Re: [PATCH 0/2] avoiding recursion in mailinfo

From: Patrick Steinhardt <ps@pks.im>
Date: Dec 15, 2023, 07:58 UTC
Message-ID: <ZXwHPL3sWhzwamrp@tanuki>
In-Reply-To: <20231214214444.GB2297853@coredump.intra.peff.net>

On Thu, Dec 14, 2023 at 04:44:44PM -0500, Jeff King wrote:

Show 30 quoted lines

> On Thu, Dec 14, 2023 at 08:41:20AM +0100, Patrick Steinhardt wrote:
> 
> > > @@ -72,11 +73,14 @@ static const char *unquote_comment(struct strbuf *outbuf, const char *in)
> > >  				take_next_literally = 1;
> > >  				continue;
> > >  			case '(':
> > > -				in = unquote_comment(outbuf, in);
> > > +				strbuf_addch(outbuf, '(');
> > > +				depth++;
> > >  				continue;
> > >  			case ')':
> > >  				strbuf_addch(outbuf, ')');
> > > -				return in;
> > > +				if (!--depth)
> > > +					return in;
> > > +				continue;
> > >  			}
> > >  		}
> > >  
> > > I doubt it's a big deal either way, but if it's that easy to do it might
> > > be worth it.
> > 
> > Isn't this only protecting against unbalanced braces? That might be a
> > sensible check to do regardless, but does it protect against recursion
> > blowing the stack if you just happen to have many opening braces?
> > 
> > Might be I'm missing something.
> 
> It protects against recrusion blowing the stack because it removes the
> recursive call to unquote_comment(). ;)

Doh. Of course it does, I completely missed the removals.

> The "depth" stuff is there because without recursion, we have to know
> when we've hit the correct closing paren (as opposed to an embedded
> one).

Yes, makes sense now. The patches look good to me, thanks!

Patrick