core: fix infinite loop in evaluation of strings (closes #1183)

2 files changed, 25 insertions, 7 deletions

diff --git a/src/core/wee-eval.c b/src/core/wee-eval.c
index 6b5e41181..2cba33a22 100644
--- a/src/core/wee-eval.c
+++ b/src/core/wee-eval.c
@@ -717,14 +717,28 @@ char *
 eval_replace_vars (const char *expr, struct t_eval_context *eval_context)
 {
     const char *no_replace_prefix_list[] = { "if:", NULL };
+    char *result;
 
-    return string_replace_with_callback (expr,
-                                         eval_context->prefix,
-                                         eval_context->suffix,
-                                         no_replace_prefix_list,
-                                         &eval_replace_vars_cb,
-                                         eval_context,
-                                         NULL);
+    eval_context->recursion_count++;
+
+    if (eval_context->recursion_count < EVAL_RECURSION_MAX)
+    {
+        result = string_replace_with_callback (expr,
+                                               eval_context->prefix,
+                                               eval_context->suffix,
+                                               no_replace_prefix_list,
+                                               &eval_replace_vars_cb,
+                                               eval_context,
+                                               NULL);
+    }
+    else
+    {
+        result = strdup ("");
+    }
+
+    eval_context->recursion_count--;
+
+    return result;
 }
 
 /*
@@ -1253,6 +1267,7 @@ eval_expression (const char *expr, struct t_hashtable *pointers,
     eval_context.prefix = default_prefix;
     eval_context.suffix = default_suffix;
     eval_context.regex = NULL;
+    eval_context.recursion_count = 0;
 
     /*
      * set window/buffer with pointer to current window/buffer
diff --git a/src/core/wee-eval.h b/src/core/wee-eval.h
index 41e8fac7b..8522b9efa 100644
--- a/src/core/wee-eval.h
+++ b/src/core/wee-eval.h
@@ -28,6 +28,8 @@
 #define EVAL_DEFAULT_PREFIX "${"
 #define EVAL_DEFAULT_SUFFIX "}"
 
+#define EVAL_RECURSION_MAX  32
+
 struct t_hashtable;
 
 enum t_eval_logical_op
@@ -69,6 +71,7 @@ struct t_eval_context
     const char *prefix;
     const char *suffix;
     struct t_eval_regex *regex;
+    int recursion_count;
 };
 
 extern int eval_is_true (const char *value);