From 43a0d0779d00c036b14b991e40cf6b4e39c1bbdc Mon Sep 17 00:00:00 2001 From: Lukas Johannes Moller Date: Mon, 6 Apr 2026 18:55:24 +0000 Subject: [PATCH] parser: add depth limit to prevent stack overflow Deeply nested input exhausts the goroutine stack, causing an unrecoverable fatal error that bypasses recover(). Add a depth counter to parse() with a limit of 500 (matching MaxStack). Signed-off-by: Lukas Johannes Moller --- internal/parser/parser.go | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/internal/parser/parser.go b/internal/parser/parser.go index ef65fe51..b5f0f061 100644 --- a/internal/parser/parser.go +++ b/internal/parser/parser.go @@ -42,9 +42,12 @@ func locFromTokenAST(begin *token, end ast.Node) ast.LocationRange { // --------------------------------------------------------------------------- +const maxParseDepth = 500 + type parser struct { - t Tokens - currT int + t Tokens + currT int + parseDepth int } func makeParser(t Tokens) *parser { @@ -981,6 +984,14 @@ func (p *parser) parsingFailure(msg string, tok *token) (ast.Node, errors.Static } func (p *parser) parse(prec iast.Precedence) (ast.Node, errors.StaticError) { + p.parseDepth++ + defer func() { p.parseDepth-- }() + if p.parseDepth > maxParseDepth { + return nil, errors.MakeStaticError( + fmt.Sprintf("Exceeded max parse depth of %d", maxParseDepth), + p.peek().loc) + } + begin := p.peek() switch begin.kind {