peepmatic: Implement maximum nesting level in parser

So that we don't blow the stack. Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24705
fitzgen · Aug 7, 2020 · aad0868 · aad0868
1 parent 174159a
commit aad0868
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/cranelift/peepmatic/src/parser.rs b/cranelift/peepmatic/src/parser.rs
@@ -429,6 +429,13 @@ where
     DynAstRef<'a, TOperator>: From<&'a TOperand>,
 {
     fn parse(p: Parser<'a>) -> ParseResult<Self> {
+        // Don't blow the stack with this recursive parser. We don't expect
+        // nesting to ever get very deep, so it isn't worth refactoring this
+        // code to be non-recursive.
+        if p.parens_depth() > 25 {
+            return Err(p.error("module nesting too deep"));
+        }
+
         let span = p.cur_span();
         p.parens(|p| {
             let operator = p.parse()?;
@@ -816,6 +823,9 @@ mod test {
                 "$var",
                 "$CONST",
                 "(ishl $x $(log2 $C))",
+
+                // Nesting too deep.
+                "(iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd (iadd))))))))))))))))))))))))))))))))))))))))))))))))))",
             }
         }
         parse_operation_rhs<Operation<TestOperator, Rhs<TestOperator>>> {