Prevent memory crash when building Query Nodes

CHANGELOG.md

@@ -6,6 +6,7 @@
 
 ### Fixed
 * `SyncSession::pause()` could hold a reference to the database open after shutting down the sync session, preventing users from being able to delete the realm. ([#6372](https://github.com/realm/realm-core/issues/6372), since v13.3.0)
+* Prevented memory crash when having a query with more than 1000 logical clauses. (PR [#6428](https://github.com/realm/realm-core/pull/6428))
 
 ### Breaking changes
 * None.

src/realm/parser/driver.hpp

@@ -30,7 +30,7 @@ class QueryNode : public ParserNode {
 public:
     ~QueryNode() override;
     virtual Query visit(ParserDriver*) = 0;
-    virtual void canonicalize() {}
+    virtual void canonicalize(int depth = 0) {}
 };
 
 class TrueOrFalseNode : public QueryNode {
@@ -47,18 +47,24 @@ class TrueOrFalseNode : public QueryNode {
 
 class LogicalNode : public QueryNode {
 public:
+    static constexpr int MAX_DEPTH_OF_LOGICAL_NODES = 1000;
     std::vector<QueryNode*> children;
     LogicalNode(QueryNode* left, QueryNode* right)
     {
         children.emplace_back(left);
         children.emplace_back(right);
     }
-    void canonicalize() override
+    void canonicalize(int depth = 0) override
     {
+        if (depth >= MAX_DEPTH_OF_LOGICAL_NODES) {
+            throw InvalidQueryError("The query has too many conditions.");
+        }
+        depth++;        
         std::vector<QueryNode*> newChildren;
         auto& my_type = typeid(*this);
         for (auto& child : children) {
-            child->canonicalize();
+
+            child->canonicalize(depth);
             if (typeid(*child) == my_type) {
                 auto logical_node = static_cast<LogicalNode*>(child);
                 for (auto c : logical_node->children) {

test/object-store/c_api/c_api.cpp

@@ -2357,6 +2357,19 @@ TEST_CASE("C API", "[c_api]") {
                 // Invalid number of arguments
                 CHECK(!realm_query_parse(realm, class_foo.key, "string == $0", 0, nullptr));
                 CHECK_ERR_CAT(RLM_ERR_INDEX_OUT_OF_BOUNDS, (RLM_ERR_CAT_INVALID_ARG | RLM_ERR_CAT_LOGIC));
+
+                // Query logical nodes count exceeded
+                std::string query;
+                int exceeded_max_count = 1001;
+                for (int node_id = 0; node_id <= exceeded_max_count; node_id++) {
+                    std::stringstream node;
+                    node << "_id=oid(" << ObjectId().gen().to_string() << ")"
+                         << (node_id < exceeded_max_count ? " OR " : "");
+                    query.append(node.str());
+                }
+                const char* queryString = query.c_str();
+                CHECK(!realm_query_parse(realm, class_foo.key, queryString, 0, nullptr));
+                CHECK_ERR_CAT(RLM_ERR_INVALID_QUERY, (RLM_ERR_CAT_INVALID_ARG | RLM_ERR_CAT_LOGIC));
             }
 
             SECTION("decimal NaN") {