RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:38:11 +00:00
Code Issues Activity Actions

Shell: Prevent exponential explosion around '$(('

Browse source 
When parse_expression looks at '$((', there are two ways it can end up
in parse_expression again, three consumed characters later. All these
ways fail, so what happened was that the parser tried all possible
combinations, hence taking potentially an exponential amount of time.

1. parse_evaluate swallows the '$(', a new invocation of
   parse_expression swallows the other '(', and through
   parse_list_expression we're at another parse_expression.
2. parse_evaluate swallows the '$(', but returns a SyntaxError.
   parse_expression used to not recognize the error, and treated it as a
   regular AST node, calling into read_concat, then a new invocation of
   parse_expression swallows the other '(', and through
   parse_list_expression we're at another parse_expression.

Fixes #10561.

Found by OSS Fuzz, long-standing issue
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28113
This commit is contained in:
Ben Wiederhake 2021-10-21 22:55:52 +02:00 • committed by Linus Groh
parent fc519d43ba
commit 48e4fb239a
2 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
Userland/Shell/Parser.cpp
View file

@ -1166,8 +1166,10 @@ RefPtr<AST::Node> Parser::parse_expression()
if (auto immediate = parse_immediate_expression())
return read_concat(immediate.release_nonnull());
if (auto inline_exec = parse_evaluate())
auto inline_exec = parse_evaluate();
if (inline_exec && !inline_exec->is_syntax_error())
return read_concat(inline_exec.release_nonnull());
return inline_exec;
}
if (starting_char == '#')