Change types for source map offsets (#174)

* Improve strbuf guarantees

Introduce BUFSIZE_MAX macro and make sure that the strbuf implementation
can handle strings up to this size.

* Abort early if document size exceeds internal limit

* Change types for source map offsets

Switch to size_t for the public API, making the public headers
C89-compatible again.

Switch to bufsize_t internally, reducing memory usage and improving
performance on 32-bit platforms.

* Make parser return NULL on internal index overflow

Make S_parser_feed set an error and ignore subsequent chunks if the
total input document size exceeds an internal limit. Make
cmark_parser_finish return NULL if an error was encountered. Add
public API functions to retrieve error code and error message.

strbuf overflow in renderers and OOM in parser or renderers still
cause an abort.

1 files changed, 37 insertions, 0 deletions

diff --git a/api_test/main.c b/api_test/main.c
index 17e1582..61291dc 100644
--- a/api_test/main.c
+++ b/api_test/main.c
@@ -5,6 +5,7 @@
 #define CMARK_NO_SHORT_NAMES
 #include "cmark.h"
 #include "node.h"
+#include "parser.h"
 
 #include "harness.h"
 #include "cplusplus.h"
@@ -883,6 +884,41 @@ static void test_feed_across_line_ending(test_batch_runner *runner) {
   cmark_node_free(document);
 }
 
+static cmark_node *S_parse_with_fake_total(bufsize_t fake_total,
+                                           const char *str,
+                                           cmark_err_type *err) {
+  cmark_parser *parser = cmark_parser_new(CMARK_OPT_DEFAULT);
+  parser->total_bytes = fake_total;
+  cmark_parser_feed(parser, str, strlen(str));
+  cmark_node *doc = cmark_parser_finish(parser);
+  *err = cmark_parser_get_error(parser);
+  cmark_parser_free(parser);
+  return doc;
+}
+
+static void test_bufsize_overflow(test_batch_runner *runner) {
+  cmark_node *doc;
+  cmark_err_type err;
+
+  doc = S_parse_with_fake_total(BUFSIZE_MAX, "a", &err);
+  OK(runner, doc == NULL, "parse 1 byte after BUFSIZE_MAX bytes fails");
+  INT_EQ(runner, err, CMARK_ERR_INPUT_TOO_LARGE,
+         "parse 1 byte after BUFSIZE_MAX bytes error code");
+
+  doc = S_parse_with_fake_total(BUFSIZE_MAX - 9, "0123456789", &err);
+  OK(runner, doc == NULL, "parse 10 byte after BUFSIZE_MAX-9 bytes fails");
+  INT_EQ(runner, err, CMARK_ERR_INPUT_TOO_LARGE,
+         "parse 10 byte after BUFSIZE_MAX-9 bytes error code");
+
+  doc = S_parse_with_fake_total(BUFSIZE_MAX - 1, "a", &err);
+  OK(runner, doc != NULL, "parse 1 byte after BUFSIZE_MAX-1 bytes");
+  cmark_node_free(doc);
+
+  doc = S_parse_with_fake_total(BUFSIZE_MAX - 10, "0123456789", &err);
+  OK(runner, doc != NULL, "parse 10 byte after BUFSIZE_MAX-10 bytes");
+  cmark_node_free(doc);
+}
+
 int main() {
   int retval;
   test_batch_runner *runner = test_batch_runner_new();
@@ -908,6 +944,7 @@ int main() {
   test_cplusplus(runner);
   test_safe(runner);
   test_feed_across_line_ending(runner);
+  test_bufsize_overflow(runner);
 
   test_print_summary(runner);
   retval = test_ok(runner) ? 0 : 1;