Tags: git-pkgs/spdx
Tags
Add input length cap and parenthesis depth limit to expression parser (… …#13) parseAtom recurses into parseExpression on each open parenthesis with no depth bound, so a long run of '(' overflows the goroutine stack and fatally crashes the process. Adds a depth counter on the parser struct checked on each open paren, and a 1 MiB input length cap at the top of Parse and ParseStrict. Both return ErrExpressionTooLarge.