From d86056fee6d181d6d6355cb6b56e19104b06add2 Mon Sep 17 00:00:00 2001
From: Brad Jorsch <bjorsch@wikimedia.org>
Date: Thu, 13 Oct 2016 12:53:31 -0400
Subject: [PATCH] Avoid blowing up inside Parser::extensionSubstitution() when
 PP limits are exceeded

The most critical one is if the marker name is bad, since that causes
StripState to throw an exception since I798d31af. But we may as well
check the other expand calls in this function too to avoid outputting
broken wikitext.

Bug: T136401
Change-Id: I1cb353d74f9a46168055e1abeb22cf569fe9354a
---
 includes/parser/Parser.php | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/includes/parser/Parser.php b/includes/parser/Parser.php
index a32acc2d36..f0898bad51 100644
--- a/includes/parser/Parser.php
+++ b/includes/parser/Parser.php
@@ -3784,9 +3784,28 @@ class Parser {
 	 * @return string
 	 */
 	public function extensionSubstitution( $params, $frame ) {
+		static $errorStr = '<span class="error">';
+		static $errorLen = 20;
+
 		$name = $frame->expand( $params['name'] );
+		if ( substr( $name, 0, $errorLen ) === $errorStr ) {
+			// Probably expansion depth or node count exceeded. Just punt the
+			// error up.
+			return $name;
+		}
+
 		$attrText = !isset( $params['attr'] ) ? null : $frame->expand( $params['attr'] );
+		if ( substr( $attrText, 0, $errorLen ) === $errorStr ) {
+			// See above
+			return $attrText;
+		}
+
 		$content = !isset( $params['inner'] ) ? null : $frame->expand( $params['inner'] );
+		if ( substr( $content, 0, $errorLen ) === $errorStr ) {
+			// See above
+			return $content;
+		}
+
 		$marker = self::MARKER_PREFIX . "-$name-"
 			. sprintf( '%08X', $this->mMarkerIndex++ ) . self::MARKER_SUFFIX;
 
@@ -3844,6 +3863,10 @@ class Parser {
 				$output = "<$name$attrText/>";
 			} else {
 				$close = is_null( $params['close'] ) ? '' : $frame->expand( $params['close'] );
+				if ( substr( $close, 0, $errorLen ) === $errorStr ) {
+					// See above
+					return $close;
+				}
 				$output = "<$name$attrText>$content$close";
 			}
 		}
-- 
2.20.1