Skip to content

Commit

Permalink
Delay breaking out of the parse loop when max_tree_depth is hit
Browse files Browse the repository at this point in the history
When a token causes a node to be added to the DOM which increases the
depth of the DOM to exceed the `max_tree_depth` _and_ the token needs to
be reprocessed, memory is leaked. By delaying breaking out of the loop
until after the token has been completely handled, this appears to fix
the leak.

Fixes #3098
  • Loading branch information
stevecheckoway committed Jan 16, 2024
1 parent c354b82 commit de6bcd2
Showing 1 changed file with 8 additions and 5 deletions.
13 changes: 8 additions & 5 deletions gumbo-parser/src/parser.c
Original file line number Diff line number Diff line change
Expand Up @@ -4826,14 +4826,17 @@ GumboOutput* gumbo_parse_with_options (
// to a token.
if (token.type == GUMBO_TOKEN_END_TAG &&
token.v.end_tag.tag == GUMBO_TAG_UNKNOWN)
{
gumbo_free(token.v.end_tag.name);
token.v.end_tag.name = NULL;
}
if (unlikely(state->_open_elements.length > max_tree_depth)) {
parser._output->status = GUMBO_STATUS_TREE_TOO_DEEP;
gumbo_debug("Tree depth limit exceeded.\n");
break;
}
}

if (unlikely(state->_open_elements.length > max_tree_depth)) {
parser._output->status = GUMBO_STATUS_TREE_TOO_DEEP;
gumbo_debug("Tree depth limit exceeded.\n");
break;
}

++loop_count;
assert(loop_count < 1000000000UL);
Expand Down

0 comments on commit de6bcd2

Please sign in to comment.