Skip to content

Parser stack overflow: deeply-nested source causes SIGSEGV instead of SyntaxError #7655

@changjoon-park

Description

@changjoon-park

Summary

Parsing deeply-nested Python source (brackets, parens, etc.) crashes the interpreter with SIGSEGV at ~4000 levels of nesting. CPython caps this at 200 via SyntaxError: too many nested parentheses from the parser's internal depth limit.

The crash is in the parser itself (rustpython-ruff_python_parser 0.15.8): compile(src, '<s>', 'exec') (parser + codegen, does NOT go through _ast::ast_to_object) and ast.parse() crash at the identical depth threshold, showing the shared component is the parser, not post-parse conversion.

This is the parser-layer root cause of the class of bugs tracked in #2796. #4857 also still reproduces on current main (closed as fixed in 2023).

Expected

Matches CPython 3.13.4 behavior:

$ python3 -c "import ast; ast.parse('[' * 5000 + '1' + ']' * 5000)"
Traceback (most recent call last):
  ...
SyntaxError: too many nested parentheses (<unknown>, line 1)

(CPython's parser rejects at depth 201 via a hard-coded limit, well before the native stack is exhausted.)

Actual

$ rustpython -c "import ast; ast.parse('[' * 5000 + '1' + ']' * 5000)"
[no output, exit 139 — SIGSEGV]

$ rustpython -c "src="proxy.php?url=https%3A%2F%2Fgithub.com%2FRustPython%2FRustPython%2Fissues%2F%5B"*5000+'1'+']'*5000; compile(src,'<s>','exec')"
[no output, exit 139 — SIGSEGV]

# #4857's original reproducer also still crashes:
$ rustpython -c "import ast; ast.parse('+chr(33)' * 1000000)"
[no output, exit 139]

Threshold

Depth compile() ast.parse()
3000 ok ok
4000 SIGSEGV SIGSEGV
15000 SIGSEGV SIGSEGV

Identical thresholds confirm the crash is in the parser, not in post-parse conversion.

Relation to prior fixes

Both fixes live downstream of the parser. The parser's own recursive descent has no depth guard, so any Python source deeply nested in brackets, parens, unary ops, or binary ops reaches the native stack limit first.

Environment

  • RustPython main @ 5a45d41d (parser: rustpython-ruff_python_parser 0.15.8)
  • Compared against: CPython 3.13.4
  • macOS 15.1 / Darwin 24.1.0
  • Rust release build

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions