Skip to content

Pretty: ensure recursionsLeft is not zero before decrementing it#283

Merged
thiagomacieira merged 1 commit intointel:mainfrom
niooss-ledger:fix-cborpretty-recursion
Mar 18, 2025
Merged

Pretty: ensure recursionsLeft is not zero before decrementing it#283
thiagomacieira merged 1 commit intointel:mainfrom
niooss-ledger:fix-cborpretty-recursion

Conversation

@niooss-ledger
Copy link
Contributor

When value_to_pretty is called with recursionsLeft=0 and an Array or Map type, container_to_pretty is called with recursionsLeft - 1 = -1. This breaks the recursion limit check.

In practice, this can be triggered with a CBOR data containing 1023 Arrays, a Tag and many more Arrays:

$ python3 -c 'import sys;sys.stdout.buffer.write(b"\x9f" * 1023 + b"\xc0\x9f" + b"\x9f" * 100000 + b"\xff" * 101024)' | ./bin/cbordump
Segmentation fault (core dumped)

This segmentation fault is due to the stack growing too much, due to the quantity of recursive calls.

Fix this by reporting a proper error instead. The same input now produces:

[_ [_ [_ ... [_ 0([
-: internal error: too many nested containers found in recursive function
_ <nesting too deep, recursion stopped>

Moreover, using fewer nested arrays works fine:

$ python3 -c 'import sys;sys.stdout.buffer.write(b"\x9f" * 1023 + b"\xc0\x9f" + b"\x9f" * 1024 + b"\xff" * 2048)' |./bin/cbordump
[_ [_ [_ ... [_ 0([_ <nesting too deep, recursion stopped>])] ... ]]]

Copy link
Member

@thiagomacieira thiagomacieira left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks ok, but it would be easier to just change container_to_pretty:

    if (!recursionsLeft <= 0) {

@niooss-ledger
Copy link
Contributor Author

Actually, I was not sure whether negative values of recursionsLeft were acceptable. In some projects, values such as -1 are used to mean "disable the limit".

Here it seems recursionsLeft is always expected to start at CBOR_PARSER_MAX_RECURSIONS and stay positive. So I agree with your comment and will update the Pull Request.

When value_to_pretty is called with recursionsLeft=0 and an Array or Map
type, container_to_pretty is called with recursionsLeft - 1 = -1. This
breaks the recursion limit check.

In practice, this can be triggered with a CBOR data containing 1023
Arrays, a Tag and many more Arrays:

    $ python3 -c 'import sys;sys.stdout.buffer.write(b"\x9f" * 1023 + b"\xc0\x9f" + b"\x9f" * 100000 + b"\xff" * 101024)' | ./bin/cbordump
    Segmentation fault (core dumped)

This segmentation fault is due to the stack growing too much, due to the
quantity of recursive calls.

Fix this by reporting a proper error when recursionsLeft <= 0, instead
of when recursionsLeft == 0. The same input now produces:

    [_ [_ [_ ... [_ 0([
    -: internal error: too many nested containers found in recursive function
    _ <nesting too deep, recursion stopped>

Moreover, using fewer nested arrays works fine:

    $ python3 -c 'import sys;sys.stdout.buffer.write(b"\x9f" * 1023 + b"\xc0\x9f" + b"\x9f" * 1024 + b"\xff" * 2048)' |./bin/cbordump
    [_ [_ [_ ... [_ 0([_ <nesting too deep, recursion stopped>])] ... ]]]

Also modify the test when formatting CborTagType to ensure
value_to_pretty is never called with a negative recursionsLeft.
@thiagomacieira thiagomacieira force-pushed the fix-cborpretty-recursion branch from 1a6c1c1 to 8a57e1a Compare March 18, 2025 15:11
@thiagomacieira thiagomacieira merged commit 4682eaa into intel:main Mar 18, 2025
6 checks passed
@niooss-ledger niooss-ledger deleted the fix-cborpretty-recursion branch March 18, 2025 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants