Repository: pest-parser/pest (language: rust)

Issue:
oss-fuzz: pest:parser: ASSERT: index out of bounds: the len is 0 but the index is 8
**Describe the bug**
Fuzzing found a crash due to indexing an empty vector.
https://github.com/pest-parser/pest/blob/9c42f1293aa999b24cd8dea70469da3be3a4c9eb/pest/src/parser_state.rs#L309

```
thread '<unnamed>' panicked at 'index out of bounds: the len is 0 but the index is 8', [pest/pest/src/parser_state.rs:309](https://github.com/pest-parser/pest/blob/9c42f1293aa999b24cd8dea70469da3be3a4c9eb/pest/src/parser_state.rs#L309):27
```

**To Reproduce**
minimal sample:
```
f={f{/*/*6/*6/*6/*5/*6*6/*6/*6/*5/*7//*
```

**Expected behavior**
No crash

**Additional context**
https://oss-fuzz.com/testcase-detail/5457878206513152


Discussion / hints:

Fix patch:
diff --git a/meta/src/parser.rs b/meta/src/parser.rs
index a5b2a078..3185131c 100644
--- a/meta/src/parser.rs
+++ b/meta/src/parser.rs
@@ -1518,6 +1518,10 @@ mod tests {
             env!("CARGO_MANIFEST_DIR"),
             "/resources/test/fuzzsample3.grammar"
         ));
+        let sample4 = include_str!(concat!(
+            env!("CARGO_MANIFEST_DIR"),
+            "/resources/test/fuzzsample4.grammar"
+        ));
         const ERROR: &str = "call limit reached";
         pest::set_call_limit(Some(25_000usize.try_into().unwrap()));
         let s1 = crate::parser::parse(crate::parser::Rule::grammar_rules, sample1);
@@ -1529,5 +1533,8 @@ mod tests {
         let s3 = crate::parser::parse(crate::parser::Rule::grammar_rules, sample3);
         assert!(s3.is_err());
         assert_eq!(s3.unwrap_err().variant.message(), ERROR);
+        let s4 = crate::parser::parse(crate::parser::Rule::grammar_rules, sample4);
+        assert!(s4.is_err());
+        assert_eq!(s4.unwrap_err().variant.message(), ERROR);
     }
 }
diff --git a/pest/src/parser_state.rs b/pest/src/parser_state.rs
index 76f0c26c..a4422e86 100644
--- a/pest/src/parser_state.rs
+++ b/pest/src/parser_state.rs
@@ -228,7 +228,6 @@ impl<'i, R: RuleType> ParserState<'i, R> {
     #[inline]
     fn inc_call_check_limit(mut self: Box<Self>) -> ParseResult<Box<Self>> {
         if self.call_tracker.limit_reached() {
-            self.queue.clear();
             return Err(self);
         }
         self.call_tracker.increment_depth();


Test patch:
diff --git a/meta/resources/test/fuzzsample4.grammar b/meta/resources/test/fuzzsample4.grammar
new file mode 100644
index 00000000..8c5caba5
--- /dev/null
+++ b/meta/resources/test/fuzzsample4.grammar
@@ -0,0 +1,1 @@
+f={f{/*/*6/*6/*6/*5/*6*6/*6/*6/*5/*7//*
\ No newline at end of file