Hemera/nomo
1
1
Fork 0
Code Issues 5 Pull requests Releases Wiki Activity

Unbounded recursion causes non-catchable stack overflow (process abort) during parse and render #23

New issue
Open
opened 2026-08-07 13:33:12 +02:00 by Hemera · 0 comments
Hemera commented 2026-08-07 13:33:12 +02:00
Owner
Copy link

Both the parser and the evaluator recurse once per nesting level with no depth limit. A stack overflow is a hard SIGABRT that cannot be intercepted with catch_unwind.

Verified on main (default 8 MB stack):

  • add_template with ~400 nested ( (debug) / ~1000-2000 (release) → abort. A 2-4 KB template is enough.
  • add_template with deeply nested if / for blocks (~2000 deep, release) → abort.
  • render with ~1500 nested {{ define }} blocks → abort (each define executes RenderInline recursively).
  • render of a template that renders itself (directly or mutually) → abort.

Suggested mitigations:

  • Cap parser nesting depth (track depth in parse_expression / chain parsers and error out beyond a limit).
  • Cap eval recursion: a max run_execute depth / max Render+RenderInline nesting, returning an EvaluationError.
  • Optionally a max total output size for render.
Both the parser and the evaluator recurse once per nesting level with no depth limit. A stack overflow is a hard `SIGABRT` that cannot be intercepted with `catch_unwind`. Verified on `main` (default 8 MB stack): - `add_template` with ~400 nested `(` (debug) / ~1000-2000 (release) → abort. A 2-4 KB template is enough. - `add_template` with deeply nested `if` / `for` blocks (~2000 deep, release) → abort. - `render` with ~1500 nested `{{ define }}` blocks → abort (each `define` executes `RenderInline` recursively). - `render` of a template that renders itself (directly or mutually) → abort. Suggested mitigations: - Cap parser nesting depth (track depth in `parse_expression` / chain parsers and error out beyond a limit). - Cap eval recursion: a max `run_execute` depth / max `Render`+`RenderInline` nesting, returning an `EvaluationError`. - Optionally a max total output size for `render`.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
remake-expr
v0.1.0
v0.0.1
Labels
Clear labels   
automated-🤖
This issue was created in an automated fashion. As such it requires careful triage before assuming it is correct.

No labels
automated-🤖
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Hemera/nomo#23
No description provided.