Skip to content

v2.14.1 — fix a crash on long language classes

Choose a tag to compare

@teaguesterling teaguesterling released this 05 Nov 20:12
af00a77

Security fix. Upgrade if you read untrusted HTML with the duck_block functions.

Fixed

A long class on <pre><code> crashed DuckDB. html_to_duck_blocks, read_html_blocks and parse_html_blocks matched the language- class with std::regex, which recurses per character. A class of about 64 KB overflowed the stack, and the process exited with SIGSEGV.

A linear scan now reads the class (#223). A new test pins 17 classes at the values the regex returned, and the results are the same. A 65,536-character class now returns its value.

Claude (Opus) found this in review of #220.

No other changes since v2.14.0.