Crash with large `max_playlist_length` value

Bug report

Describe the bug

MPD crashes when max_playlist_length configuration option has a sufficiently large value, e.g. in my case it was "1234567890".

Expected Behavior

MPD prints an error that the provided value is invalid (too large) and exits with a non-zero status.

Actual Behavior

MPD crashes with std::bad_alloc.

Version

Music Player Daemon 0.23.15 (v0.23.15)
Copyright 2003-2007 Warren Dukes <[email protected]>
Copyright 2008-2021 Max Kellermann <[email protected]>
This is free software; see the source for copying conditions.  There is NO
warranty; not even MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Database plugins:
 simple proxy upnp

Storage plugins:
 local udisks nfs curl

Neighbor plugins:
 upnp udisks

Decoders plugins:
 [mad] mp3 mp2
 [mpg123] mp3
 [vorbis] ogg oga
 [oggflac] ogg oga
 [flac] flac
 [opus] opus ogg oga
 [sndfile] wav aiff aif au snd paf iff svx sf voc w64 pvf xi htk caf sd2
 [audiofile] wav au aiff aif
 [dsdiff] dff
 [dsf] dsf
 [hybrid_dsd] m4a
 [faad] aac
 [mpcdec] mpc
 [wavpack] wv
 [openmpt] mptm mod s3m xm it 669 amf ams c67 dbm digi dmf dsm dtm far imf ice j2b m15 mdl med mms mt2 mtm nst okt plm psm pt36 ptm sfx sfx2 st26 stk stm stp ult wow gdm mo3 oxm umx xpk ppm mmcmp
 [modplug] 669 amf ams dbm dfm dsm far it med mdl mod mtm mt2 okt s3m stm ult umx xm
 [mikmod] amf dsm far gdm imf it med mod mtm s3m stm stx ult uni xm
 [sidplay] sid mus str prg P00
 [wildmidi] mid
 [fluidsynth] mid
 [gme] ay gbs gym hes kss nsf nsfe rsn sap spc vgm vgz
 [ffmpeg] 16sv 3g2 3gp 4xm 8svx aa3 aac ac3 adx afc aif aifc aiff al alaw amr anim apc ape asf atrac au aud avi avm2 avs bap bfi c93 cak cin cmv cpk daud dct divx dts dv dvd dxa eac3 film flac flc fli fll flx flv g726 gsm gxf iss m1v m2v m2t m2ts m4a m4b m4v mad mj2 mjpeg mjpg mka mkv mlp mm mmf mov mp+ mp1 mp2 mp3 mp4 mpc mpeg mpg mpga mpp mpu mve mvi mxf nc nsv nut nuv oga ogm ogv ogx oma ogg omg opus psp pva qcp qt r3d ra ram rl2 rm rmvb roq rpl rvc shn smk snd sol son spx str swf tak tgi tgq tgv thp ts tsp tta xa xvid uv uv2 vb vid vob voc vp6 vmd wav webm wma wmv wsaud wsvga wv wve rtp:// rtsp:// rtsps://
 [pcm]

Filters:
 libsamplerate soxr

Tag plugins:
 id3tag

Output plugins:
 shout null fifo pipe alsa ao openal pipewire pulse jack httpd snapcast recorder

Encoder plugins:
 null vorbis opus lame twolame wave flac

Archive plugins:
 [bz2] bz2
 [zzip] zip
 [iso] iso

Input plugins:
 file io_uring archive alsa qobuz curl ffmpeg nfs mms cdio_paranoia

Playlist plugins:
 extm3u m3u pls xspf asx rss soundcloud flac cue embcue

Protocols:
 file:// alsa:// cdda:// ftp:// ftps:// gopher:// hls+http:// hls+https:// http:// https:// mms:// mmsh:// mmst:// mmsu:// nfs:// qobuz:// rtmp:// rtmpe:// rtmps:// rtmpt:// rtmpte:// rtmpts:// rtp:// rtsp:// rtsps:// scp:// sftp:// smb:// srtp://

Other features:
 avahi dbus udisks epoll icu inotify ipv6 systemd tcp un

Configuration

max_playlist_length "1234567890"

Log

config_file: loading file mpd.conf

Backtrace

#0  0x00007ffff18ac83c in  () at /usr/lib/libc.so.6
#1  0x00007ffff185c668 in raise () at /usr/lib/libc.so.6
#2  0x00007ffff18444b8 in abort () at /usr/lib/libc.so.6
#3  0x00007ffff1a9ca6f in __gnu_cxx::__verbose_terminate_handler() () at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/vterminate.cc:95
#4  0x00007ffff1ab011c in __cxxabiv1::__terminate(void (*)()) (handler=<optimized out>) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/eh_terminate.cc:48
#5  0x00007ffff1aaf0aa in __cxa_call_terminate(_Unwind_Exception*) (ue_header=0x5555558f0b80) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/eh_call.cc:54
#6  0x00007ffff1aaf82a in __cxxabiv1::__gxx_personality_v0(int, _Unwind_Action, _Unwind_Exception_Class, _Unwind_Exception*, _Unwind_Context*)
    (version=<optimized out>, actions=6, exception_class=5138137972254386944, ue_header=<optimized out>, context=0x7fffffffb5a0)
    at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/eh_personality.cc:688
#7  0x00007ffff1d1f52a in _Unwind_RaiseException_Phase2 (exc=exc@entry=0x5555558f0b80, context=context@entry=0x7fffffffb5a0, frames_p=frames_p@entry=0x7fffffffb690)
    at /usr/src/debug/gcc/gcc/libgcc/unwind.inc:64
#8  0x00007ffff1d1fc52 in _Unwind_RaiseException (exc=0x5555558f0b80) at /usr/src/debug/gcc/gcc/libgcc/unwind.inc:136
#9  0x00007ffff1ab03de in __cxxabiv1::__cxa_throw(void*, std::type_info*, void (*)(void*))
    (obj=<optimized out>, tinfo=0x7ffff1c6ab28 <typeinfo for std::bad_alloc>, dest=0x7ffff1aae680 <std::bad_alloc::~bad_alloc()>)
    at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/eh_throw.cc:93
#10 0x00007ffff1a9c4f3 in operator new(unsigned long) (sz=29629629360) at /usr/src/debug/gcc/gcc/libstdc++-v3/libsupc++/new_op.cc:54
#11 0x00005555555d2c11 in Queue::Queue(unsigned int) (this=0x55555591b668, _max_length=1234567890) at ../../src/queue/Queue.cxx:27
#12 0x00005555555c3d84 in playlist::playlist(unsigned int, QueueListener&) (this=0x55555591b668, max_length=1234567890, _listener=...) at ../../src/queue/Playlist.hxx:97
#13 0x00005555555c3401 in Partition::Partition(Instance&, char const*, unsigned int, unsigned int, AudioFormat, ReplayGainConfig const&)
--Type <RET> for more, q to quit, c to continue without paging--
    (this=0x55555591b590, _instance=..., _name=0x5555557b5605 "default", max_length=1234567890, buffer_chunks=1024, configured_audio_format=..., replay_gain_config=...)
    at ../../src/Partition.cxx:45
#14 0x0000555555590423 in std::__new_allocator<std::_List_node<Partition> >::construct<Partition, Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&>(Partition*, Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&)
    (__p=0x55555591b590, this=0x7fffffffd7a0) at /usr/include/c++/13.2.1/bits/new_allocator.h:187
#15 std::allocator_traits<std::allocator<std::_List_node<Partition> > >::construct<Partition, Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&>(std::allocator<std::_List_node<Partition> >&, Partition*, Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&) (__p=0x55555591b590, __a=...) at /usr/include/c++/13.2.1/bits/alloc_traits.h:537
#16 std::__cxx11::list<Partition, std::allocator<Partition> >::_M_create_node<Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&>(Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&) (this=0x7fffffffd7a0)
    at /usr/include/c++/13.2.1/bits/stl_list.h:713
#17 0x000055555558f3b8 in std::__cxx11::list<Partition, std::allocator<Partition> >::_M_insert<Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&>(std::_List_iterator<Partition>, Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&) (this=0x7fffffffd7a0, __position=...) at /usr/include/c++/13.2.1/bits/stl_list.h:2005
#18 0x000055555558e0af in std::__cxx11::list<Partition, std::allocator<Partition> >::emplace_back<Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&>(Instance&, char const (&) [8], unsigned int const&, unsigned int const&, AudioFormat&, ReplayGainConfig const&) (this=0x7fffffffd7a0)
    at /usr/include/c++/13.2.1/bits/stl_list.h:1321
#19 0x000055555558a9d6 in initialize_decoder_and_player(Instance&, ConfigData const&, ReplayGainConfig const&) (instance=..., config=..., replay_gain_config=...)
    at ../../src/Main.cxx:337
#20 0x000055555558af4b in MainConfigured(CommandLineOptions const&, ConfigData const&) (options=..., raw_config=...) at ../../src/Main.cxx:428
#21 0x000055555558b92a in MainOrThrow(int, char**) (argc=5, argv=0x7fffffffdb98) at ../../src/Main.cxx:694
#22 0x000055555558b9a6 in mpd_main(int, char**) (argc=5, argv=0x7fffffffdb98) at ../../src/Main.cxx:700
#23 0x000055555558ba09 in main(int, char**) (argc=5, argv=0x7fffffffdb98) at ../../src/Main.cxx:712