diff --git a/crates/wast/src/ast/types.rs b/crates/wast/src/ast/types.rs index 1b8c828501..5b209a2618 100644 --- a/crates/wast/src/ast/types.rs +++ b/crates/wast/src/ast/types.rs @@ -617,6 +617,11 @@ pub struct ModuleType<'a> { impl<'a> Parse<'a> for ModuleType<'a> { fn parse(parser: Parser<'a>) -> Result { + // See comments in `nested_module.rs` for why this is tested here. + if parser.parens_depth() > 100 { + return Err(parser.error("module type nesting too deep")); + } + let mut imports = Vec::new(); while parser.peek2::() { imports.push(parser.parens(|p| p.parse())?); @@ -658,6 +663,11 @@ pub struct InstanceType<'a> { impl<'a> Parse<'a> for InstanceType<'a> { fn parse(parser: Parser<'a>) -> Result { + // See comments in `nested_module.rs` for why this is tested here. + if parser.parens_depth() > 100 { + return Err(parser.error("instance type nesting too deep")); + } + let mut exports = Vec::new(); while !parser.is_empty() { exports.push(parser.parens(|p| p.parse())?); diff --git a/tests/local/deep.wast b/tests/local/deep.wast new file mode 100644 index 0000000000..04f8705b95 --- /dev/null +++ b/tests/local/deep.wast @@ -0,0 +1,106 @@ +(assert_malformed (module quote + + "(import\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + "(export\"\"(instance (export\"\"(instance (export\"\"(instance (export\"\"(instance" + ) + "nesting too deep")