Improper Validation of Specified Index, Position, or Offset in Input Affecting ratex-parser package, versions <0.1.11

ratex-parser is a LaTeX parser for RaTeX

Affected versions of this package are vulnerable to Improper Validation of Specified Index, Position, or Offset in Input due to UTF-8 byte-boundary slicing in the parse_symbol_inner handling of \verb commands in crates/ratex-parser/src/parser.rs. An attacker can crash the process by supplying a \verb delimiter that is a multibyte character, such as \verbéxé, which triggers a slice starting inside the delimiter character. This aborts parsing for untrusted LaTeX input and, in release builds configured with panic = "abort", can take down the entire service or application process. Users lose availability of any endpoint or pipeline that renders attacker-controlled TeX.

Notes

• The crash is reachable through the public ratex_parser::parse(&str) entry point, so any caller that accepts attacker-supplied LaTeX through that API inherits the DoS risk.
• The issue is not limited to the non-starred form; the parser’s \verb* path uses the same slicing logic and can panic on a multibyte delimiter there as well.

• GitHub Commit v0.1.11
• Maintainer's Advisory