Commit `b4ec29e3b2`

b4ec29e3b267067e77d9845562803a8d513d54d1

parent: 28b91f82ea

Verified · cmc

cmc <hello@cleberg.net> · 2026-10-07 22:23 UTC

Keep hostile Lisp, diary sexps and formulas from crashing

The Lisp evaluator: integer overflow (where Emacs has bignums) is
unsupported, negative or invalid character codes are errors, nesting
stops at max-lisp-eval-depth or when the thread's stack runs low,
dotimes counts toward the step limit without building its range, and
number-sequence refuses huge ranges.

Diary functions bound the date numbers they compute with, and
calendar-last-day-of-month checks its month.

Table formulas: durations too large to show, numbers too large for
references and flags, and constants that refer to themselves are
unsupported rather than trapping or looping. A huge table-line-pos or
%\N in capture no longer traps.

Layout: unified · split

Sources/OrgCore/Agenda/DiarySexp.swift +37 −25

         return .list([.integer(date.month), .integer(date.day), .integer(date.year)])
     }
+    /// A number from Lisp used in date arithmetic, within what that arithmetic handles.
+    static func bounded(_ v: Sexp) throws -> Int {
+        let i = try Elisp.int(v)
+        guard (-100_000_000...100_000_000).contains(i) else { throw Elisp.Unsupported(what: "date number \(i)") }
+        return i
+    }
     static func parts(_ date: Sexp) throws -> (month: Int, day: Int, year: Int) {
         let items = try Elisp.elements(date)
         guard items.count == 3 else { throw Elisp.Signal(message: "Bad date \(date.description)") }
-        return (try Elisp.int(items[0]), try Elisp.int(items[1]), try Elisp.int(items[2]))
+        return (try bounded(items[0]), try bounded(items[1]), try bounded(items[2]))
     }
     static func absolute(_ date: Sexp) throws -> Int {
     static func isLeap(_ year: Int) -> Bool { year % 4 == 0 && (year % 100 != 0 || year % 400 == 0) }
-    static func lastDay(month: Int, year: Int) -> Int {
+    static func lastDay(month: Int, year: Int) throws -> Int {
-        month == 2 ? (isLeap(year) ? 29 : 28) : [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][(month - 1 + 12) % 12]
+        guard (1...12).contains(month) else { throw Elisp.Signal(message: "Args out of range: \(month)") }
+        return month == 2 ? (isLeap(year) ? 29 : 28) : [31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][month - 1]
     }
     /// `calendar-nth-named-absday`.
-    static func nthNamedAbsday(_ n: Int, _ dayname: Int, _ month: Int, _ year: Int, _ day: Int?) -> Int {
+    static func nthNamedAbsday(_ n: Int, _ dayname: Int, _ month: Int, _ year: Int, _ day: Int?) throws -> Int {
         func onOrBefore(_ date: Int) -> Int { date - (date - dayname) % 7 }
         if n > 0 {
             return 7 * (n - 1) + onOrBefore(6 + Days.absolute(year: year, month: month, day: day ?? 1))
         }
-        return 7 * (n + 1) + onOrBefore(Days.absolute(year: year, month: month, day: day ?? lastDay(month: month, year: year)))
+        return 7 * (n + 1) + onOrBefore(Days.absolute(year: year, month: month, day: try day ?? lastDay(month: month, year: year)))
     }
     /// `diary-ordinal-suffix`.
         }
         lisp.define("calendar-gregorian-from-absolute") { _, args in
             try arity(args, 1...1, "calendar-gregorian-from-absolute")
-            return gregorian(try Elisp.int(args[0]))
+            return gregorian(try bounded(args[0]))
         }
         lisp.define("calendar-day-of-week") { _, args in
             try arity(args, 1...1, "calendar-day-of-week")
         }
         lisp.define("calendar-last-day-of-month") { _, args in
             try arity(args, 2...2, "calendar-last-day-of-month")
-            return .integer(lastDay(month: try Elisp.int(args[0]), year: try Elisp.int(args[1])))
+            return .integer(try lastDay(month: try bounded(args[0]), year: try bounded(args[1])))
         }
         lisp.define("calendar-date-equal") { _, args in
             try arity(args, 2...2, "calendar-date-equal")
         }
         lisp.define("calendar-nth-named-absday") { _, args in
             try arity(args, 4...5, "calendar-nth-named-absday")
-            let day = Elisp.isNil(optional(args, 4)) ? nil : try Elisp.int(args[4])
+            let day = Elisp.isNil(optional(args, 4)) ? nil : try bounded(args[4])
-            return .integer(nthNamedAbsday(try Elisp.int(args[0]), try Elisp.int(args[1]), try Elisp.int(args[2]), try Elisp.int(args[3]), day))
+            return .integer(try nthNamedAbsday(try bounded(args[0]), try bounded(args[1]), try bounded(args[2]), try bounded(args[3]), day))
         }
         lisp.define("calendar-nth-named-day") { lisp, args in
-            gregorian(try Elisp.int(try lisp.callNamed("calendar-nth-named-absday", args)))
+            gregorian(try bounded(try lisp.callNamed("calendar-nth-named-absday", args)))
         }
         lisp.define("calendar-iso-from-absolute") { _, args in
             try arity(args, 1...1, "calendar-iso-from-absolute")
-            let day = try Elisp.int(args[0])
+            let day = try bounded(args[0])
             let thursday = day - (Days.weekday(day) + 6) % 7 + 3
             return .list([.integer(Days.isoWeek(day)), .integer(Days.weekday(day)), .integer(Days.date(thursday).year)])
         }
         lisp.define("diary-float") { _, args in
             try arity(args, 3...5, "diary-float")
             let month = args[0]
-            let dayname = try Elisp.int(args[1])
+            let dayname = try bounded(args[1])
-            let n = try Elisp.int(args[2])
+            let n = try bounded(args[2])
-            let day = Elisp.isNil(optional(args, 3)) ? nil : try Elisp.int(args[3])
+            let day = Elisp.isNil(optional(args, 3)) ? nil : try bounded(args[3])
             let current = try absolute(try date())
             guard dayname == Days.weekday(current) else { return .nil }
             let d = Days.date(current)
-            let limit = nthNamedAbsday(-n, dayname, d.month, d.year, d.day)
+            let limit = try nthNamedAbsday(-n, dayname, d.month, d.year, d.day)
             let lastAbs = n > 0 ? limit : limit + 6
             let firstAbs = n > 0 ? limit - 6 : limit
             let first = Days.date(firstAbs)
                 default: false
                 }
             }
-            func base(_ m: Int, _ y: Int) -> Int { day ?? (n > 0 ? 1 : lastDay(month: m, year: y)) }
+            func base(_ m: Int, _ y: Int) throws -> Int { try day ?? (n > 0 ? 1 : lastDay(month: m, year: y)) }
             let applies: Bool
             if first.month == last.month {
-                let b = base(first.month, first.year)
+                let b = try base(first.month, first.year)
                 applies = monthMatches(first.month) && first.day <= b && b <= last.day
             } else {
+                let firstBase = try base(first.month, first.year)
+                let lastBase = try base(last.month, last.year)
                 applies = (first.year < last.year || (first.year == last.year && first.month < last.month))
-                    && ((monthMatches(first.month) && first.day <= base(first.month, first.year))
+                    && ((monthMatches(first.month) && first.day <= firstBase) || (monthMatches(last.month) && lastBase <= last.day))
-                        || (monthMatches(last.month) && base(last.month, last.year) <= last.day))
             }
             return applies ? Elisp.cons(optional(args, 4), try entry()) : .nil
         }
         lisp.define("diary-anniversary") { lisp, args in
             try arity(args, 2...4, "diary-anniversary")
             let made = try makeDate(lisp, args[0], args[1], optional(args, 2))
-            var dd = try Elisp.int(made[1])
+            var dd = try bounded(made[1])
-            var mm = try Elisp.int(made[0])
+            var mm = try bounded(made[0])
             let y = try parts(try date()).year
-            let diff = Elisp.isNil(made[2]) ? 100 : y - (try Elisp.int(made[2]))
+            let diff = Elisp.isNil(made[2]) ? 100 : y - (try bounded(made[2]))
             if mm == 2, dd == 29, !isLeap(y) {
                 mm = 3
                 dd = 1
         lisp.define("diary-remind") { lisp, args in
             try arity(args, 2...3, "diary-remind")
             var days = args[1]
-            if case .integer(let n) = days, n < 0 { days = Elisp.list((1...(-n)).map { .integer($0) }) }
+            if case .integer(let n) = days, n < 0 {
+                guard n >= -Elisp.lengthLimit else { throw Elisp.Signal(message: "Too many days for diary-remind") }
+                days = Elisp.list((1...(-n)).map { .integer($0) })
+            }
             func remind(_ days: Sexp) throws -> Sexp {
                 let applies = try lisp.eval(args[0])
                 if !Elisp.isNil(applies) { return applies }
                 if case .integer(let n) = days {
-                    let shifted = gregorian(try absolute(try date()) + n)
+                    let shifted = gregorian(try absolute(try date()) + (try bounded(.integer(n))))
                     var found = try lisp.binding(["date": shifted]) { try lisp.eval(args[0]) }
                     guard !Elisp.isNil(found) else { return .nil }
                     if case .dotted = found { found = try Elisp.cdr(found) } else if case .list = found { found = try Elisp.cdr(found) }
         lisp.define("org-date") { lisp, args in try iso(lisp) { try lisp.callNamed("diary-date", args) } }
         lisp.define("org-class") { _, args in
             try arity(args, 7...Int.max, "org-class")
-            let ints = try args.prefix(7).map(Elisp.int)
+            let ints = try args.prefix(7).map(bounded)
             let first = Days.absolute(year: ints[0], month: ints[1], day: ints[2])
             let last = Days.absolute(year: ints[3], month: ints[4], day: ints[5])
             let d = try absolute(try date())

