fengyue-xve opened a new pull request, #2621: URL: https://github.com/apache/datafusion-sqlparser-rs/pull/2621
`Parser::with_recursion_limit` did not bound flat set-operation chains. `parse_remaining_set_exprs` folds `UNION`/`INTERSECT`/`EXCEPT` chains iteratively, so parsing never recurses — but every fold still nests the AST one level deeper, and a chain of any length was accepted: ```sql SELECT 1 UNION ALL SELECT 1 UNION ALL ...; -- 1000 terms: parses without error on main ``` The resulting statement can then not be walked recursively: `to_string()` overflows the stack (reproduced locally: a 50,000-term chain on a 2 MB thread dies with `STATUS_STACK_OVERFLOW`), and derived `Clone`, visitors and plan builders hit the same wall. This crashed a downstream database on well-formed input — GreptimeDB/greptimedb#9356 (fix proposed in GreptimeDB/greptimedb#9506). This reserves one level of recursion budget per folded operator, holding the guards until the set expression has been parsed. Chains longer than the limit now fail with `ParserError::RecursionLimitExceeded`; shorter ones are unaffected, and the limit stays adjustable via `with_recursion_limit`. Related to #2440, which deliberately leaves `parse_remaining_set_exprs` uncounted — correct for the parser's own recursion budget, since the fold is iterative. This PR additionally bounds the nesting of the produced AST, which recursive consumers have no other protection against. Tests: `parse_with_recursion_limit_counts_set_operation_folds` (a 100-term chain is rejected at the default limit; 10 terms still parse; an explicit limit of 20 rejects 30 terms) and `set_operation_chains_hit_recursion_limit_without_default_features` in `tests/no_std_recursion.rs`. --- This PR was prepared with AI assistance. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
