Review fixes on #355: cap caret chains, honor the full space set

Two probe-confirmed bypasses of the new depth guard: the ^ chain is
right-recursive in the grammar (50k carets still overflowed the
stack), and the minus-run reset treated \v/\f as run breakers while
PEGTL's space rule accepts them ('-\v' x 50000 crashed). Every ^ now
counts toward the cap regardless of position, and the run persists
across the full PEGTL space set. Lock-ins cover both bypasses plus a
100-caret happy path.

Signed-off-by: petlenz <peterlenz89.pl@gmail.com>

Author: petlenz

src/numsim_cas/parser/parser.cpp

@@ -46,8 +46,15 @@ syntax_error translate_pegtl_error(pegtl::parse_error const &e,
 // runs (whitespace does not reset a run: "- - -x" recurses per minus).
 void check_nesting_depth(std::string_view source) {
   constexpr std::size_t max_depth = 512;
+  const auto is_space = [](char c) {
+    // must cover PEGTL's full space set or a whitespace variant resets
+    // the run and bypasses the guard (review on #355)
+    return c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == '\v' ||
+           c == '\f';
+  };
   std::size_t depth = 0;
   std::size_t minus_run = 0;
+  std::size_t caret_count = 0;
   for (std::size_t i = 0; i < source.size(); ++i) {
     const char c = source[i];
     if (c == '(' || c == '[' || c == '{') {
@@ -58,12 +65,18 @@ void check_nesting_depth(std::string_view source) {
       if (depth > 0) {
         --depth;
       }
+    } else if (c == '^') {
+      // every ^ contributes one right-recursion level regardless of
+      // position (review on #355: 50k carets overflowed the stack)
+      if (++caret_count > max_depth) {
+        throw syntax_error("expression nesting too deep", i, source);
+      }
     }
     if (c == '-') {
       if (++minus_run > max_depth) {
         throw syntax_error("expression nesting too deep", i, source);
       }
-    } else if (c != ' ' && c != '\t' && c != '\n' && c != '\r') {
+    } else if (!is_space(c)) {
       minus_run = 0;
     }
   }

tests/ParserTest.h

@@ -2170,11 +2170,29 @@ TEST(ParserDepthGuard, DeepNestingRaisesParseError) {
   EXPECT_THROW((void)numsim::cas::parser::parse(minuses, syms),
                numsim::cas::parser::parse_error);
 
+  // review on #355: caret chains and PEGTL-space-separated minus runs
+  // are recursion drivers too
+  std::string carets = "1";
+  for (int i = 0; i < 20000; ++i)
+    carets += "^1";
+  EXPECT_THROW((void)numsim::cas::parser::parse(carets, syms),
+               numsim::cas::parser::parse_error);
+  std::string vminus;
+  for (int i = 0; i < 20000; ++i)
+    vminus += "-\v";
+  vminus += "1";
+  EXPECT_THROW((void)numsim::cas::parser::parse(vminus, syms),
+               numsim::cas::parser::parse_error);
+
   // moderate nesting still parses
   std::string ok(200, '(');
   ok += "1";
   ok += std::string(200, ')');
   EXPECT_NO_THROW((void)numsim::cas::parser::parse(ok, syms));
+  std::string ok2 = "1";
+  for (int i = 0; i < 100; ++i)
+    ok2 += "^1";
+  EXPECT_NO_THROW((void)numsim::cas::parser::parse(ok2, syms));
 }
 
 #endif // NUMSIM_CAS_PARSER_ENABLED