > DEPTH_LIMIT; } ~DepthProtect() { --m_rParseDepth; diff --git a/starmath/source/parse.cxx b/starmath/source/parse.cxx index 9bb4530eae4e..232a5273f3bc 100644 --- a/starmath/source/parse.cxx +++ b/starmath/source/parse.cxx @@ -1103,8 +1103,16 @@ std::unique_ptr<SmNode> SmParser::DoProduct() auto xFirst = DoPower(); + int nDepthLimit = 0; + while (TokenInGroup(TG::Product)) { + //this linear loop builds a recursive structure, if it gets + //too deep then later processing, e.g. releasing the tree, + //can exhaust stack + if (nDepthLimit > DEPTH_LIMIT) + throw std::range_error("parser depth limit"); + std::unique_ptr<SmStructureNode> xSNode; std::unique_ptr<SmNode> xOper; bool bSwitchArgs = false; @@ -1169,6 +1177,7 @@ std::unique_ptr<SmNode> SmParser::DoProduct() xSNode->SetSubNodes(xFirst.release(), xOper.release(), xArg.release()); } xFirst = std::move(xSNode); + ++nDepthLimit; } return xFirst; } |