@@ -286,6 +286,8 @@ yaml_parser_load_scalar(yaml_parser_t *parser, yaml_event_t *first_event)
286 int index;
286 int index;
287 yaml_char_t *tag = first_event->data.scalar.tag;
287 yaml_char_t *tag = first_event->data.scalar.tag;
289+ if (!STACK_LIMIT(parser, parser->document->nodes, INT_MAX-1)) goto error;
289 if (!tag || strcmp((char *)tag, "!") == 0) {
291 if (!tag || strcmp((char *)tag, "!") == 0) {
290 yaml_free(tag);
292 yaml_free(tag);
291 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_SCALAR_TAG);
293 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_SCALAR_TAG);
@@ -329,6 +331,8 @@ yaml_parser_load_sequence(yaml_parser_t *parser, yaml_event_t *first_event)
329 int index, item_index;
331 int index, item_index;
330 yaml_char_t *tag = first_event->data.sequence_start.tag;
332 yaml_char_t *tag = first_event->data.sequence_start.tag;
334+ if (!STACK_LIMIT(parser, parser->document->nodes, INT_MAX-1)) goto error;
332 if (!tag || strcmp((char *)tag, "!") == 0) {
336 if (!tag || strcmp((char *)tag, "!") == 0) {
333 yaml_free(tag);
337 yaml_free(tag);
334 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_SEQUENCE_TAG);
338 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_SEQUENCE_TAG);
@@ -351,6 +355,9 @@ yaml_parser_load_sequence(yaml_parser_t *parser, yaml_event_t *first_event)
351 if (!yaml_parser_parse(parser, &event)) return 0;
355 if (!yaml_parser_parse(parser, &event)) return 0;
353 while (event.type != YAML_SEQUENCE_END_EVENT) {
357 while (event.type != YAML_SEQUENCE_END_EVENT) {
358+ if (!STACK_LIMIT(parser,
359+ parser->document->nodes.start[index-1].data.sequence.items,
360+ INT_MAX-1)) return 0;
354 item_index = yaml_parser_load_node(parser, &event);
361 item_index = yaml_parser_load_node(parser, &event);
355 if (!item_index) return 0;
362 if (!item_index) return 0;
356 if (!PUSH(parser,
363 if (!PUSH(parser,
@@ -387,6 +394,8 @@ yaml_parser_load_mapping(yaml_parser_t *parser, yaml_event_t *first_event)
387 yaml_node_pair_t pair;
394 yaml_node_pair_t pair;
388 yaml_char_t *tag = first_event->data.mapping_start.tag;
395 yaml_char_t *tag = first_event->data.mapping_start.tag;
397+ if (!STACK_LIMIT(parser, parser->document->nodes, INT_MAX-1)) goto error;
390 if (!tag || strcmp((char *)tag, "!") == 0) {
399 if (!tag || strcmp((char *)tag, "!") == 0) {
391 yaml_free(tag);
400 yaml_free(tag);
392 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_MAPPING_TAG);
401 tag = yaml_strdup((yaml_char_t *)YAML_DEFAULT_MAPPING_TAG);
@@ -409,6 +418,9 @@ yaml_parser_load_mapping(yaml_parser_t *parser, yaml_event_t *first_event)
409 if (!yaml_parser_parse(parser, &event)) return 0;
418 if (!yaml_parser_parse(parser, &event)) return 0;
411 while (event.type != YAML_MAPPING_END_EVENT) {
420 while (event.type != YAML_MAPPING_END_EVENT) {
421+ if (!STACK_LIMIT(parser,
422+ parser->document->nodes.start[index-1].data.mapping.pairs,
423+ INT_MAX-1)) return 0;
412 pair.key = yaml_parser_load_node(parser, &event);
424 pair.key = yaml_parser_load_node(parser, &event);
413 if (!pair.key) return 0;
425 if (!pair.key) return 0;
414 if (!yaml_parser_parse(parser, &event)) return 0;
426 if (!yaml_parser_parse(parser, &event)) return 0;