Sources/OrgCore/Capture/Capture.swift +4 −2

             let ns = text as NSString
             var out = text
             for m in regex.matches(in: text, range: NSRange(location: 0, length: ns.length)).reversed() where !escaped(ns, at: m.range.location) {
-                let n = Int(ns.substring(with: m.range(at: 1)))!
+                let n = Int(ns.substring(with: m.range(at: 1))) ?? Int.max
                 out = (out as NSString).replacingCharacters(in: m.range, with: n <= values.count ? values[n - 1] : "")
             }
             text = out
             guard let m = pos.firstMatch(of: /(I+)([-+][0-9]+)/) else { throw Failure.message("Invalid table line specification \"\(pos)\"") }
             let hlines = rows.indices.filter { rows[$0].range(of: "^[ \\t]*\\|-", options: .regularExpression) != nil }
             guard m.1.count <= hlines.count else { throw Failure.message("Invalid table line specification \"\(pos)\"") }
-            let delta = Int(m.2.replacingOccurrences(of: "+", with: ""))!
+            guard let delta = Int(m.2.replacingOccurrences(of: "+", with: "")), (-999_999...999_999).contains(delta) else {
+                throw Failure.message("Invalid table line specification \"\(pos)\"")
+            }
             buffer.point = lineStart(hlines[m.1.count - 1] + delta + (delta < 0 ? 0 : -1) + 1)
         } else if options.prepend {
             if let rule = rows.firstIndex(where: { $0.range(of: "^[ \\t]*\\|-", options: .regularExpression) != nil }) {

Sources/OrgCore/Compute/TableFormulas.swift +41 −25

         }
     }
+    /// A number written in a formula, small enough to work with.
+    static func integer(_ s: String) throws -> Int {
+        guard let n = Int(s.hasPrefix("+") ? String(s.dropFirst()) : s), (-999_999_999...999_999_999).contains(n) else { throw Calc.Unsupported("number size \(s)") }
+        return n
+    }
     /// `org-table-time-string-to-seconds`.
-    static func timeStringToSeconds(_ s: String) -> String {
+    static func timeStringToSeconds(_ s: String) throws -> String {
         guard !s.isEmpty else { return s }
-        func seconds(_ sign: Substring, _ parts: [Substring]) -> String {
+        func seconds(_ sign: Substring, _ parts: [Substring]) throws -> String {
-            let total = parts.enumerated().reduce(0) { sum, part in
+            var total = 0
-                sum + (Int(part.element) ?? 0) * [3600, 60, 1][part.offset]
+            for (i, part) in parts.enumerated() {
+                let (scaled, o1) = (Int(part) ?? Int.max).multipliedReportingOverflow(by: [3600, 60, 1][i])
+                let (sum, o2) = total.addingReportingOverflow(scaled)
+                if o1 || o2 || Int(part) == nil { throw Calc.Unsupported("duration size") }
+                total = sum
             }
             return String(sign.isEmpty ? total : -total)
         }
-        if let m = s.firstMatch(of: /(-?)([0-9]+):([0-9]+):([0-9]+)/) { return seconds(m.1, [m.2, m.3, m.4]) }
+        if let m = s.firstMatch(of: /(-?)([0-9]+):([0-9]+):([0-9]+)/) { return try seconds(m.1, [m.2, m.3, m.4]) }
         if s.range(of: timestampBoth, options: .regularExpression) == nil, let m = s.firstMatch(of: /(-?)([0-9]+):([0-9]+)/) {
-            return seconds(m.1, [m.2, m.3])
+            return try seconds(m.1, [m.2, m.3])
         }
         return numberText(s)
     }
     /// `org-table-time-seconds-to-string`, with `org-table-duration-custom-format` `hours`
     /// and zero-padded hours.
-    static func secondsToString(_ seconds: Sexp, _ format: DurationFormat) -> String {
+    static func secondsToString(_ seconds: Sexp, _ format: DurationFormat) throws -> String {
         let value = (try? Elisp.number(seconds))?.double ?? 0
         let magnitude = abs(value)
+        guard magnitude.isFinite, magnitude < 1e15 else { throw Calc.Unsupported("duration size") }
         let result: String
         switch format {
         case .hours:
     /// `org-table-formula-substitute-names`: column names become `$N`; parameters, named
     /// fields and constants their values, in parentheses outside Lisp formulas.
-    func substituteNames(_ formula: String, analysis: TableAnalysis) -> String {
+    func substituteNames(_ formula: String, analysis: TableAnalysis) throws -> String {
         let parenthesize = !formula.hasPrefix("'")
         let duration = formula.range(of: ";.*[Tt].*$", options: .regularExpression) != nil
         var new = formula
         }
         let regex = try! NSRegularExpression(pattern: "\\$([a-zA-Z][_a-zA-Z0-9]*)|(\\bremote\\([^)]*\\))")
         var start = 0
+        var substitutions = 0
         while let m = regex.firstMatch(in: new, range: NSRange(location: start, length: (new as NSString).length - start)) {
             let ns = new as NSString
+            // A constant whose value names itself would go on forever, as it does in Org.
+            substitutions += 1
+            if substitutions > 1000 { throw Calc.Unsupported("constants that refer to themselves") }
             if m.range(at: 2).location != NSNotFound {
                 start = NSMaxRange(m.range(at: 2))
                 continue
             }
             start = m.range.location + 1
             var value = tableConstant(ns.substring(with: m.range(at: 1)), analysis: analysis)
-            if duration, value.contains(where: { !$0.isWhitespace }) { value = Self.timeStringToSeconds(value) }
+            if duration, value.contains(where: { !$0.isWhitespace }) { value = try Self.timeStringToSeconds(value) }
             new = ns.replacingCharacters(in: m.range, with: parenthesize ? "(" + value + ")" : value)
         }
         return new
         }
         let remote = EmacsBuffer(string, point: m.range.location, settings: settings, options: options)
         let analysis = try remote.tableAnalyze()
-        let resolved = remote.substituteNames(try Self.handleFirstLast(Self.refsToRC(form), analysis: analysis), analysis: analysis)
+        let resolved = try remote.substituteNames(try Self.handleFirstLast(Self.refsToRC(form), analysis: analysis), analysis: analysis)
         let range = try! NSRegularExpression(pattern: Self.rangePattern)
         let rns = resolved as NSString
         if let r = range.firstMatch(in: resolved, range: NSRange(location: 0, length: rns.length)), r.range.length > 1 {
             let numeric = try! NSRegularExpression(pattern: "([pnfse])(-?[0-9]+)")
             while let m = numeric.firstMatch(in: flags, range: NSRange(location: 0, length: (flags as NSString).length)) {
                 let ns = flags as NSString
-                let n = Int(ns.substring(with: m.range(at: 2)))!
+                let n = try Self.integer(ns.substring(with: m.range(at: 2)))
                 switch ns.substring(with: m.range(at: 1)) {
                 case "p": modes.precision = n
                 case "n": modes.format = .float(n)
             }
             if flags.contains(where: { !$0.isWhitespace }) { fmt = flags }
         }
-        if !substituted { formula = try Self.handleFirstLast(substituteNames(formula, analysis: analysis), analysis: analysis) }
+        if !substituted { formula = try Self.handleFirstLast(try substituteNames(formula, analysis: analysis), analysis: analysis) }
         var fields = Self.splitFields(substring(lineStart(point), lineEnd(point)).trimmingCharacters(in: .whitespaces), separator: " *\\| *")
-        if duration != nil { fields = fields.map(Self.timeStringToSeconds) }
