Skip to content

gvariant-parser: Reject deeply-nested typedecls in text form variants

Return G_VARIANT_PARSE_ERROR_RECURSION from g_variant_parse() if a typedecl is found within a text-form variant which would cause any part of the variant to exceed the maximum allowed recursion/nesting depth.

This fixes an oversight when G_VARIANT_MAX_RECURSION_DEPTH was implemented, which allowed typedecls to effectively multiply the size of an array if g_variant_parse() was parsing a text-form variant without a top-level concrete type specified.

Signed-off-by: Philip Withnall pwithnall@endlessos.org

Fixes: #2782 (closed) oss-fuzz#49462

Closes #2782 (closed)

Merge request reports