From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Allink <arclicious@vivaldi.net>
Date: Fri, 2 Jun 2023 22:13:54 +0100
Subject: [PATCH] Add depth limit to SNBT


diff --git a/src/main/java/net/minecraft/nbt/TagParser.java b/src/main/java/net/minecraft/nbt/TagParser.java
index 94cb73e7f60171aa57bd1dbe7e91ef4db94e70b7..9ed1c477620b41317c4bf2b14ebc672c2fdd4656 100644
--- a/src/main/java/net/minecraft/nbt/TagParser.java
+++ b/src/main/java/net/minecraft/nbt/TagParser.java
@@ -182,9 +182,56 @@ public class TagParser {
 
         this.expect('}');
         this.depth--; // Paper
-        return compoundTag;
+        return exceedsDepthLimit(compoundTag) ? new CompoundTag() : compoundTag; // Scissors - Add depth limit to SNBT
     }
 
+    // Scissors start - Add depth limit to SNBT
+    private boolean exceedsDepthLimit(Tag tag) {
+        return this.exceedsDepthLimit(0, tag);
+    }
+
+    private boolean exceedsDepthLimit(long depth, Tag tag)
+    {
+        if (depth > 256)
+        {
+            return true;
+        }
+
+        if (tag instanceof ListTag listTag)
+        {
+            for (Tag childTag : listTag)
+            {
+                boolean returnValue = this.exceedsDepthLimit(depth + 1, childTag);
+
+                if (returnValue)
+                {
+                    return true;
+                }
+            }
+        } else if (tag instanceof CompoundTag compoundTag)
+        {
+            for (String key: compoundTag.getAllKeys())
+            {
+                Tag childTag = compoundTag.get(key);
+
+                if (childTag == null)
+                {
+                    continue;
+                }
+
+                boolean returnValue = this.exceedsDepthLimit(depth + 1, childTag);
+
+                if (returnValue)
+                {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+    // Scissors end
+
     private Tag readListTag() throws CommandSyntaxException {
         this.expect('[');
         this.reader.skipWhitespace();
@@ -218,7 +265,7 @@ public class TagParser {
 
             this.expect(']');
             this.depth--; // Paper
-            return listTag;
+            return exceedsDepthLimit(listTag) ? new ListTag() : listTag; // Scissors - Add depth limit to SNBT
         }
     }
 
@@ -243,7 +290,7 @@ public class TagParser {
     }
 
     private <T extends Number> List<T> readArray(TagType<?> arrayTypeReader, TagType<?> typeReader) throws CommandSyntaxException {
-        List<T> list = Lists.newArrayList();
+        List<Number> list = Lists.newArrayList(); // Scissors - List<T> -> List<Number>
 
         while(true) {
             if (this.reader.peek() != ']') {
@@ -256,11 +303,11 @@ public class TagParser {
                 }
 
                 if (typeReader == ByteTag.TYPE) {
-                    list.add((T)((NumericTag)tag).getAsNumber()); // Paper - decompile fix
+                    list.add(((NumericTag)tag).getAsNumber()); // Scissors - Remove (T) cast
                 } else if (typeReader == LongTag.TYPE) {
-                    list.add((T)((NumericTag)tag).getAsNumber()); // Paper - decompile fix
+                    list.add(((NumericTag)tag).getAsNumber()); // Scissors - Remove (T) cast
                 } else {
-                    list.add((T)((NumericTag)tag).getAsNumber()); // Paper - decompile fix
+                    list.add(((NumericTag)tag).getAsNumber()); // Scissors - Remove (T) cast
                 }
 
                 if (this.hasElementSeparator()) {
@@ -272,7 +319,7 @@ public class TagParser {
             }
 
             this.expect(']');
-            return list;
+            return (List<T>) list; // Scissors - Cast to List<T>
         }
     }