fix stack overflow by limiting the maximum depth of dotted keys #242
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this change do?
This patch fixes potential stack overflow error in case of huge depths of dotted keys, like
This issue happens during fuzzing testing on google/oss-fuzz platform and prevents the fuzzer from achieving good coverage.
Before the change:
with address sanitizer:
$ simple_parser crash-064bef61a4386fdb3e690f05a827389fe0c63b40 AddressSanitizer:DEADLYSIGNAL ================================================================= ==327716==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdcb974ff8 (pc 0x56059bbac291 bp 0x7ffdcb975090 sp 0x7ffdcb975000 T0) #0 0x56059bbac291 in std::_Rb_tree<toml::v3::key, std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > >, std::_Select1st<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > >, std::less<void>, std::allocator<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > > >::begin() /usr/include/c++/13/bits/stl_tree.h:997 #1 0x56059bb997bf in std::map<toml::v3::key, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> >, std::less<void>, std::allocator<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > > >::begin() /usr/include/c++/13/bits/stl_map.h:369 #2 0x56059bb8c31f in toml::v3::table::begin() /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/table.hpp:799 #3 0x56059bb8c31f in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3509 #4 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512 #5 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512 #6 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512 #7 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512 ...After the change:
Additionally the
-joption has been added tozipcommand infuzzing/build.sh-- without this option the seed corpus is useless because the fuzzer takes files only from the root level.Is it related to an exisiting bug report or feature request?
No
Pre-merge checklist
origin/master(if necessary)