[Security] Unbounded recursion in src/eval.c parser causes stack exhaustion

Zhihan Zheng <[email protected]> Mon, 16 Mar 2026 21:05:57 +0800
Newsgroups gmane.comp.gnu.m4.bugs
Message-ID <TYRP301MB14277AD85F302D350A64C154D140A@TYRP301MB1427.JPNP301.PROD.OUTLOOK.COM>
Hello GNU m4 Maintainer,

I would like to report a potential security issue in m4 1.4.21.

The issue is in the eval parser in src/eval.c. The parser recursively 
calls primary() on nested parentheses and unary operators:

```c
case LEFTP:
   er = primary (v1);
   er = parse_expr (v1, er, MIN_PREC);

case PLUS:
   return primary (v1);
case MINUS:
   er = primary (v1);
```

There appears to be no recursion-depth limit on this path. A deeply 
nested expression can therefore exhaust the process stack and crash.

Affected area:
- src/eval.c:311-372

If useful, I can provide a minimal PoC and reproduction output.

If you believe this is a valid security issue, please let me know your 
preferred remediation or coordinated disclosure process. If needed, I 
can also assist with CVE coordination after triage.

-- 
Best regards,
Zhihan Zheng
Beijing Institute of Technology