godotengine
/
godot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[3.x] Core: Add recursion level check for `VariantWriter::write()` 

(cherry picked from commit 0213cbbf20)
This commit is contained in:
Danil Alexeev 2023-08-29 13:46:53 +03:00 committed by Rémi Verschelde
parent 930390a2fb
commit 442677a3f0
No known key found for this signature in database
GPG Key ID: C3336907360768E1
2 changed files with 28 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
core/variant_parser.cpp
View File

@ -1532,7 +1532,7 @@ static String rtos_fix(double p_value) {
} }
} }
Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_string_func, void *p_store_string_ud, EncodeResourceFunc p_encode_res_func, void *p_encode_res_ud) { Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_string_func, void *p_store_string_ud, EncodeResourceFunc p_encode_res_func, void *p_encode_res_ud, int p_recursion_count) {
switch (p_variant.get_type()) { switch (p_variant.get_type()) {
case Variant::NIL: { case Variant::NIL: {
p_store_string_func(p_store_string_ud, "null"); p_store_string_func(p_store_string_ud, "null");
@ -1649,6 +1649,13 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
} break; } break;
case Variant::OBJECT: { case Variant::OBJECT: {
if (unlikely(p_recursion_count > MAX_RECURSION)) {
ERR_PRINT("Max recursion reached");
p_store_string_func(p_store_string_ud, "null");
return OK;
}
p_recursion_count++;
Object *obj = p_variant; Object *obj = p_variant;
if (!obj) { if (!obj) {
@ -1698,7 +1705,7 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
} }
p_store_string_func(p_store_string_ud, "\"" + E->get().name + "\":"); p_store_string_func(p_store_string_ud, "\"" + E->get().name + "\":");
write(obj->get(E->get().name), p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud); write(obj->get(E->get().name), p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud, p_recursion_count);
} }
} }
@ -1707,6 +1714,13 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
} break; } break;
case Variant::DICTIONARY: { case Variant::DICTIONARY: {
if (unlikely(p_recursion_count > MAX_RECURSION)) {
ERR_PRINT("Max recursion reached");
p_store_string_func(p_store_string_ud, "{}");
return OK;
}
p_recursion_count++;
Dictionary dict = p_variant; Dictionary dict = p_variant;
List<Variant> keys; List<Variant> keys;
@ -1719,9 +1733,9 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
if (!_check_type(dict[E->get()])) if (!_check_type(dict[E->get()]))
continue; continue;
*/ */
write(E->get(), p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud); write(E->get(), p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud, p_recursion_count);
p_store_string_func(p_store_string_ud, ": "); p_store_string_func(p_store_string_ud, ": ");
write(dict[E->get()], p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud); write(dict[E->get()], p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud, p_recursion_count);
if (E->next()) { if (E->next()) {
p_store_string_func(p_store_string_ud, ",\n"); p_store_string_func(p_store_string_ud, ",\n");
} else { } else {
@ -1733,6 +1747,13 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
} break; } break;
case Variant::ARRAY: { case Variant::ARRAY: {
if (unlikely(p_recursion_count > MAX_RECURSION)) {
ERR_PRINT("Max recursion reached");
p_store_string_func(p_store_string_ud, "[]");
return OK;
}
p_recursion_count++;
p_store_string_func(p_store_string_ud, "[ "); p_store_string_func(p_store_string_ud, "[ ");
Array array = p_variant; Array array = p_variant;
int len = array.size(); int len = array.size();
@ -1740,7 +1761,7 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
if (i > 0) { if (i > 0) {
p_store_string_func(p_store_string_ud, ", "); p_store_string_func(p_store_string_ud, ", ");
} }
write(array[i], p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud); write(array[i], p_store_string_func, p_store_string_ud, p_encode_res_func, p_encode_res_ud, p_recursion_count);
} }
p_store_string_func(p_store_string_ud, " ]"); p_store_string_func(p_store_string_ud, " ]");
@ -1871,6 +1892,7 @@ Error VariantWriter::write(const Variant &p_variant, StoreStringFunc p_store_str
p_store_string_func(p_store_string_ud, " )"); p_store_string_func(p_store_string_ud, " )");
} break; } break;
default: { default: {
} }
} }

2
core/variant_parser.h
View File

@ -141,7 +141,7 @@ public:
typedef Error (*StoreStringFunc)(void *ud, const String &p_string); typedef Error (*StoreStringFunc)(void *ud, const String &p_string);
typedef String (*EncodeResourceFunc)(void *ud, const RES &p_resource); typedef String (*EncodeResourceFunc)(void *ud, const RES &p_resource);
static Error write(const Variant &p_variant, StoreStringFunc p_store_string_func, void *p_store_string_ud, EncodeResourceFunc p_encode_res_func, void *p_encode_res_ud); static Error write(const Variant &p_variant, StoreStringFunc p_store_string_func, void *p_store_string_ud, EncodeResourceFunc p_encode_res_func, void *p_encode_res_ud, int p_recursion_count = 0);
static Error write_to_string(const Variant &p_variant, String &r_string, EncodeResourceFunc p_encode_res_func = nullptr, void *p_encode_res_ud = nullptr); static Error write_to_string(const Variant &p_variant, String &r_string, EncodeResourceFunc p_encode_res_func = nullptr, void *p_encode_res_ud = nullptr);
}; };