[Dot] Segmentation fault with large number of nested brackets

[GadgetSteve]

Ported Issue from Mantis
Original ID: 1406
Reported By: Marcus Granado

SEVERITY: CRITICAL
Submitted: 2008-09-19 11:22:22

OS: --

VERSION: 2.16

DESCRIPTION

I was using graphviz dot 2.16-3ubuntu2 to parse huge graphs,
and one of them segfaulted dot.

The graph had a deep nested structure, and it seems that dot wasn't
able to cope with that. The attached example is the minimal dot file
that triggers the problem.

STEPS TO REPRODUCE

//usage: 'dot -Tsvg bracketbug-graphviz.dot'
//output: Segmentation fault

digraph "bracketbug_outputs_segmentationfault" {

node [label="a"] "b" -> {
//33 brackets are fine, but
//34 brackets trigger crash
{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}

}
}

ADDITIONAL INFORMATION

[ellson] I can reproduce this with:

digraph "bracketbug_outputs_segmentationfault" {
node [label="a"]
"b" -> {
//33 brackets are fine, but
//34 brackets trigger crash
{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{c}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
}
}

-Tsvg isn't needded for the crash to occur.

It crashes with or without the 'c', although without crashes in a different place, on an agstrfree("")

Program received signal SIGSEGV, Segmentation fault. 0x0000000000000013 in ?? () (gdb) where #0 0x0000000000000013 in ?? () #1 0x00007ffff7df7f95 in agstrdup (s=0x611aa0 "c") at refstr.c:83 #2 0x00007ffff7df63b3 in aglex () at lexer.c:440 #3 0x00007ffff7df7765 in agparse () at y.tab.c:1618 #4 0x00007ffff7df56d5 in agread (fp=) at graphio.c:71