pipeline initialization: avoid deep recursion on corrupted PROJ string like https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21889

2 files changed, 13 insertions, 0 deletions

diff --git a/src/pipeline.cpp b/src/pipeline.cpp
index 96767143..8c4ac655 100644
--- a/src/pipeline.cpp
+++ b/src/pipeline.cpp
@@ -406,6 +406,16 @@ PJ *OPERATION(pipeline,0) {
     int i_pipeline = -1, i_first_step = -1, i_current_step;
     char **argv, **current_argv;
 
+    if( P->ctx->pipelineInitRecursiongCounter == 5 )
+    {
+        // Can happen for a string like:
+        // proj=pipeline step "x="""," u=" proj=pipeline step ste=""[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline p step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ""x="""""""""""
+        // Probably an issue with the quoting handling code
+        // But doesn't hurt to add an extra safety check
+        proj_log_error (P, "Pipeline: too deep recursion");
+        return destructor (P, PJD_ERR_MALFORMED_PIPELINE); /* ERROR: nested pipelines */
+    }
+
     P->fwd4d  =  pipeline_forward_4d;
     P->inv4d  =  pipeline_reverse_4d;
     P->fwd3d  =  pipeline_forward_3d;
@@ -495,7 +505,9 @@ PJ *OPERATION(pipeline,0) {
 
         err = proj_errno_reset (P);
 
+        P->ctx->pipelineInitRecursiongCounter ++;
         next_step = pj_create_argv_internal (P->ctx, current_argc, current_argv);
+        P->ctx->pipelineInitRecursiongCounter --;
         proj_log_trace (P, "Pipeline: Step %d (%s) at %p", i, current_argv[0], next_step);
 
         if (nullptr==next_step) {
diff --git a/src/proj_internal.h b/src/proj_internal.h
index 3e219682..22848e8d 100644
--- a/src/proj_internal.h
+++ b/src/proj_internal.h
@@ -711,6 +711,7 @@ struct projCtx_t {
     void* file_finder_user_data = nullptr;
 
     int projStringParserCreateFromPROJStringRecursionCounter = 0; // to avoid potential infinite recursion in PROJStringParser::createFromPROJString()
+    int pipelineInitRecursiongCounter = 0; // to avoid potential infinite recursion in pipeline.cpp
 
     projCtx_t() = default;
     projCtx_t(const projCtx_t&);