+        if duration != nil { fields = try fields.map(Self.timeStringToSeconds) }
         if mode.numbers { fields = fields.map { $0.contains(where: { !$0.isWhitespace }) ? Self.numberText($0) : $0 } }
         if formula.count > 2, formula.hasPrefix("'(") { mode.lisp = literal ? .literal : .lisp }
         func reference(_ value: TableRangeValue) throws -> String {
             guard duration != nil else { return try Self.makeReference(value, mode) }
             switch value {
-            case .field(let s): return try Self.makeReference(.field(Self.timeStringToSeconds(s)), mode)
+            case .field(let s): return try Self.makeReference(.field(try Self.timeStringToSeconds(s)), mode)
-            case .list(let items): return try Self.makeReference(.list(items.map(Self.timeStringToSeconds)), mode)
+            case .list(let items): return try Self.makeReference(.list(try items.map(Self.timeStringToSeconds)), mode)
             }
         }
         let n0 = tableCurrentColumn()
         let rowRange = try! NSRegularExpression(pattern: "\\$(([-+])?[0-9]+)\\.\\.\\$(([-+])?[0-9]+)")
         while let m = rowRange.firstMatch(in: form, range: NSRange(location: 0, length: (form as NSString).length)) {
             let ns = form as NSString
-            let a = Int(ns.substring(with: m.range(at: 1)))! + (m.range(at: 2).location != NSNotFound ? n0 : 0)
+            let a = try Self.integer(ns.substring(with: m.range(at: 1))) + (m.range(at: 2).location != NSNotFound ? n0 : 0)
-            let b = Int(ns.substring(with: m.range(at: 3)))! + (m.range(at: 4).location != NSNotFound ? n0 : 0)
+            let b = try Self.integer(ns.substring(with: m.range(at: 3))) + (m.range(at: 4).location != NSNotFound ? n0 : 0)
             guard a >= 1, b <= fields.count, a - 1 <= b else { throw Calc.Unsupported("range outside row") }
             form = ns.replacingCharacters(in: m.range, with: try Self.makeReference(.list(Array(fields[(a - 1)..<b])), mode))
         }
         let single = try! NSRegularExpression(pattern: "\\$(([-+])?[0-9]+)")
         while let m = single.firstMatch(in: form, range: NSRange(location: 0, length: (form as NSString).length)) {
             let ns = form as NSString
-            let n = Int(ns.substring(with: m.range(at: 1)))! + (m.range(at: 2).location != NSNotFound ? n0 : 0)
+            let n = try Self.integer(ns.substring(with: m.range(at: 1))) + (m.range(at: 2).location != NSNotFound ? n0 : 0)
             let index = (n == 0 ? n0 : max(n, 1)) - 1
             guard index < fields.count else { throw UserError(message: "Invalid field specifier \"\(ns.substring(with: m.range))\"") }
             let replacement = try Self.makeReference(.field(fields[index]), mode)
                 }
             }
             if let duration, !result.isEmpty, result != "#ERROR" {
-                let seconds = result.range(of: "^[0-9]+:[0-9]+(:[0-9]+)?$", options: .regularExpression) != nil ? Self.timeStringToSeconds(result) : result
+                let seconds = result.range(of: "^[0-9]+:[0-9]+(:[0-9]+)?$", options: .regularExpression) != nil ? try Self.timeStringToSeconds(result) : result
-                result = Self.secondsToString(Elisp.stringToNumber(seconds), duration)
+                result = try Self.secondsToString(Elisp.stringToNumber(seconds), duration)
             }
         }
         if let fmt {
             return "#ERROR"
         }
         var result = Elisp.printed(value)
-        if let duration { result = Self.secondsToString(Elisp.stringToNumber(result), duration) }
+        if let duration { result = try Self.secondsToString(Elisp.stringToNumber(result), duration) }
         return result
     }
         var columnEquations: [(Int, String)] = []
         var fieldEquations: [(String, String)] = []
         for (oldLHS, rawRHS) in stored {
-            let rhs = substituteNames(try Self.handleFirstLast(rawRHS, analysis: analysis), analysis: analysis)
+            let rhs = try substituteNames(try Self.handleFirstLast(rawRHS, analysis: analysis), analysis: analysis)
             if oldLHS.range(of: "^@-?I+", options: .regularExpression) != nil { throw UserError(message: "Can't assign to hline relative reference") }
             let lhs = try Self.handleFirstLast(oldLHS, analysis: analysis)
             if lhs.range(of: "^\\$[0-9]+$", options: .regularExpression) != nil {
-                columnEquations.append((Int(lhs.dropFirst())!, rhs))
+                columnEquations.append((try Self.integer(String(lhs.dropFirst())), rhs))
             } else {
                 fieldEquations.append((lhs, rhs))
             }
         var fields: [(row: Int, column: Int, rhs: String)] = []
         for (lhs, rhs) in fieldEquations {
             if let m = lhs.firstMatch(of: /^@([0-9]+)\$([0-9]+)$/) {
-                fields.append((Int(m.1)!, Int(m.2)!, rhs))
+                fields.append((try Self.integer(String(m.1)), try Self.integer(String(m.2)), rhs))
             } else if lhs.range(of: "^[a-zA-Z][_a-zA-Z0-9]*$", options: .regularExpression) != nil {
                 guard let location = analysis.namedFields.last(where: { $0.name == lhs }), let row = Self.lineToDline(location.line, analysis) else {
                     throw UserError(message: "Unknown field: \(lhs)")
             } else if lhs.range(of: "^@[-+0-9]+\\$-?[0-9]+$", options: .regularExpression) != nil {
                 throw Calc.Unsupported("relative field formula")
             } else if let m = lhs.firstMatch(of: /^@([0-9]+)$/) {
-                for c in 1...analysis.ncol { fields.append((Int(m.1)!, c, rhs)) }
+                let row = try Self.integer(String(m.1))
+                for c in 1...analysis.ncol { fields.append((row, c, rhs)) }
             } else {
                 let corners = try rangeCorners(lhs, analysis: analysis)
                 guard let r1 = Self.lineToDline(corners.r1, analysis), let r2 = Self.lineToDline(corners.r2, analysis, above: true), r1 <= r2 else {

Sources/OrgCore/Config/Elisp.swift +58 −16

     private var functions: [String: Builtin] = [:]
     private var steps = 0
     static let stepLimit = 1_000_000
+    /// Nested evaluations, as `max-lisp-eval-depth` limits them.
+    private var depth = 0
+    static let depthLimit = 1600
+    /// The most elements a list built at once may have.
+    static let lengthLimit = 1_000_000
     /// What `princ` and the other printers wrote: the innermost `with-output-to-string`, or
     /// standard output.
     private var outputs: [String] = [""]
     // MARK: - Evaluation
+    /// Less than 128 KB of this thread's stack left: background threads have only 512 KB.
+    static func stackIsLow() -> Bool {
+        var marker = 0
+        let here = withUnsafeMutablePointer(to: &marker) { UInt(bitPattern: $0) }
+        let top = UInt(bitPattern: pthread_get_stackaddr_np(pthread_self()))
+        let size = UInt(pthread_get_stacksize_np(pthread_self()))
+        return here < top - size + 128 * 1024
+    }
     public func eval(_ form: Sexp) throws -> Sexp {
         steps += 1
         if steps > Self.stepLimit { throw Signal(message: "Evaluation took too long") }
+        depth += 1
+        defer { depth -= 1 }
+        if depth > Self.depthLimit || Self.stackIsLow() { throw Signal(message: "Lisp nesting exceeds ‘max-lisp-eval-depth’") }
         switch form {
         case .symbol(let name):
             if name == "nil" || name == "t" || name.hasPrefix(":") { return form }
             let spec = try args.first.map(Self.elements) ?? []
             guard case .symbol(let variable)? = spec.first, spec.count >= 2 else { throw Signal(message: "Bad \(name)") }
             let source = try eval(spec[1])
-            let items = name == "dolist" ? try Self.elements(source) : (0..<max(0, try Self.int(source))).map { Sexp.integer($0) }
+            let items = name == "dolist" ? try Self.elements(source) : []
+            let count = name == "dolist" ? items.count : max(0, try Self.int(source))
             scopes.append([:])
             defer { scopes.removeLast() }
-            for item in items {
+            for i in 0..<count {
-                scopes[scopes.count - 1][variable] = item
+                steps += 1
+                if steps > Self.stepLimit { throw Signal(message: "Evaluation took too long") }
+                scopes[scopes.count - 1][variable] = name == "dolist" ? items[i] : .integer(i)
                 _ = try progn(args.dropFirst())
             }
             if spec.count > 2 {
-                scopes[scopes.count - 1][variable] = name == "dotimes" ? .integer(items.count) : .nil
+                scopes[scopes.count - 1][variable] = name == "dotimes" ? .integer(count) : .nil
                 return try eval(spec[2])
             }
             return .nil
                 guard var result = numbers.first else { return .integer(identity) }
                 if numbers.count == 1, name == "-" {
                     switch result {
-                    case .int(let i): return .integer(-i)
+                    case .int(let i):
+                        guard i != .min else { throw Unsupported(what: "integer size") }
+                        return .integer(-i)
                     case .float(let d): return .float(-d)
                     }
                 }
             try arity(args, 2...2, "%")
             let b = try int(args[1])
             guard b != 0 else { throw Signal(message: "Arithmetic error") }
-            return .integer(try int(args[0]) % b)
+            let (r, overflow) = try int(args[0]).remainderReportingOverflow(dividingBy: b)
+            if overflow { throw Unsupported(what: "integer size") }
+            return .integer(r)
         }
         lisp.define("mod") { _, args in
             try arity(args, 2...2, "mod")
             switch (try number(args[0]), try number(args[1])) {
             case (.int(let a), .int(let b)):
                 guard b != 0 else { throw Signal(message: "Arithmetic error") }
-                let r = a % b
+                let (r, overflow) = a.remainderReportingOverflow(dividingBy: b)
+                if overflow { throw Unsupported(what: "integer size") }
                 return .integer(r != 0 && (r < 0) != (b < 0) ? r + b : r)
             case (let a, let b):
