From cad6416ccbf103648874b0f5fb615ec5ac798f14 Mon Sep 17 00:00:00 2001
From: ethannicholas <ethannicholas@google.com>
Date: Thu, 27 Oct 2016 10:54:02 -0700
Subject: [PATCH] Added skslc parse recursion limit

The fuzzer discovered that a long chain of left-parentheses would cause a stack overflow due to excessive recursion. While it is not in general possible to guarantee that we do not exceed stack limits (because the system can be configured with an arbitrarily small stack), setting a reasonable recursion limit will at least keep the fuzzer from continually finding more "bugs" like this.

BUG=skia:5899
GOLD_TRYBOT_URL= https://gold.skia.org/search?issue=2459573003

Review-Url: https://codereview.chromium.org/2459573003
---
 src/sksl/SkSLParser.cpp | 33 +++++++++++++++++++++++++++++++++
 src/sksl/SkSLParser.h   |  6 +++++-
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/src/sksl/SkSLParser.cpp b/src/sksl/SkSLParser.cpp
index 2699d9c..7eac0ce 100644
--- a/src/sksl/SkSLParser.cpp
+++ b/src/sksl/SkSLParser.cpp
@@ -73,6 +73,31 @@
 
 namespace SkSL {
 
+#define MAX_PARSE_DEPTH 50
+
+class AutoDepth {
+public:
+    AutoDepth(Parser* p)
+    : fParser(p) {
+        fParser->fDepth++;
+    }
+
+    ~AutoDepth() {
+        fParser->fDepth--;
+    }
+
+    bool checkValid() {
+        if (fParser->fDepth > MAX_PARSE_DEPTH) {
+            fParser->error(fParser->peek().fPosition, "exceeded max parse depth");
+            return false;
+        }
+        return true;
+    }
+
+private:
+    Parser* fParser;
+};
+
 Parser::Parser(std::string text, SymbolTable& types, ErrorReporter& errors) 
 : fPushback(Position(-1, -1), Token::INVALID_TOKEN, "")
 , fTypes(types)
@@ -920,6 +945,10 @@ std::unique_ptr<ASTDiscardStatement> Parser::discardStatement() {
 
 /* LBRACE statement* RBRACE */
 std::unique_ptr<ASTBlock> Parser::block() {
+    AutoDepth depth(this);
+    if (!depth.checkValid()) {
+        return nullptr;
+    }
     Token start;
     if (!this->expect(Token::LBRACE, "'{'", &start)) {
         return nullptr;
@@ -959,6 +988,10 @@ std::unique_ptr<ASTExpressionStatement> Parser::expressionStatement() {
 
 /* assignmentExpression */
 std::unique_ptr<ASTExpression> Parser::expression() {
+    AutoDepth depth(this);
+    if (!depth.checkValid()) {
+        return nullptr;
+    }
     return this->assignmentExpression();
 }
 
diff --git a/src/sksl/SkSLParser.h b/src/sksl/SkSLParser.h
index d1ae0d0..f9dcde2 100644
--- a/src/sksl/SkSLParser.h
+++ b/src/sksl/SkSLParser.h
@@ -197,12 +197,16 @@ private:
 
     bool identifier(std::string* dest);
 
-
     void* fScanner;
     YY_BUFFER_STATE fBuffer;
+    // current parse depth, used to enforce a recursion limit to try to keep us from overflowing the
+    // stack on pathological inputs
+    int fDepth = 0;
     Token fPushback;
     SymbolTable& fTypes;
     ErrorReporter& fErrors;
+
+    friend class AutoDepth;
 };
 
 } // namespace
-- 
2.7.4