fix: bound JSON nesting depth to prevent stack overflow (#540) - #546
Open
slsgzs-cloud wants to merge 3 commits into
Open
fix: bound JSON nesting depth to prevent stack overflow (#540)#546slsgzs-cloud wants to merge 3 commits into
slsgzs-cloud wants to merge 3 commits into
Conversation
Member
|
The implementation direction looks good, but both #538 and #540 explicitly require regression coverage. Could you add tests for the acceptance cases before we merge this? For #540, please cover array/object/alternating nesting around the chosen depth limit and verify overly deep input returns an error rather than crashing. For #538, please cover successful stderr containing the failure sentinels, expected non-zero exits, and a genuine compiler failure so we know removing the stderr heuristic does not hide producer failures. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two fixes in this PR:
Fix 1: Bound JSON nesting depth to prevent stack overflow (#540)
parse_value recursively calls parse_array/parse_object without tracking a depth limit. Nested metadata can consume call stack proportional to input nesting.
Fix 2: Stop classifying valid program stderr as compiler failure (#538)
run_and_classify checked looks_like_fail(result.stderr) before comparing the expected exit status. Any stderr containing phrases such as stack overflow, SyntaxError, or error[E was rejected, even when the program deliberately printed that text and exited with the expected status.
Fix: check exit code first. If the program exits with the expected status, it succeeded — don't reject based on stderr content alone. The compiler/child output is combined, so a real compiler failure would show as a non-zero exit code, not just stderr text.