                 let r = fmod(a.double, b.double)
         lisp.define("abs") { _, args in
             try arity(args, 1...1, "abs")
             switch try number(args[0]) {
-            case .int(let i): return .integer(abs(i))
+            case .int(let i):
+                guard i != .min else { throw Unsupported(what: "integer size") }
+                return .integer(abs(i))
             case .float(let d): return .float(abs(d))
             }
         }
             let to = try int(args[1])
             let step = args.count > 2 && !isNil(args[2]) ? try int(args[2]) : 1
             guard step != 0 else { throw Signal(message: "The increment can not be zero") }
+            let span = Double(to) - Double(from)
+            guard span / Double(step) < Double(Self.lengthLimit) else { throw Signal(message: "Too many elements for number-sequence") }
             return list(Array(stride(from: from, through: to, by: step)).map { .integer($0) })
         }
         for name in ["memq", "member", "memql"] {
         lisp.define("string-lessp") { lisp, args in try lisp.callNamed("string<", args) }
         lisp.define("upcase") { _, args in
             try arity(args, 1...1, "upcase")
-            if case .integer(let c) = args[0] { return .integer(Int(Unicode.Scalar(c).map { String($0).uppercased().unicodeScalars.first!.value } ?? UInt32(c))) }
+            if case .integer(let c) = args[0] { return .integer(Int(String(try scalar(c)).uppercased().unicodeScalars.first!.value)) }
             return .string(try string(args[0]).uppercased())
         }
         lisp.define("downcase") { _, args in
             try arity(args, 1...1, "downcase")
-            if case .integer(let c) = args[0] { return .integer(Int(Unicode.Scalar(c).map { String($0).lowercased().unicodeScalars.first!.value } ?? UInt32(c))) }
+            if case .integer(let c) = args[0] { return .integer(Int(String(try scalar(c)).lowercased().unicodeScalars.first!.value)) }
             return .string(try string(args[0]).lowercased())
         }
         lisp.define("capitalize") { _, args in
         }
     }
-    static func add(_ n: Number, _ k: Int) -> Number {
+    static func add(_ n: Number, _ k: Int) throws -> Number {
         switch n {
-        case .int(let i): .int(i + k)
+        case .int(let i):
-        case .float(let d): .float(d + Double(k))
+            let (sum, overflow) = i.addingReportingOverflow(k)
+            if overflow { throw Unsupported(what: "integer size") }
+            return .int(sum)
+        case .float(let d): return .float(d + Double(k))
+        }
+    }
+    /// A character code as a character.
+    static func scalar(_ code: Int) throws -> Unicode.Scalar {
+        guard code >= 0, code <= 0x10FFFF, let scalar = Unicode.Scalar(UInt32(code)) else {
+            throw Signal(message: "Invalid character: \(code)")
         }
+        return scalar
     }
     static func divide(_ a: Number, _ b: Number, floating: Bool) throws -> Number {
         if !floating, case .int(let x) = a, case .int(let y) = b {
             guard y != 0 else { throw Signal(message: "Arithmetic error") }
-            return .int(x / y)
+            let (q, overflow) = x.dividedReportingOverflow(by: y)
+            if overflow { throw Unsupported(what: "integer size") }
+            return .int(q)
         }
         return .float(a.double / b.double)
     }
         case .string(let s): return s
         case _ where isNil(v): return ""
         case .list, .vector:
-            return String(String.UnicodeScalarView(try sequence(v).map { Unicode.Scalar(UInt32(try int($0))) ?? " " }))
+            return String(String.UnicodeScalarView(try sequence(v).map { try scalar(try int($0)) }))
         default: throw Signal(message: "Wrong type argument: sequencep, \(v.description)")
         }
     }
                 out += text
                 continue
             case "c":
-                text = Unicode.Scalar(UInt32(try int(try argument()))).map { String($0) } ?? ""
+                text = String(try scalar(try int(try argument())))
             case "e", "f", "g":
                 let value = try number(try argument()).double
                 out += String(format: "%" + flags + width + (precision.map { ".\($0)" } ?? "") + String(conversion), value)

