Add recursion checks for parse_interval - #2422
Open
shuvamk wants to merge 1 commit into
Open
Conversation
`SELECT INTERVAL INTERVAL INTERVAL ... 1` (600 levels, ~5 KB) aborts the process with `fatal runtime error: stack overflow` on a 2 MiB stack instead of returning `ParserError::RecursionLimitExceeded`. In Rust a stack overflow is `abort()`, not a panic, so a consumer parsing untrusted SQL cannot contain it. For dialects where `require_interval_qualifier()` is false, `parse_interval` calls `parse_prefix` directly rather than `parse_expr`, so it bypasses the counter that lives in `parse_subexpr`. `parse_prefix` re-enters `parse_interval` on the next INTERVAL keyword, leaving the cycle unguarded. Reproduced on generic, duckdb, snowflake and postgres. Apply the same guards used for the parenthesis gap in apache#2199: the recursion counter plus `recursive::recursive` under the `recursive-protection` feature. Test in tests/sqlparser_common.rs alongside the other recursion-limit tests. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
LucaCappelletti94
approved these changes
Aug 4, 2026
LucaCappelletti94
left a comment
LucaCappelletti94
left a comment
Contributor
There was a problem hiding this comment.
Looks sensible.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This aborts the process with
fatal runtime error: stack overflowon a 2 MiB stack(the default for a spawned thread) instead of returning
RecursionLimitExceeded.For dialects where
require_interval_qualifier()is false,parse_intervalcallsparse_prefixdirectly rather thanparse_expr, so it never passes through therecursion counter that lives in
parse_subexpr.parse_prefixre-entersparse_intervalon the next INTERVAL keyword, leaving that cycle unguarded.Reproduced on generic, duckdb, snowflake and postgres.
The fix applies the same two guards #2199 used for the parenthesis gap; the 600-level
input then returns
Err(RecursionLimitExceeded).Test added beside the existing recursion-limit tests in
tests/sqlparser_common.rs.Without the parser change it fails as a stack-overflow abort. Same defect class as
#2411, on a different path.