MyFavMirrors/owntone-server
1
0
Fork 0
mirror of https://github.com/owntone/owntone-server.git synced 2025-03-31 01:33:44 -04:00
Code Issues Packages Projects Releases Wiki Activity

[parsers] Fix possible stack overflow from recursion

Browse Source 
Closes #1873
This commit is contained in:
ejurgensen 2025-03-07 16:22:43 +01:00
parent 8d2b4b925d
commit 13a8f71c0c
3 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/parsers/mpd_parser.y
View File

@ -182,6 +182,7 @@ int mpd_lex_parse(struct mpd_result *result, const char *input);
#include <assert.h> #include <assert.h>
#define INVERT_MASK 0x80000000 #define INVERT_MASK 0x80000000
#define RECURSION_MAX 64
} }
/* Dependencies, mocked or real */ /* Dependencies, mocked or real */
@ -225,6 +226,8 @@ struct mpd_result {
int err; int err;
char errmsg[128]; char errmsg[128];
int recursion_level;
}; };
enum mpd_type { enum mpd_type {
@ -416,6 +419,15 @@ static void sql_append_recursive(struct mpd_result *result, struct mpd_result_pa
{ {
char escape_char; char escape_char;
if (result->recursion_level > RECURSION_MAX)
{
snprintf(result->errmsg, sizeof(result->errmsg), "Recursion maximum exceeded");
result->err = -2;
return;
}
result->recursion_level++;
switch (append_type) switch (append_type)
{ {
case SQL_APPEND_OPERATOR: case SQL_APPEND_OPERATOR:
@ -477,6 +489,8 @@ static void sql_append_recursive(struct mpd_result *result, struct mpd_result_pa
sql_append(result, part, ")"); sql_append(result, part, ")");
break; break;
} }
result->recursion_level--;
} }
/* Creates the parsing result from the AST. Errors are set via result->err. */ /* Creates the parsing result from the AST. Errors are set via result->err. */

14
src/parsers/rsp_parser.y
View File

@ -178,6 +178,7 @@ int rsp_lex_parse(struct rsp_result *result, const char *input);
#include <assert.h> #include <assert.h>
#define INVERT_MASK 0x80000000 #define INVERT_MASK 0x80000000
#define RECURSION_MAX 64
} }
/* Dependencies, mocked or real */ /* Dependencies, mocked or real */
@ -197,6 +198,8 @@ struct rsp_result {
int offset; int offset;
int err; int err;
char errmsg[128]; char errmsg[128];
int recursion_level;
}; };
} }
@ -272,6 +275,15 @@ static void sql_append_recursive(struct rsp_result *result, struct ast *a, const
{ {
char escape_char; char escape_char;
if (result->recursion_level > RECURSION_MAX)
{
snprintf(result->errmsg, sizeof(result->errmsg), "Recursion maximum exceeded");
result->err = -2;
return;
}
result->recursion_level++;
switch (append_type) switch (append_type)
{ {
case SQL_APPEND_OPERATOR: case SQL_APPEND_OPERATOR:
@ -317,6 +329,8 @@ static void sql_append_recursive(struct rsp_result *result, struct ast *a, const
sql_append(result, ")"); sql_append(result, ")");
break; break;
} }
result->recursion_level--;
} }
static void sql_from_ast(struct rsp_result *result, struct ast *a) static void sql_from_ast(struct rsp_result *result, struct ast *a)

14
src/parsers/smartpl_parser.y
View File

@ -182,6 +182,7 @@ int smartpl_lex_parse(struct smartpl_result *result, const char *input);
#include <assert.h> #include <assert.h>
#define INVERT_MASK 0x80000000 #define INVERT_MASK 0x80000000
#define RECURSION_MAX 64
} }
/* Dependencies, mocked or real */ /* Dependencies, mocked or real */
@ -215,6 +216,8 @@ struct smartpl_result {
int limit; int limit;
int err; int err;
char errmsg[128]; char errmsg[128];
int recursion_level;
}; };
} }
@ -289,6 +292,15 @@ static void sql_append_recursive(struct smartpl_result *result, struct result_pa
{ {
char escape_char; char escape_char;
if (result->recursion_level > RECURSION_MAX)
{
snprintf(result->errmsg, sizeof(result->errmsg), "Recursion maximum exceeded");
result->err = -2;
return;
}
result->recursion_level++;
switch (append_type) switch (append_type)
{ {
case SQL_APPEND_OPERATOR: case SQL_APPEND_OPERATOR:
@ -359,6 +371,8 @@ static void sql_append_recursive(struct smartpl_result *result, struct result_pa
sql_append(result, part, "', "); sql_append(result, part, "', ");
break; break;
} }
result->recursion_level--;
} }
/* Creates the parsing result from the AST. Errors are set via result->err. */ /* Creates the parsing result from the AST. Errors are set via result->err. */