Skip to content

Conversation

spyoungtech
Copy link
Owner

This change adds a limit to the nesting depth by default to guard against stack overflow in cases where arrays and/or objects are deeply nested.

Additionally, a new feature, unlimited_depth has been added (disabled by default) as an easy way for users to bypass this limit.

JSON5Parser structs also have a new constructor with_max_depth to allow a parser to be constructed with a user-specified max depth.

The default limit aims to prevent stack overflows in most normal circumstances on tier 1 operating systems. Some targets with extremely limited stack space may still experience stack overflows. The limit is adjusted based on operating system and the presence of the debug_assertions configuration, intended to allow higher default limits for release builds.

At time of writing, the default limit is as follows:

Operating System Depth limit with debug_assertions Depth limit without debug_assersions
Windows 700 2000
All other OS 1000 3000
@spyoungtech
Copy link
Owner Author

Because parse_unary is also implemented recursively, the depth limit also applies to unary signs.

@spyoungtech
Copy link
Owner Author

Actually it seems like nested unary operators are actually not allowed, so nesting limit does not need changes in parse_unary. A separate PR should fix this to return an error when multiple unary signs are encountered.

@spyoungtech spyoungtech merged commit e022239 into main Jun 30, 2025
2 checks passed
@spyoungtech spyoungtech deleted the fix-stack-overflow branch June 30, 2025 22:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant