From 68e8c1bb8f523ca0bc05a7d4823de2a4e3be6a8b Mon Sep 17 00:00:00 2001
From: Danil Alexeev <danil@alexeev.xyz>
Date: Tue, 22 Aug 2023 15:07:53 +0300
Subject: [PATCH] [3.x] Core: Add recursion level check for `Array` and
 `Dictionary` hashing

---
 core/array.cpp      | 11 ++++++++++-
 core/array.h        |  1 +
 core/dictionary.cpp | 12 ++++++++++--
 core/dictionary.h   |  1 +
 core/variant.cpp    | 11 ++++++-----
 core/variant.h      |  1 +
 6 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/core/array.cpp b/core/array.cpp
index 922a068ee9f..e3e2579c3d4 100644
--- a/core/array.cpp
+++ b/core/array.cpp
@@ -118,16 +118,25 @@ bool Array::operator==(const Array &p_array) const {
 }
 
 uint32_t Array::hash() const {
+	return recursive_hash(0);
+}
+
+uint32_t Array::recursive_hash(int p_recursion_count) const {
+	ERR_FAIL_COND_V_MSG(p_recursion_count > MAX_RECURSION, 0, "Max recursion reached");
+	p_recursion_count++;
+
 	uint32_t h = hash_djb2_one_32(0);
 
 	for (int i = 0; i < _p->array.size(); i++) {
-		h = hash_djb2_one_32(_p->array[i].hash(), h);
+		h = hash_djb2_one_32(_p->array[i].recursive_hash(p_recursion_count), h);
 	}
 	return h;
 }
+
 void Array::operator=(const Array &p_array) {
 	_ref(p_array);
 }
+
 void Array::push_back(const Variant &p_value) {
 	_p->array.push_back(p_value);
 }
diff --git a/core/array.h b/core/array.h
index 981781d723a..61d7d3189c7 100644
--- a/core/array.h
+++ b/core/array.h
@@ -60,6 +60,7 @@ public:
 	bool operator==(const Array &p_array) const;
 
 	uint32_t hash() const;
+	uint32_t recursive_hash(int p_recursion_count) const;
 	void operator=(const Array &p_array);
 
 	void push_back(const Variant &p_value);
diff --git a/core/dictionary.cpp b/core/dictionary.cpp
index 9f7e033f965..c672e2691bb 100644
--- a/core/dictionary.cpp
+++ b/core/dictionary.cpp
@@ -221,12 +221,20 @@ void Dictionary::_unref() const {
 	}
 	_p = nullptr;
 }
+
 uint32_t Dictionary::hash() const {
+	return recursive_hash(0);
+}
+
+uint32_t Dictionary::recursive_hash(int p_recursion_count) const {
+	ERR_FAIL_COND_V_MSG(p_recursion_count > MAX_RECURSION, 0, "Max recursion reached");
+	p_recursion_count++;
+
 	uint32_t h = hash_djb2_one_32(Variant::DICTIONARY);
 
 	for (OrderedHashMap<Variant, Variant, VariantHasher, VariantComparator>::Element E = _p->variant_map.front(); E; E = E.next()) {
-		h = hash_djb2_one_32(E.key().hash(), h);
-		h = hash_djb2_one_32(E.value().hash(), h);
+		h = hash_djb2_one_32(E.key().recursive_hash(p_recursion_count), h);
+		h = hash_djb2_one_32(E.value().recursive_hash(p_recursion_count), h);
 	}
 
 	return h;
diff --git a/core/dictionary.h b/core/dictionary.h
index 61e356d5d34..e0e5cf0cd80 100644
--- a/core/dictionary.h
+++ b/core/dictionary.h
@@ -75,6 +75,7 @@ public:
 	bool operator!=(const Dictionary &p_dictionary) const;
 
 	uint32_t hash() const;
+	uint32_t recursive_hash(int p_recursion_count) const;
 	void operator=(const Dictionary &p_dictionary);
 
 	const Variant *next(const Variant *p_key = nullptr) const;
diff --git a/core/variant.cpp b/core/variant.cpp
index 12457d4897b..38dfe1c09a9 100644
--- a/core/variant.cpp
+++ b/core/variant.cpp
@@ -2508,6 +2508,10 @@ Variant::~Variant() {
 }*/
 
 uint32_t Variant::hash() const {
+	return recursive_hash(0);
+}
+
+uint32_t Variant::recursive_hash(int p_recursion_count) const {
 	switch (type) {
 		case NIL: {
 			return 0;
@@ -2622,13 +2626,10 @@ uint32_t Variant::hash() const {
 			return reinterpret_cast<const NodePath *>(_data._mem)->hash();
 		} break;
 		case DICTIONARY: {
-			return reinterpret_cast<const Dictionary *>(_data._mem)->hash();
-
+			return reinterpret_cast<const Dictionary *>(_data._mem)->recursive_hash(p_recursion_count);
 		} break;
 		case ARRAY: {
-			const Array &arr = *reinterpret_cast<const Array *>(_data._mem);
-			return arr.hash();
-
+			return reinterpret_cast<const Array *>(_data._mem)->recursive_hash(p_recursion_count);
 		} break;
 		case POOL_BYTE_ARRAY: {
 			const PoolVector<uint8_t> &arr = *reinterpret_cast<const PoolVector<uint8_t> *>(_data._mem);
diff --git a/core/variant.h b/core/variant.h
index 357b5c5aeb7..b5923ea342c 100644
--- a/core/variant.h
+++ b/core/variant.h
@@ -413,6 +413,7 @@ public:
 	bool operator!=(const Variant &p_variant) const;
 	bool operator<(const Variant &p_variant) const;
 	uint32_t hash() const;
+	uint32_t recursive_hash(int p_recursion_count) const;
 
 	bool hash_compare(const Variant &p_variant) const;
 	bool booleanize() const;