Fix stack smashing by converting recursion to iteration

src/cm.rs

@@ -204,16 +204,25 @@ impl<'a, 'o> CommonMarkFormatter<'a, 'o> {
         self.need_cr = max(self.need_cr, 2);
     }
 
-    fn format_children(&mut self, node: &'a AstNode<'a>) {
-        for n in node.children() {
-            self.format(n);
-        }
-    }
-
     fn format(&mut self, node: &'a AstNode<'a>) {
-        if self.format_node(node, true) {
-            self.format_children(node);
-            self.format_node(node, false);
+
+        enum Phase { Pre, Post }
+        let mut stack = vec![(node, Phase::Pre)];
+
+        while let Some((node, phase)) = stack.pop() {
+            match phase {
+                Phase::Pre => {
+                    if self.format_node(node, true) {
+                        stack.push((node, Phase::Post));
+                        for ch in node.reverse_children() {
+                            stack.push((ch, Phase::Pre));
+                        }
+                    }
+                }
+                Phase::Post => {
+                    self.format_node(node, false);
+                }
+            }
         }
     }
 

src/html.rs

@@ -254,31 +254,48 @@ impl<'o> HtmlFormatter<'o> {
         Ok(())
     }
 
-    fn format_children<'a>(&mut self, node: &'a AstNode<'a>, plain: bool) -> io::Result<()> {
-        for n in node.children() {
-            try!(self.format(n, plain));
-        }
-        Ok(())
-    }
-
     fn format<'a>(&mut self, node: &'a AstNode<'a>, plain: bool) -> io::Result<()> {
-        if plain {
-            match node.data.borrow().value {
-                NodeValue::Text(ref literal)
-                | NodeValue::Code(ref literal)
-                | NodeValue::HtmlInline(ref literal) => {
-                    try!(self.escape(literal));
+        // Traverse the AST iteratively using a work stack, with pre- and
+        // post-child-traversal phases. During pre-order traversal render the
+        // opening tags, then push the node back onto the stack for the
+        // post-order traversal phase, then push the children in reverse order
+        // onto the stack and begin rendering first child.
+
+        enum Phase { Pre, Post }
+        let mut stack = vec![(node, plain, Phase::Pre)];
+
+        while let Some((node, plain, phase)) = stack.pop() {
+            match phase {
+                Phase::Pre => {
+                    let new_plain;
+                    if plain {
+                        match node.data.borrow().value {
+                            NodeValue::Text(ref literal)
+                            | NodeValue::Code(ref literal)
+                            | NodeValue::HtmlInline(ref literal) => {
+                                try!(self.escape(literal));
+                            }
+                            NodeValue::LineBreak | NodeValue::SoftBreak => {
+                                try!(self.output.write_all(b" "));
+                            }
+                            _ => (),
+                        }
+                        new_plain = plain;
+                    }
+                    else {
+                        stack.push((node, false, Phase::Post));
+                        new_plain = try!(self.format_node(node, true));
+                    }
+
+                    for ch in node.reverse_children() {
+                        stack.push((ch, new_plain, Phase::Pre));
+                    }
                 }
-                NodeValue::LineBreak | NodeValue::SoftBreak => {
-                    try!(self.output.write_all(b" "));
+                Phase::Post => {
+                    debug_assert!(!plain);
+                    try!(self.format_node(node, false));
                 }
-                _ => (),
             }
-            try!(self.format_children(node, true));
-        } else {
-            let new_plain = try!(self.format_node(node, true));
-            try!(self.format_children(node, new_plain));
-            try!(self.format_node(node, false));
         }
 
         Ok(())

src/parser/mod.rs

@@ -1173,12 +1173,10 @@ impl<'a, 'o> Parser<'a, 'o> {
     }
 
     fn process_inlines_node(&mut self, node: &'a AstNode<'a>) {
-        if node.data.borrow().value.contains_inlines() {
-            self.parse_inlines(node);
-        }
-
-        for n in node.children() {
-            self.process_inlines_node(n);
+        for node in node.descendants() {
+            if node.data.borrow().value.contains_inlines() {
+                self.parse_inlines(node);
+            }
         }
     }
 
@@ -1275,45 +1273,54 @@ impl<'a, 'o> Parser<'a, 'o> {
     }
 
     fn postprocess_text_nodes(&mut self, node: &'a AstNode<'a>) {
-        let mut nch = node.first_child();
-
-        while let Some(n) = nch {
-            let mut this_bracket = false;
-            loop {
-                match n.data.borrow_mut().value {
-                    NodeValue::Text(ref mut root) => {
-                        let ns = match n.next_sibling() {
-                            Some(ns) => ns,
-                            _ => {
-                                self.postprocess_text_node(n, root);
-                                break;
-                            }
-                        };
-
-                        match ns.data.borrow().value {
-                            NodeValue::Text(ref adj) => {
-                                root.extend_from_slice(adj);
-                                ns.detach();
-                            }
-                            _ => {
-                                self.postprocess_text_node(n, root);
-                                break;
+        let mut stack = vec![node];
+        let mut children = vec![];
+
+        while let Some(node) = stack.pop() {
+            let mut nch = node.first_child();
+
+            while let Some(n) = nch {
+                let mut this_bracket = false;
+                loop {
+                    match n.data.borrow_mut().value {
+                        NodeValue::Text(ref mut root) => {
+                            let ns = match n.next_sibling() {
+                                Some(ns) => ns,
+                                _ => {
+                                    self.postprocess_text_node(n, root);
+                                    break;
+                                }
+                            };
+
+                            match ns.data.borrow().value {
+                                NodeValue::Text(ref adj) => {
+                                    root.extend_from_slice(adj);
+                                    ns.detach();
+                                }
+                                _ => {
+                                    self.postprocess_text_node(n, root);
+                                    break;
+                                }
                             }
                         }
+                        NodeValue::Link(..) | NodeValue::Image(..) => {
+                            this_bracket = true;
+                            break;
+                        }
+                        _ => break,
                     }
-                    NodeValue::Link(..) | NodeValue::Image(..) => {
-                        this_bracket = true;
-                        break;
-                    }
-                    _ => break,
                 }
-            }
 
-            if !this_bracket {
-                self.postprocess_text_nodes(n);
+                if !this_bracket {
+                    children.push(n);
+                }
+
+                nch = n.next_sibling();
             }
 
-            nch = n.next_sibling();
+            // Push children onto work stack in reverse order so they are
+            // traversed in order
+            stack.extend(children.drain(..).rev());
         }
     }
 

src/tests.rs

@@ -797,3 +797,21 @@ fn nested_tables_3() {
         |opts| opts.ext_table = true,
     );
 }
+
+#[test]
+fn no_stack_smash_html() {
+    let s: String = ::std::iter::repeat('>').take(150_000).collect();
+    let arena = Arena::new();
+    let root = parse_document(&arena, &s, &ComrakOptions::default());
+    let mut output = vec![];
+    html::format_document(root, &ComrakOptions::default(), &mut output).unwrap()
+}
+
+#[test]
+fn no_stack_smash_cm() {
+    let s: String = ::std::iter::repeat('>').take(150_000).collect();
+    let arena = Arena::new();
+    let root = parse_document(&arena, &s, &ComrakOptions::default());
+    let mut output = vec![];
+    cm::format_document(root, &ComrakOptions::default(), &mut output).unwrap()
+}