RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-18 21:35:06 +00:00
Code Issues Activity Actions

LibSQL: Limit the allowed depth of an expression tree

Browse source 
According to the definition at https://sqlite.org/lang_expr.html, SQL
expressions could be infinitely deep. For practicality, SQLite enforces
a maxiumum expression tree depth of 1000. Apply the same limit in
LibSQL to avoid stack overflow in the expression parser.

Fixes https://crbug.com/oss-fuzz/34859.
This commit is contained in:
Timothy Flynn 2021-06-05 09:55:16 -04:00 • committed by Ali Mohammad Pur
parent 3d9bcb860e
commit f8f36effc9
3 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibSQL/Parser.cpp
View file

@ -352,6 +352,11 @@ RefPtr<CommonTableExpressionList> Parser::parse_common_table_expression_list()
NonnullRefPtr<Expression> Parser::parse_expression()
{
if (++m_parser_state.m_current_expression_depth > Limits::maximum_expression_tree_depth) {
syntax_error(String::formatted("Exceeded maximum expression tree depth of {}", Limits::maximum_expression_tree_depth));
return create_ast_node<ErrorExpression>();
}
// https://sqlite.org/lang_expr.html
auto expression = parse_primary_expression();
@ -362,6 +367,7 @@ NonnullRefPtr<Expression> Parser::parse_expression()
// FIXME: Parse 'function-name'.
// FIXME: Parse 'raise-function'.
--m_parser_state.m_current_expression_depth;
return expression;
}