Repository navigation
v2.14.1 — fix a crash on long language classes
Security fix. Upgrade if you read untrusted HTML with the duck_block functions.
Fixed
A long class on <pre><code> crashed DuckDB. html_to_duck_blocks, read_html_blocks and parse_html_blocks matched the language- class with std::regex, which recurses per character. A class of about 64 KB overflowed the stack, and the process exited with SIGSEGV.
A linear scan now reads the class (#223). A new test pins 17 classes at the values the regex returned, and the results are the same. A 65,536-character class now returns its value.
Claude (Opus) found this in review of #220.
No other changes since v2.14.0.