Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix stack overflow by limiting the maximum depth of dotted keys #242

Merged
merged 1 commit into from
Nov 14, 2024

Conversation

tyler92
Copy link
Contributor

@tyler92 tyler92 commented Nov 13, 2024

What does this change do?

This patch fixes potential stack overflow error in case of huge depths of dotted keys, like

[a.b.c.d. <very long list> .n]

This issue happens during fuzzing testing on google/oss-fuzz platform and prevents the fuzzer from achieving good coverage.
Before the change:

$ examples/simple_parser crash-064bef61a4386fdb3e690f05a827389fe0c63b40 
Segmentation fault (core dumped)

with address sanitizer:

$ simple_parser crash-064bef61a4386fdb3e690f05a827389fe0c63b40 
AddressSanitizer:DEADLYSIGNAL
=================================================================
==327716==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdcb974ff8 (pc 0x56059bbac291 bp 0x7ffdcb975090 sp 0x7ffdcb975000 T0)
    #0 0x56059bbac291 in std::_Rb_tree<toml::v3::key, std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > >, std::_Select1st<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > >, std::less<void>, std::allocator<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > > >::begin() /usr/include/c++/13/bits/stl_tree.h:997
    #1 0x56059bb997bf in std::map<toml::v3::key, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> >, std::less<void>, std::allocator<std::pair<toml::v3::key const, std::unique_ptr<toml::v3::node, std::default_delete<toml::v3::node> > > > >::begin() /usr/include/c++/13/bits/stl_map.h:369
    #2 0x56059bb8c31f in toml::v3::table::begin() /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/table.hpp:799
    #3 0x56059bb8c31f in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3509
    #4 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512
    #5 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512
    #6 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512
    #7 0x56059bb8c3b1 in toml::v3::impl::impl_ex::parser::update_region_ends(toml::v3::node&) /home/misha/work/relax/github.com/marzer/tomlplusplus/include/toml++/impl/parser.inl:3512
...

After the change:

$ examples/simple_parser crash-064bef61a4386fdb3e690f05a827389fe0c63b40 
Error while parsing key: exceeded maximum dotted keys depth of 1024 (TOML_MAX_DOTTED_KEYS_DEPTH)
	(error occurred at line 1, column 2051 of 'crash-064bef61a4386fdb3e690f05a827389fe0c63b40')

Additionally the -j option has been added to zip command in fuzzing/build.sh -- without this option the seed corpus is useless because the fuzzer takes files only from the root level.

Is it related to an exisiting bug report or feature request?

No

Pre-merge checklist

  • I've read CONTRIBUTING.md
  • I've rebased my changes against the current HEAD of origin/master (if necessary)
  • I've added new test cases to verify my change
  • I've regenerated toml.hpp (how-to)
  • I've updated any affected documentation
  • I've rebuilt and run the tests with at least one of:
    • Clang 8 or higher
    • GCC 8 or higher
    • MSVC 19.20 (Visual Studio 2019) or higher
  • I've added my name to the list of contributors in README.md

@marzer marzer merged commit c4369ae into marzer:master Nov 14, 2024
9 checks passed
@marzer
Copy link
Owner

marzer commented Nov 14, 2024

Great work, thanks for contributing! 😄

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants