Skip to content

imap-parser-nesting-limit#282

Closed
uwezkhan wants to merge 2 commits intodovecot:mainfrom
uwezkhan:imap-parser-nesting-limit
Closed

imap-parser-nesting-limit#282
uwezkhan wants to merge 2 commits intodovecot:mainfrom
uwezkhan:imap-parser-nesting-limit

Conversation

@uwezkhan
Copy link
Copy Markdown
Contributor

@uwezkhan uwezkhan commented May 2, 2026

The IMAP parser currently tracks list_count_limit, but nested list depth is only constrained after lists are closed. This means deeply nested input can still build a large recursive imap_arg tree before the limit is enforced.

Several downstream imap_arg consumers traverse these structures recursively, so excessively deep nesting may lead to stack exhaustion.

This change adds proactive nesting-depth enforcement when opening lists by:

  • tracking current nesting depth during parsing
  • rejecting input once nesting exceeds the configured list_count_limit
  • applying a hard safety ceiling of 100 levels to protect recursive consumers even if a higher limit is configured

The hard ceiling is intentionally conservative and aligns with similar nesting limits elsewhere in the codebase.

Tests are included for both:

  • the default hard nesting ceiling
  • custom list_count_limit enforcement

@cmouse
Copy link
Copy Markdown
Contributor

cmouse commented May 8, 2026

fixed with 9a0f8c1

@cmouse cmouse closed this May 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants