fix(c,cpp): quadratic ReDoS in FUNCTION_DECLARATION regex (#4362)

[xxiaoxiong]

Description

Fixes a quadratic ReDoS vulnerability in the C/C++ FUNCTION_DECLARATION regex.

Root Cause

The pattern for FUNCTION_DECLARATION contains a nested quantifier:

begin: '(' + FUNCTION_TYPE_RE + '[\*&\s]+)+' + FUNCTION_TITLE,

The outer + wraps a group whose inner [\*&\s]+ also uses +. When applied to input without a matching function title (e.g. repeated words separated by spaces), the regex engine tries all possible ways to partition whitespace between the inner and outer groups, resulting in O(n²) backtracking.

Fix

Restructured the pattern to avoid the nested quantifier by splitting the outer + into an outer * (repeating type+modifier pairs) plus a final optional type pair:

begin: '(' + FUNCTION_TYPE_RE + '\s*[\*&]+\s*)*(?:' + FUNCTION_TYPE_RE + '\s*[\*&]*\s*)?' + FUNCTION_TITLE,

PoC

const hljs = require('highlight.js');
for (const n of [2000, 4000, 8000, 16000, 32000]) {
  const start = process.hrtime.bigint();
  hljs.highlight('a '.repeat(n), { language: 'c', ignoreIllegals: true });
  const ms = Number(process.hrtime.bigint() - start) / 1e6;
  console.log(`len=${(n*2).toString().padStart(6)}: ${ms.toFixed(0)}ms`);
}

Affected Languages

• C (c.js)
• C++ (cpp.js)
• Arduino (inherits from C++)

Fixes #4362