Tests/OrgCoreTests/ElispTests.swift +48

	@@ -46,3 +46,51 @@ struct ElispTests {
46	}	46	}
47	}	47	}
48	}	48	}
		49
		50	/// Inputs that once crashed the evaluator, the diary functions or duration formulas.
		51	struct HostileInputTests {
		52	static let forms = [
		53	"(1+ 9223372036854775807)", "(1- -9223372036854775808)", "(- -9223372036854775808)", "(abs -9223372036854775808)",
		54	"(% -9223372036854775808 -1)", "(mod -9223372036854775808 -1)", "(/ -9223372036854775808 -1)",
		55	"(upcase -1)", "(downcase -1)", "(concat (list -1))", "(format \"%c\" -1)", "(format \"%c\" 99999999)",
		56	"(funcall (lambda (f) (funcall f f)) (lambda (f) (funcall f f)))",
		57	"(dotimes (i 10000000000) nil)", "(number-sequence 1 10000000000)",
		58	]
		59
		60	@Test func evaluatorRefusesWithoutCrashing() {
		61	for form in Self.forms { #expect(ElispTests.ours(form) == "error", "\(form)") }
		62	}
		63
		64	/// On a stack the size of a background task's, deep recursion stops with an error.
		65	@Test func deepRecursionFitsABackgroundStack() async {
		66	let done = await withCheckedContinuation { continuation in
		67	let thread = Thread {
		68	continuation.resume(returning: ElispTests.ours("(funcall (lambda (f) (funcall f f)) (lambda (f) (funcall f f)))"))
		69	}
		70	thread.stackSize = 512 * 1024
		71	thread.start()
		72	}
		73	#expect(done == "error")
		74	}
		75
		76	@Test func diaryFunctionsRefuseWithoutCrashing() throws {
		77	let day = Days.absolute(year: 2026, month: 10, day: 7)
		78	for form in ["(calendar-last-day-of-month -20 2024)", "(calendar-gregorian-from-absolute 9223372036854775807)",
		79	"(calendar-nth-named-absday -9223372036854775808 1 10 2026)", "(diary-remind '(diary-date 1 1 2027) -9223372036854775808)",
		80	"(diary-float 10 3 -9223372036854775808)", "(diary-anniversary 10 7 -9223372036854775808)"] {
		81	#expect(DiarySexp.entries(try LispReader.readFirst(form).sexp, entry: "E", day: day) == nil, "\(form)")
		82	}
		83	}
		84
		85	@Test func durationsAndHugeNumbersDoNotCrashFormulas() {
		86	for table in [
		87	"\| 1e300 \| \|\n#+TBLFM: $2=$12;T\n", "\| 1e300 \| \|\n#+TBLFM: $2='( $1 2);T\n", "\| 9999999999999999:00:00 \| \|\n#+TBLFM: $2=$1;T\n",
		88	"\| 1 \| \|\n#+TBLFM: $2=$1;p99999999999999999999\n", "\| 1 \| \|\n#+TBLFM: $2=$99999999999999999999\n",
		89	"\| 1 \| \|\n#+TBLFM: @99999999999999999999$2=1\n", "#+CONSTANTS: a=$a\n\| 1 \| \|\n#+TBLFM: $2=$a\n",
		90	] {
		91	let caret = (table as NSString).range(of: "#+TBLFM").location + 3
		92	let result = runCommand(TableRecalculate(all: true), table, caret: caret)
		93	#expect(result.text == table, "\(table)")
		94	}
		95	}
		96	}

Commit b4ec29e3b2

Commit `b4ec29e3b2`