Unratedcrates.ioPublished
Stack overflow on deeply nested LaTeX input
- Affected
- crates.io latex-rust >= 0.0.0-0, < 1.0.5
- Fixed in
- 1.0.5· Vendor fix available
- Issue
- The parser and layout engine in affected versions of `latex-rust` recurse once per level of nesting with no limit. Deeply nested input, such as `\frac{1}{…}`, braces, `\sqrt{…}`, `\left(`, or superscripts nested hundreds or thousands of levels deep, exhausts the call stack. A stack overflow in Rust aborts the process. It is not a panic, so it cannot be caught with `catch_unwind`. A program that renders LaTeX from untrusted input can therefore be terminated by a short string. With a release build on an 8 MiB stack, 700 nested `\frac{1}{…}` (about 7 KB of input) abort version 1.0.4, and 10,000 nested braces (about 20 KB) abort it as well. The threshold is lower on smaller stacks and in debug builds; on a 2 MiB thread in a debug build, about 35 nested fractions are enough. ```rust let mut src = String::from("1"); for _ in 0..700 { src = format!("\\frac{{1}}{{{src}}}"); } let _ = latex_rust::parse(&src); // stack overflow, process aborts ``` The fixed versions count nesting depth in the…
Recommended action: Upgrade to 1.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.