Baike.dev
Log in
Back to tool/Back to issues
#4369·ctags

[Bug] Stack-overflow in V parser (parseExpression/parseExprList)

Author: oneafterCreated Jan 16, 2026Updated Mar 2, 2026

Description

We discovered a Stack Overflow vulnerability in the V language parser of Universal Ctags. The crash occurs due to uncontrolled recursion when parsing deeply nested expressions.

The ASAN report shows an infinite recursion loop between parseExpression and parseExprList, eventually leading to a stack exhaustion and a crash in getInputFilePosition.

Environment

  • OS: Linux x86_64
  • Complier: Clang
  • Build Configuration: Release mode with ASan enabled.

Vulnerability Details

  • Target: Universal Ctags (ctags)
  • Vulnerability Type: CWE-674: Uncontrolled Recursion (Stack Overflow)
  • Function: parseExpression / parseExprList
  • Location: parsers/v.c:2744 (and parsers/v.c:2721)
  • Root Cause Analysis: The V parser uses recursive calls to handle expressions and expression lists. The cycle is: parseExpression calls parseExprList, which in turn calls parseExpression again.
// parsers/v.c
static void parseExpression (...) {
    // ...
    parseExprList(...);
    // ...
}
static void parseExprList (...) {
    // ...
    parseExpression(...);
    // ...
}

There appears to be no limit on the nesting depth of expressions. A specially crafted V source file with deeply nested structures (e.g., deeply nested parentheses or arrays) triggers this infinite recursion.

Reproduce

  1. Build ctags with Release optimization and ASAN enabled.
  2. Run with the crashing file repro:
./ctags -f /dev/null --sort=no poc.v
ASAN report
AddressSanitizer:DEADLYSIGNAL
=================================================================
==12961==ERROR: AddressSanitizer: stack-overflow on address 0x7ffec5913ec8 (pc 0x5626acc1b09a bp 0x7ffec5914710 sp 0x7ffec5913ed0 T0)
    #0 0x5626acc1b09a in __asan_memcpy (/src/ctags/ctags+0x19909a) (BuildId: 4e8981c500ee9870205e9d50b4bf13ab5c564fbe)
    #1 0x5626accae7c2 in getInputFilePosition /src/ctags/main/read.c:353:27
    #2 0x5626acfe46f3 in readTokenFull /src/ctags/parsers/v.c:608:24
    #3 0x5626acff3ee2 in readToken /src/ctags/parsers/v.c:891:2
    #4 0x5626acff3ee2 in parseExpression /src/ctags/parsers/v.c:2721:3
    #5 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #6 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #7 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #8 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #9 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #10 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #11 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #12 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #13 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #14 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #15 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #16 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #17 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #18 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #19 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #20 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #21 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #22 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #23 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #24 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #25 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #26 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #27 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #28 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #29 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #30 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #31 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #32 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #33 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #34 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #35 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #36 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #37 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #38 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #39 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #40 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #41 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #42 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #43 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #44 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #45 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #46 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #47 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #48 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #49 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #50 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #51 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #52 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #53 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #54 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #55 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #56 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #57 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #58 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #59 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #60 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #61 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #62 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #63 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #64 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #65 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #66 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #67 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #68 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #69 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #70 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #71 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #72 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #73 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #74 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #75 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #76 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #77 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #78 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #79 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #80 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #81 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #82 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #83 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #84 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #85 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #86 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #87 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #88 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #89 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #90 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #91 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #92 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #93 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #94 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #95 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #96 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #97 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #98 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #99 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #100 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #101 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #102 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #103 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #104 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #105 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #106 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #107 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #108 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #109 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #110 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #111 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #112 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #113 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #114 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #115 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #116 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #117 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #118 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #119 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #120 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #121 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #122 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #123 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #124 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #125 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #126 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #127 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #128 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #129 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #130 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #131 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #132 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #133 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #134 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #135 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #136 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #137 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #138 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #139 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #140 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #141 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #142 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #143 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #144 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #145 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #146 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #147 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #148 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #149 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #150 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #151 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #152 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #153 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #154 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #155 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #156 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #157 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #158 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #159 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #160 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #161 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #162 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #163 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #164 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #165 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #166 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #167 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #168 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #169 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #170 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #171 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #172 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #173 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #174 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #175 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #176 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #177 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #178 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #179 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #180 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #181 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #182 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #183 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #184 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #185 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #186 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #187 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #188 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #189 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #190 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #191 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #192 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #193 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #194 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #195 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #196 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #197 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #198 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #199 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #200 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #201 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #202 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #203 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #204 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #205 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #206 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #207 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #208 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #209 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #210 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #211 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #212 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #213 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #214 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #215 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #216 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #217 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #218 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #219 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #220 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #221 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #222 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #223 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #224 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #225 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #226 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #227 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #228 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #229 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #230 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #231 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #232 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #233 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #234 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #235 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #236 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #237 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #238 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #239 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #240 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #241 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #242 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #243 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #244 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #245 0x5626acff795d in parseExprList /src/ctags/parsers/v.c
    #246 0x5626acff40c5 in parseExpression /src/ctags/parsers/v.c:2744:5
    #247 0x5626acff795d in parseExprList /src/ctags/parsers/v.c

SUMMARY: AddressSanitizer: stack-overflow (/src/ctags/ctags+0x19909a) (BuildId: 4e8981c500ee9870205e9d50b4bf13ab5c564fbe) in __asan_memcpy
==12961==ABORTING

Source: universal-ctags/ctags

View original on GitHubView discussion on GitHub