Skip to content

Add explicit recursion limits to avoid stack overflows#420

Merged
juntyr merged 3 commits into
ron-rs:masterfrom
juntyr:307-stack-overflow
Oct 12, 2022
Merged

Add explicit recursion limits to avoid stack overflows#420
juntyr merged 3 commits into
ron-rs:masterfrom
juntyr:307-stack-overflow

Conversation

@juntyr

@juntyr juntyr commented Oct 9, 2022 •
edited
Loading

Copy link
Copy Markdown
Member

Fixes #307 and the long-standing potential for stack overflows while serialising or deserialising.

Now, ron::Options is by default configured for a recursion limit of 128 (here recursion is very loosely defined). This limit can be adjusted or disabled.

This bug was first reported by @5225225 in #307 and later by oss-fuzz.

This PR also slightly extends the from_str fuzz target to check serialising as well.

  • I've included my change in CHANGELOG.md

@juntyr

juntyr commented Oct 9, 2022 •
edited
Loading

Copy link
Copy Markdown
Member Author

@torkleyy Does this API change look good to you? If so, feel free to squash and merge.

I would be surprised if anyone is using such highly recursive data structures in the wild and would be affected by the default limit. Hence, this might be a v0.9 change?

@juntyr juntyr self-assigned this Oct 9, 2022
@juntyr juntyr requested a review from torkleyy October 9, 2022 10:56
@juntyr juntyr marked this pull request as ready for review October 9, 2022 10:57
@codecov-commenter

codecov-commenter commented Oct 9, 2022 •
edited
Loading

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 56.52174% with 50 lines in your changes missing coverage. Please review.
✅ Project coverage is 87.19%. Comparing base (0c32f8d) to head (ab9f879).
⚠️ Report is 111 commits behind head on master.

Files with missing lines Patch % Lines
src/options.rs 5.55% 17 Missing ⚠️
src/ser/mod.rs 64.58% 17 Missing ⚠️
src/de/mod.rs 68.75% 15 Missing ⚠️
src/error.rs 0.00% 1 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

❗ There is a different number of reports uploaded between BASE (0c32f8d) and HEAD (ab9f879). Click for more details.

HEAD has 1 upload less than BASE
Flag BASE (0c32f8d) HEAD (ab9f879)
2 1
Additional details and impacted files 
@@            Coverage Diff             @@
##           master     #420      +/-   ##
==========================================
- Coverage   93.06%   87.19%   -5.87%     
==========================================
  Files          56       57       +1     
  Lines        6618     7117     +499     
==========================================
+ Hits         6159     6206      +47     
- Misses        459      911     +452

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@juntyr

juntyr commented Oct 9, 2022

Copy link
Copy Markdown
Member Author

Part of the codecov regression is spurious, part is expected. As I've spent the past few commits increasing codecov this is unfortunate, but I'll get to adding coverage for the stack overflow checks at some point :)

@juntyr juntyr mentioned this pull request Oct 9, 2022
Closed
@juntyr juntyr changed the title 307 stack overflow Add explicit recursion limits to avoid stack overflows Oct 9, 2022
@juntyr

juntyr commented Oct 12, 2022

Copy link
Copy Markdown
Member Author

@torkleyy As you might be busy, I will merge this PR on Friday if you don’t object. While this change would break deeply nested structures, I think this can be dealt with by pushing the change to 0.9 instead of 0.8.1. Apart from a new error, the API update is a non-breaking change.

torkleyy
torkleyy approved these changes Oct 12, 2022
View reviewed changes

@torkleyy torkleyy left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes limiting the recursion limit is certainly useful especially for untrusted inputs. 👍

@juntyr juntyr merged commit 562963f into ron-rs:master Oct 12, 2022
@juntyr juntyr deleted the 307-stack-overflow branch October 12, 2022 06:58
juntyr added a commit to juntyr/ron that referenced this pull request Aug 15, 2023
@juntyr
Add explicit recursion limits to avoid stack overflows (ron-rs#420)
531d2af 
* Explicit recursion limit during deserializing

* Explicit recursion limit during serializing

* Added CHANGELOG entry
juntyr added a commit to juntyr/ron that referenced this pull request Aug 16, 2023
@juntyr
Add explicit recursion limits to avoid stack overflows (ron-rs#420)
bab7689 
* Explicit recursion limit during deserializing

* Explicit recursion limit during serializing

* Added CHANGELOG entry
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@torkleyy torkleyy torkleyy approved these changes

Assignees

@juntyr juntyr

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Stack overflow when parsing deeply nested map

3 participants

@juntyr @codecov-commenter @torkleyy