Limit parser recursion depth, fixes Group Photo Post Instagram Ideas

Author: Don't Read My Bio

README.md

@@ -318,6 +318,10 @@ That will match how many scripting languages do it (e.g. Python, Ruby).
 Also, if you'd like `log` to default to the natural log instead of `log10`,
 then you can define `TE_NAT_LOG`.
 
+TinyExpr limits expression nesting (parentheses and function application) to
+512 levels, so that deeply nested input fails with a parse error instead of
+overflowing the stack. Define `TE_MAX_DEPTH` to change the limit.
+
 ## Hints
 
 - All functions/types start with the letters *te*.

smoke.c

@@ -24,6 +24,8 @@
 
 #include "tinyexpr.h"
 #include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
 #include "minctest.h"
 
 
@@ -796,6 +798,40 @@ void test_logic() {
 }
 
 
+void test_depth() {
+ /* Expressions nested deeper than TE_MAX_DEPTH must fail cleanly
+ * instead of overflowing the stack. */
+ int depths[] = {100, 400, 1000, 5000};
+ int i;
+ for (i = 0; i < (int)(sizeof(depths) / sizeof(int)); ++i) {
+ const int depth = depths[i];
+ const int ok = depth < 500;
+ int j, err;
+
+ /* ((((...1...)))) */
+ char *expr = malloc(depth * 2 + 2);
+ memset(expr, '(', depth);
+ expr[depth] = '1';
+ memset(expr + depth + 1, ')', depth);
+ expr[depth * 2 + 1] = '\0';
+
+ double r = te_interp(expr, &err);
+ lok(ok ? (err == 0 && r == 1.0) : (err != 0 && r != r));
+ free(expr);
+
+ /* sin sin sin ... 1 */
+ expr = malloc(depth * 4 + 2);
+ for (j = 0; j < depth; ++j) memcpy(expr + j * 4, "sin ", 4);
+ expr[depth * 4] = '1';
+ expr[depth * 4 + 1] = '\0';
+
+ r = te_interp(expr, &err);
+ lok(ok ? (err == 0) : (err != 0 && r != r));
+ free(expr);
+ }
+}
+
+
 int main(int argc, char *argv[])
 {
  lrun("Results", test_results);
@@ -810,6 +846,7 @@ int main(int argc, char *argv[])
  lrun("Pow", test_pow);
  lrun("Combinatorics", test_combinatorics);
  lrun("Logic", test_logic);
+ lrun("Depth", test_depth);
  lresults();
 
  return lfails != 0;

tinyexpr.c

@@ -73,6 +73,7 @@ typedef struct state {
  const te_variable *lookup;
  int lookup_len;
  int applied_unary;
+ int depth;
 } state;
 
 
@@ -85,6 +86,10 @@ typedef struct state {
 #define NEW_EXPR(type, ...) new_expr((type), (const te_expr*[]){__VA_ARGS__})
 #define CHECK_NULL(ptr, ...) if ((ptr) == NULL) { __VA_ARGS__; return NULL; }
 
+#ifndef TE_MAX_DEPTH
+#define TE_MAX_DEPTH 512
+#endif
+
 static te_expr *new_expr(const int type, const te_expr *parameters[]) {
  const int arity = ARITY(type);
  const int psize = sizeof(void*) * arity;
@@ -369,7 +374,22 @@ static te_expr *list(state *s);
 static te_expr *expr(state *s);
 static te_expr *power(state *s);
 
+static te_expr *base_impl(state *s);
+
 static te_expr *base(state *s) {
+ /* Guard against stack overflow from deeply nested expressions. */
+ if (s->depth >= TE_MAX_DEPTH) {
+ s->type = TOK_ERROR;
+ return NULL;
+ }
+
+ s->depth++;
+ te_expr *ret = base_impl(s);
+ s->depth--;
+ return ret;
+}
+
+static te_expr *base_impl(state *s) {
  /* <base> = <constant> | <variable> | <function-0> {"(" ")"} | <function-1> <power> | <function-X> "(" <expr> {"," <expr>} ")" | "(" <list> ")" */
  te_expr *ret;
  int arity;
@@ -853,6 +873,7 @@ te_expr *te_compile(const char *expression, const te_variable *variables, int va
  s.start = s.next = expression;
  s.lookup = variables;
  s.lookup_len = var_count;
+ s.depth = 0;
 
  next_token(&s);
  te_expr *root = list(&s);