search

commonmark / cmark

CommonMark parsing and rendering library and program in C
Other
1.62k stars 539 forks source link

Quadratic behavior with inline HTML #379

Closed nwellnhof closed 3 years ago

nwellnhof commented 3 years ago

Parsing a sequence of certain HTML opening constructs results in quadratic behavior:

# Processing instruction
python3 -c 'print("a"+"<?"*50000)' |build/src/cmark >/dev/null
# Declaration
python3 -c 'print("a"+"<!D "*50000)' |build/src/cmark >/dev/null
# CDATA section
python3 -c 'print("a"+"<![CDATA["*50000)' |build/src/cmark >/dev/null

Possible fix: Don't try to reparse these constructs if the (fixed) character sequence required to terminate them wasn't found during the first scan.

Found by OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32344

nwellnhof commented 3 years ago

Oops, this was already reported as #299.