fix: bound array and inline table nesting depth to prevent stack-overflow DoS (#1092)

Author: pelletier

unmarshaler_test.go

@@ -2588,6 +2588,53 @@ func TestUnmarshalErrors(t *testing.T) {
 	assert.Equal(t, "toml: cannot decode TOML integer into struct field toml_test.mystruct.Bar of type string", err.Error())
 }
 
+// TestUnmarshalDeeplyNestedValues checks that deeply nested arrays and inline
+// tables are rejected with an ordinary error through the stable API, rather
+// than overflowing the goroutine stack (an unrecoverable fatal error that no
+// recover() can intercept and that would terminate the whole process).
+func TestUnmarshalDeeplyNestedValues(t *testing.T) {
+	// Far beyond the parser's nesting limit, so this must error, not crash.
+	const depth = 100000
+
+	examples := []struct {
+		desc  string
+		input string
+	}{
+		{
+			desc:  "arrays",
+			input: "a=" + strings.Repeat("[", depth) + strings.Repeat("]", depth),
+		},
+		{
+			desc:  "inline tables",
+			input: "a=" + strings.Repeat("{k=", depth) + "1" + strings.Repeat("}", depth),
+		},
+	}
+
+	for _, e := range examples {
+		t.Run("Unmarshal/"+e.desc, func(t *testing.T) {
+			var v interface{}
+			err := toml.Unmarshal([]byte(e.input), &v)
+			assert.Error(t, err)
+		})
+
+		t.Run("Decode/"+e.desc, func(t *testing.T) {
+			var v interface{}
+			err := toml.NewDecoder(strings.NewReader(e.input)).Decode(&v)
+			assert.Error(t, err)
+		})
+	}
+
+	// A modestly nested document must still decode without error: the guard
+	// only rejects pathologically deep input.
+	t.Run("valid nesting still decodes", func(t *testing.T) {
+		const n = 100
+		var v interface{}
+		input := "a=" + strings.Repeat("[", n) + strings.Repeat("]", n)
+		err := toml.Unmarshal([]byte(input), &v)
+		assert.NoError(t, err)
+	})
+}
+
 func TestUnmarshalStringInvalidStructField(t *testing.T) {
 	type Server struct {
 		Path string

unstable/parser.go

@@ -55,8 +55,21 @@ type Parser struct {
 	left  []byte
 	nodes []Node
 	err   error
+
+	// nesting is the current depth of nested arrays and inline tables being
+	// parsed. It guards parseVal/parseValArray/parseInlineTable against
+	// unbounded mutual recursion, which would otherwise let a deeply nested
+	// document overflow the goroutine stack (an unrecoverable fatal error).
+	nesting int
 }
 
+// maxValueNesting is the maximum depth of nested arrays and inline tables the
+// parser accepts. Beyond it, parsing fails with a ParserError instead of
+// risking a stack overflow. Real-world TOML documents nest only a handful of
+// levels deep, so this bound is generous; it matches the limit used by the
+// standard library's encoding/json.
+const maxValueNesting = 10000
+
 // Data returns the slice provided to the last call to Reset.
 func (p *Parser) Data() []byte {
 	return p.data
@@ -92,6 +105,7 @@ func (p *Parser) Reset(b []byte) {
 	p.left = b
 	p.nodes = p.nodes[:0]
 	p.err = nil
+	p.nesting = 0
 }
 
 // Error returns any error that has occurred during parsing.
@@ -513,10 +527,24 @@ func (p *Parser) parseVal(b []byte) (int32, []byte, error) {
 		return p.parseKeyword(b, "inf", Float)
 	case c == 'n':
 		return p.parseKeyword(b, "nan", Float)
-	case c == '[':
-		return p.parseValArray(b)
-	case c == '{':
-		return p.parseInlineTable(b)
+	case c == '[' || c == '{':
+		// Arrays and inline tables recurse back into parseVal for each of
+		// their elements. Bound that recursion so a document with millions of
+		// nested brackets or braces cannot overflow the goroutine stack.
+		if p.nesting >= maxValueNesting {
+			return 0, nil, NewParserError(b[:1], "arrays and inline tables are nested more than the maximum of %d levels deep", maxValueNesting)
+		}
+		p.nesting++
+		var h int32
+		var rest []byte
+		var err error
+		if c == '[' {
+			h, rest, err = p.parseValArray(b)
+		} else {
+			h, rest, err = p.parseInlineTable(b)
+		}
+		p.nesting--
+		return h, rest, err
 	case c == '+' || c == '-':
 		return p.parseIntOrFloat(b)
 	case c >= '0' && c <= '9':