commit 75e1efcc4aa5b629a0caa82f0658cbdf39b543ee
author Nigel Tao <nigeltao@golang.org> Mon Aug 24 00:39:54 2020 +1000
committer Nigel Tao <nigeltao@golang.org> Mon Aug 24 00:39:54 2020 +1000
tree 4b6cdbe3610bb9403fe252892b067e1d1f3bc8cf
parent 75682548f58b54d6c251657cca72b05030d56389

Fix std/cbor src.meta.ri for too much recursion

Updates https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25145

release/c/wuffs-unsupported-snapshot.c

diff --git a/release/c/wuffs-unsupported-snapshot.c b/release/c/wuffs-unsupported-snapshot.c
index 2392f68..624472b 100644
--- a/release/c/wuffs-unsupported-snapshot.c
+++ b/release/c/wuffs-unsupported-snapshot.c
@@ -17145,6 +17145,11 @@
             if (WUFFS_CBOR__TOKEN_LENGTHS[v_c_minor] == 0) {
               goto label__goto_fail__break;
             } else if (v_depth >= 1024) {
+              v_token_length = ((uint32_t)(WUFFS_CBOR__TOKEN_LENGTHS[v_c_minor]));
+              while ((v_token_length > 0) && (iop_a_src > io1_a_src)) {
+                (iop_a_src--, wuffs_base__make_empty_struct());
+                v_token_length -= 1;
+              }
               status = wuffs_base__make_status(wuffs_cbor__error__unsupported_recursion_depth);
               goto exit;
             }
@@ -17181,6 +17186,11 @@
             if (WUFFS_CBOR__TOKEN_LENGTHS[v_c_minor] == 0) {
               goto label__goto_fail__break;
             } else if (v_depth >= 1024) {
+              v_token_length = ((uint32_t)(WUFFS_CBOR__TOKEN_LENGTHS[v_c_minor]));
+              while ((v_token_length > 0) && (iop_a_src > io1_a_src)) {
+                (iop_a_src--, wuffs_base__make_empty_struct());
+                v_token_length -= 1;
+              }
               status = wuffs_base__make_status(wuffs_cbor__error__unsupported_recursion_depth);
               goto exit;
             }

std/cbor/decode_cbor.wuffs

diff --git a/std/cbor/decode_cbor.wuffs b/std/cbor/decode_cbor.wuffs
index 77b1097..d18b886 100644
--- a/std/cbor/decode_cbor.wuffs
+++ b/std/cbor/decode_cbor.wuffs
@@ -456,6 +456,11 @@
 			if TOKEN_LENGTHS[c_minor] == 0 {
 				break.goto_fail
 			} else if depth >= 1024 {
+				token_length = TOKEN_LENGTHS[c_minor] as base.u32
+				while (token_length > 0) and (args.src.can_undo_byte()) {
+					args.src.undo_byte!()
+					token_length -= 1
+				} endwhile
 				return "#unsupported recursion depth"
 			}
 
@@ -518,6 +523,11 @@
 			if TOKEN_LENGTHS[c_minor] == 0 {
 				break.goto_fail
 			} else if depth >= 1024 {
+				token_length = TOKEN_LENGTHS[c_minor] as base.u32
+				while (token_length > 0) and (args.src.can_undo_byte()) {
+					args.src.undo_byte!()
+					token_length -= 1
+				} endwhile
 				return "#unsupported recursion depth"
 			}