{"id":"RUSTSEC-2026-0311","summary":"Stack overflow on deeply nested LaTeX input","details":"The parser and layout engine in affected versions of `latex-rust` recurse once\nper level of nesting with no limit. Deeply nested input, such as `\\frac{1}{…}`,\nbraces, `\\sqrt{…}`, `\\left(`, or superscripts nested hundreds or thousands of\nlevels deep, exhausts the call stack.\n\nA stack overflow in Rust aborts the process. It is not a panic, so it cannot be\ncaught with `catch_unwind`. A program that renders LaTeX from untrusted input\ncan therefore be terminated by a short string. With a release build on an 8 MiB\nstack, 700 nested `\\frac{1}{…}` (about 7 KB of input) abort version 1.0.4, and\n10,000 nested braces (about 20 KB) abort it as well. The threshold is lower on\nsmaller stacks and in debug builds; on a 2 MiB thread in a debug build, about\n35 nested fractions are enough.\n\n```rust\nlet mut src = String::from(\"1\");\nfor _ in 0..700 {\n    src = format!(\"\\\\frac{{1}}{{{src}}}\");\n}\nlet _ = latex_rust::parse(&src); // stack overflow, process aborts\n```\n\nThe fixed versions count nesting depth in the parser and in `layout` and\nrefuse input that nests more than 32 levels. `parse`, `parse_with_colors`, and\nthe `latex_to_*` functions return\n`ParseError::Malformed(\"input nests deeper than 32 levels\")`, and `layout`\nreturns `Error::Unsupported { what: \"tree nests deeper than 32 levels\" }` for a\ntree built by hand. The count is of parser recursion levels, and a braced\nargument costs two, so the limit admits 15 nested `\\frac`, `\\sqrt`, or\n`x^{…}`, and 31 nested groups, `\\left…\\right` pairs, or environments. Input\npast the limit is refused within about 100 KiB of stack in an optimised build.\n\nVersion 1.0.5 fixes this with no API changes and is a drop-in replacement for\n1.0.4; upgrade with `cargo update -p latex-rust`. It also includes the 2.0.0\nrendering fixes, so rendered output differs from 1.0.4. Versions 2.0.0 and\n2.0.1 contain the same fix, with the same limit and messages, together with\nbreaking API changes relative to 1.x, and also let callers change the limit\nwith `ParseOptions` and `layout_with_max_depth`.","modified":"2026-09-28T08:45:03.080376729Z","published":"2026-09-27T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/latex-rust"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0311.html"},{"type":"REPORT","url":"https://github.com/jscarr64/LaTeX-Rust/issues/6"},{"type":"WEB","url":"https://github.com/jscarr64/LaTeX-Rust/pull/10"},{"type":"WEB","url":"https://github.com/jscarr64/LaTeX-Rust/releases/tag/v1.0.5"}],"affected":[{"package":{"name":"latex-rust","ecosystem":"crates.io","purl":"pkg:cargo/latex-rust"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"1.0.5"}]}],"ecosystem_specific":{"affects":{"functions":["latex_rust::latex_to_png","latex_rust::latex_to_shapes","latex_rust::latex_to_svg","latex_rust::layout","latex_rust::layout_with_numbering","latex_rust::parse","latex_rust::parse_with_colors"],"arch":[],"os":[]},"affected_functions":null},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0311.json","informational":null,"categories":["denial-of-service"],"cvss":null}}],"schema_version":"1.9.0"}