wgsl/parser: Avoid stack overflows
Most recursive control flow passes through Sync().
Error out if the Sync() function is recursively called too many times.
This replaces the more specific kMaxConstExprDepth, which also passes
through Sync().
Fixed: chromium:1178436
Change-Id: I64a05f9f6a4fe6d2b53a3ca75642b30e98c7a35f
Reviewed-on: https://dawn-review.googlesource.com/c/tint/+/41724
Commit-Queue: Ben Clayton <bclayton@google.com>
Reviewed-by: dan sinclair <dsinclair@chromium.org>
diff --git a/src/reader/wgsl/parser_impl.cc b/src/reader/wgsl/parser_impl.cc
index 957cf1a..0000298 100644
--- a/src/reader/wgsl/parser_impl.cc
+++ b/src/reader/wgsl/parser_impl.cc
@@ -83,10 +83,10 @@
template <typename T>
using Maybe = ParserImpl::Maybe<T>;
-/// Controls the maximum number of times we'll call into the const_expr function
+/// Controls the maximum number of times we'll call into the sync() function
/// from itself. This is to guard against stack overflow when there is an
-/// excessive number of type constructors inside the const_expr.
-constexpr uint32_t kMaxConstExprDepth = 128;
+/// excessive number of blocks.
+constexpr uint32_t kMaxSyncDepth = 128;
/// The maximum number of tokens to look ahead to try and sync the
/// parser on error.
@@ -2709,38 +2709,29 @@
// : type_decl PAREN_LEFT (const_expr COMMA)? const_expr PAREN_RIGHT
// | const_literal
Expect<ast::ConstructorExpression*> ParserImpl::expect_const_expr() {
- return expect_const_expr_internal(0);
-}
-
-Expect<ast::ConstructorExpression*> ParserImpl::expect_const_expr_internal(
- uint32_t depth) {
auto t = peek();
- if (depth > kMaxConstExprDepth) {
- return add_error(t, "max const_expr depth reached");
- }
-
auto source = t.source();
auto type = type_decl();
if (type.errored)
return Failure::kErrored;
if (type.matched) {
- auto params = expect_paren_block(
- "type constructor", [&]() -> Expect<ast::ExpressionList> {
- ast::ExpressionList list;
- auto param = expect_const_expr_internal(depth + 1);
- if (param.errored)
- return Failure::kErrored;
- list.emplace_back(param.value);
- while (match(Token::Type::kComma)) {
- param = expect_const_expr_internal(depth + 1);
- if (param.errored)
- return Failure::kErrored;
- list.emplace_back(param.value);
- }
- return list;
- });
+ auto params = expect_paren_block("type constructor",
+ [&]() -> Expect<ast::ExpressionList> {
+ ast::ExpressionList list;
+ auto param = expect_const_expr();
+ if (param.errored)
+ return Failure::kErrored;
+ list.emplace_back(param.value);
+ while (match(Token::Type::kComma)) {
+ param = expect_const_expr();
+ if (param.errored)
+ return Failure::kErrored;
+ list.emplace_back(param.value);
+ }
+ return list;
+ });
if (params.errored)
return Failure::kErrored;
@@ -3170,9 +3161,15 @@
template <typename F, typename T>
T ParserImpl::sync(Token::Type tok, F&& body) {
+ if (sync_depth_ >= kMaxSyncDepth) {
+ return add_error(peek(), "maximum parser recursive depth reached");
+ }
+
sync_tokens_.push_back(tok);
+ ++sync_depth_;
auto result = body();
+ --sync_depth_;
assert(sync_tokens_.back() == tok);
sync_tokens_.pop_back();
diff --git a/src/reader/wgsl/parser_impl.h b/src/reader/wgsl/parser_impl.h
index 4105416..2573a0c 100644
--- a/src/reader/wgsl/parser_impl.h
+++ b/src/reader/wgsl/parser_impl.h
@@ -812,9 +812,6 @@
Expect<type::Type*> expect_type_decl_array(ast::ArrayDecorationList decos);
Expect<type::Type*> expect_type_decl_matrix(Token t);
- Expect<ast::ConstructorExpression*> expect_const_expr_internal(
- uint32_t depth);
-
Expect<type::Type*> expect_type(const std::string& use);
Maybe<ast::Statement*> non_block_statement();
@@ -834,6 +831,7 @@
std::unique_ptr<Lexer> lexer_;
std::deque<Token> token_queue_;
bool synchronized_ = true;
+ uint32_t sync_depth_ = 0;
std::vector<Token::Type> sync_tokens_;
int silence_errors_ = 0;
std::unordered_map<std::string, type::Type*> registered_constructs_;
diff --git a/src/reader/wgsl/parser_impl_const_expr_test.cc b/src/reader/wgsl/parser_impl_const_expr_test.cc
index 8930fd2..b3d3020 100644
--- a/src/reader/wgsl/parser_impl_const_expr_test.cc
+++ b/src/reader/wgsl/parser_impl_const_expr_test.cc
@@ -144,7 +144,7 @@
ASSERT_TRUE(p->has_error());
ASSERT_TRUE(e.errored);
ASSERT_EQ(e.value, nullptr);
- EXPECT_EQ(p->error(), "1:517: max const_expr depth reached");
+ EXPECT_EQ(p->error(), "1:517: maximum parser recursive depth reached");
}
} // namespace
diff --git a/src/reader/wgsl/parser_impl_error_msg_test.cc b/src/reader/wgsl/parser_impl_error_msg_test.cc
index eec3330..1497c8c 100644
--- a/src/reader/wgsl/parser_impl_error_msg_test.cc
+++ b/src/reader/wgsl/parser_impl_error_msg_test.cc
@@ -526,17 +526,17 @@
}
TEST_F(ParserImplErrorTest, GlobalDeclConstExprMaxDepth) {
- uint32_t kMaxConstExprDepth = 128;
+ uint32_t kMaxDepth = 128;
std::stringstream src;
std::stringstream mkr;
src << "const i : i32 = ";
mkr << " ";
- for (size_t i = 0; i < kMaxConstExprDepth + 8; i++) {
+ for (size_t i = 0; i < kMaxDepth + 8; i++) {
src << "f32(";
- if (i < kMaxConstExprDepth + 1) {
+ if (i < kMaxDepth) {
mkr << " ";
- } else if (i == kMaxConstExprDepth + 1) {
+ } else if (i == kMaxDepth) {
mkr << "^^^";
}
}
@@ -546,7 +546,7 @@
}
src << ";";
std::stringstream err;
- err << "test.wgsl:1:533 error: max const_expr depth reached\n"
+ err << "test.wgsl:1:529 error: maximum parser recursive depth reached\n"
<< src.str() << "\n"
<< mkr.str() << "\n";
EXPECT(src.str().c_str(), err.str().c_str());
