summaryrefslogtreecommitdiff
path: root/xfa/fxfa
diff options
context:
space:
mode:
Diffstat (limited to 'xfa/fxfa')
-rw-r--r--xfa/fxfa/fm2js/xfa_error.cpp2
-rw-r--r--xfa/fxfa/fm2js/xfa_error.h1
-rw-r--r--xfa/fxfa/fm2js/xfa_fmparse.cpp12
3 files changed, 15 insertions, 0 deletions
diff --git a/xfa/fxfa/fm2js/xfa_error.cpp b/xfa/fxfa/fm2js/xfa_error.cpp
index 9ca886954a..1d31ce6958 100644
--- a/xfa/fxfa/fm2js/xfa_error.cpp
+++ b/xfa/fxfa/fm2js/xfa_error.cpp
@@ -15,3 +15,5 @@ const wchar_t kFMErrExpectedEndIf[] = L"expected 'endif' instead of '%s'";
const wchar_t kFMErrUnexpectedExpression[] = L"unexpected expression '%s'";
const wchar_t kFMErrExpectedNonEmptyExpression[] =
L"expected non-empty expression";
+const wchar_t kFMErrLongAssignmentChain[] =
+ L"long assignment chains are unsupported";
diff --git a/xfa/fxfa/fm2js/xfa_error.h b/xfa/fxfa/fm2js/xfa_error.h
index d6bb72bb34..b6621da440 100644
--- a/xfa/fxfa/fm2js/xfa_error.h
+++ b/xfa/fxfa/fm2js/xfa_error.h
@@ -17,6 +17,7 @@ extern const wchar_t kFMErrExpectedToken[];
extern const wchar_t kFMErrExpectedEndIf[];
extern const wchar_t kFMErrUnexpectedExpression[];
extern const wchar_t kFMErrExpectedNonEmptyExpression[];
+extern const wchar_t kFMErrLongAssignmentChain[];
class CXFA_FMErrorInfo {
public:
diff --git a/xfa/fxfa/fm2js/xfa_fmparse.cpp b/xfa/fxfa/fm2js/xfa_fmparse.cpp
index 09e8f36298..c1f609315b 100644
--- a/xfa/fxfa/fm2js/xfa_fmparse.cpp
+++ b/xfa/fxfa/fm2js/xfa_fmparse.cpp
@@ -12,6 +12,12 @@
#include "third_party/base/ptr_util.h"
+namespace {
+
+const int kMaxAssignmentChainLength = 12;
+
+} // namespace
+
CXFA_FMParse::CXFA_FMParse(const CFX_WideStringC& wsFormcalc,
CXFA_FMErrorInfo* pErrorInfo)
: m_pToken(nullptr), m_pErrorInfo(pErrorInfo) {
@@ -208,9 +214,12 @@ std::unique_ptr<CXFA_FMExpression> CXFA_FMParse::ParseVarExpression() {
std::unique_ptr<CXFA_FMSimpleExpression> CXFA_FMParse::ParseSimpleExpression() {
uint32_t line = m_pToken->m_uLinenum;
std::unique_ptr<CXFA_FMSimpleExpression> pExp1 = ParseLogicalOrExpression();
+ int level = 1;
while (m_pToken->m_type == TOKassign) {
NextToken();
std::unique_ptr<CXFA_FMSimpleExpression> pExp2 = ParseLogicalOrExpression();
+ if (level++ == kMaxAssignmentChainLength)
+ Error(m_pToken->m_uLinenum, kFMErrLongAssignmentChain);
if (m_pErrorInfo->message.IsEmpty()) {
pExp1 = pdfium::MakeUnique<CXFA_FMAssignExpression>(
line, TOKassign, std::move(pExp1), std::move(pExp2));
@@ -776,9 +785,12 @@ std::unique_ptr<CXFA_FMSimpleExpression> CXFA_FMParse::ParseParenExpression() {
uint32_t line = m_pToken->m_uLinenum;
std::unique_ptr<CXFA_FMSimpleExpression> pExp1 = ParseLogicalOrExpression();
+ int level = 1;
while (m_pToken->m_type == TOKassign) {
NextToken();
std::unique_ptr<CXFA_FMSimpleExpression> pExp2 = ParseLogicalOrExpression();
+ if (level++ == kMaxAssignmentChainLength)
+ Error(m_pToken->m_uLinenum, kFMErrLongAssignmentChain);
if (m_pErrorInfo->message.IsEmpty()) {
pExp1 = pdfium::MakeUnique<CXFA_FMAssignExpression>(
line, TOKassign, std::move(pExp1), std::move(pExp2));