srctree

Robin Linden parent c3e975d8 d956faed
uri: Fail parsing on input too large for std::regex

uri/uri.cpp added: 13, removed: 2, total 11

@@ -53,6 +53,12 @@ void complete_from_base_if_needed(Uri &uri, Uri const &base) {

} // namespace

std::optional<Uri> Uri::parse(std::string uristr, std::optional<std::reference_wrapper<Uri const>> base_uri) {

// https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164

// Fuzz-testing w/ libstdc++13 still breaks the stack if 2048 characters are allowed.

if (uristr.size() > 1024) {

return std::nullopt;

}

// Regex taken from RFC 3986.

std::smatch match;

std::regex const uri_regex{"^(([^:/?#]+):)?(//([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?"};

uri/uri_test.cpp added: 13, removed: 2, total 11

@@ -8,6 +8,7 @@

#include "etest/etest.h"

#include <optional>

#include <string>

using etest::expect;

using etest::expect_eq;

@@ -42,6 +43,10 @@ int main() {

expect_eq(Uri::parse(""), std::nullopt); //

});

etest::test("large uris don't explode libstdc++", [] {

expect_eq(Uri::parse(std::string(1025, ':')), std::nullopt); //

});

etest::test("https: user, pass, port, path, query", [] {

auto https_uri =

Uri::parse("https://zero-one:muh_password@example-domain.net:8080/muh/long/path.html?foo=bar").value();