From 39cd68f661ac86484b341c93f949c29592694e89 Mon Sep 17 00:00:00 2001 From: Even Rouault Date: Sun, 26 Apr 2020 16:47:00 +0200 Subject: pipeline initialization: avoid deep recursion on corrupted PROJ string like https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21889 --- src/pipeline.cpp | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/pipeline.cpp') diff --git a/src/pipeline.cpp b/src/pipeline.cpp index 511a69fe..80ee0397 100644 --- a/src/pipeline.cpp +++ b/src/pipeline.cpp @@ -424,6 +424,16 @@ PJ *OPERATION(pipeline,0) { int i_pipeline = -1, i_first_step = -1, i_current_step; char **argv, **current_argv; + if( P->ctx->pipelineInitRecursiongCounter == 5 ) + { + // Can happen for a string like: + // proj=pipeline step "x="""," u=" proj=pipeline step ste=""[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline p step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ste="[" u=" proj=pipeline step ""x=""""""""""" + // Probably an issue with the quoting handling code + // But doesn't hurt to add an extra safety check + proj_log_error (P, "Pipeline: too deep recursion"); + return destructor (P, PJD_ERR_MALFORMED_PIPELINE); /* ERROR: nested pipelines */ + } + P->fwd4d = pipeline_forward_4d; P->inv4d = pipeline_reverse_4d; P->fwd3d = pipeline_forward_3d; @@ -513,7 +523,9 @@ PJ *OPERATION(pipeline,0) { err = proj_errno_reset (P); + P->ctx->pipelineInitRecursiongCounter ++; next_step = pj_create_argv_internal (P->ctx, current_argc, current_argv); + P->ctx->pipelineInitRecursiongCounter --; proj_log_trace (P, "Pipeline: Step %d (%s) at %p", i, current_argv[0], next_step); if (nullptr==next_step) { -- cgit v1.2.3