Created attachment 27240 [details]
crash and script

Opening a maliciously crafted epub file when opened in mupdf leads to crash / stack overflow with infinite recursion

Private the attached documents please!!

Build - Latest mupdf build 12/9/2025 cloned from github ( 1.26.8 )

Tested - Windows 10 and Windows 11

Steps to reproduce :-
-> Open the crashing file in mupdf

I have attached the script to re-create these crashing epub files and also epub file itself.

The vulnerability lies in fz_parse_css_properties which was exploited using a special python script to generate epub files

working of script :-
- It builds a minimal EPUB container (mimetype, META-INF/container.xml, content.opf).
- It generates crash.xhtml with:
- 1,500 nested <div style="display:block"> … </div> tags
Inside, a <p>boom</p> element.

Example :-
<html>
  <body>
    <div style="display:block">
      <div style="display:block">
        ...tons and tons
        <div style="display:block">
          <p>boom</p>
        </div>
        ...
      </div>
    </div>
  </body>
</html>


(145c.220c): Stack overflow - code c00000fd (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
mupdf!css_lex_init [inlined in mupdf!fz_parse_css_properties+0x26]:
00007ff6`3c78eae6 48894c2420      mov     qword ptr [rsp+20h],rcx ss:000000dd`c6403e40=0000000000000000

Call Stack :-

 # Child-SP          RetAddr               Call Site
00 (Inline Function) --------`--------     mupdf!css_lex_init [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\css-parse.c @ 242] 
01 000000dd`c6403e20 00007ff6`3c78127c     mupdf!fz_parse_css_properties+0x26 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\css-parse.c @ 1160] 
02 000000dd`c64042c0 00007ff6`3c6f6155     mupdf!fz_match_css+0x1ac [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\css-apply.c @ 1088] 
03 000000dd`c6404330 00007ff6`3c6f6031     mupdf!gen2_children+0xa5 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1492] 
04 000000dd`c6404880 00007ff6`3c6f64a3     mupdf!gen2_tag+0x8d1 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1473] 
05 000000dd`c6404940 00007ff6`3c6f6031     mupdf!gen2_children+0x3f3 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1519] 
06 000000dd`c6404e90 00007ff6`3c6f64a3     mupdf!gen2_tag+0x8d1 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1473] 
07 000000dd`c6404f50 00007ff6`3c6f6031     mupdf!gen2_children+0x3f3 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1519] 
08 000000dd`c64054a0 00007ff6`3c6f64a3     mupdf!gen2_tag+0x8d1 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1473] 
09 000000dd`c6405560 00007ff6`3c6f6031     mupdf!gen2_children+0x3f3 [C:\Users\ishay\OneDrive\Desktop\mupdf\mupdf\source\html\html-parse.c @ 1519] 
.. continues

further leads to Access Violations 
0:000> g
(145c.220c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
WARNING: Stack overflow detected. The unwound frames are extracted from outside normal stack bounds.
mupdf!css_lex_init [inlined in mupdf!fz_parse_css_properties+0x26]:
00007ff6`3c78eae6 48894c2420      mov     qword ptr [rsp+20h],rcx ss:000000dd`c6400dc0=????????????????
0:000> g
(145c.220c): Access violation - code c0000005 (!!! second chance !!!)
mupdf!css_lex_init [inlined in mupdf!fz_parse_css_properties+0x26]:
00007ff6`3c78eae6 48894c2420      mov     qword ptr [rsp+20h],rcx ss:000000dd`c6400dc0=????????????????

:000> r
rax=0000194dd405e978 rbx=0000028f723935a0 rcx=0000028f723935a0
rdx=0000028f77952fc0 rsi=0000028f785881c8 rdi=0000000000000000
rip=00007ff63c78eae6 rsp=000000ddc6400da0 rbp=000000ddc6400ea0
 r8=0000028f78588210  r9=0000028f785881f8 r10=0000028f723935a0
r11=00007ff63cbc3b48 r12=000000ddc64014f0 r13=0000028f78588210
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010206
mupdf!css_lex_init [inlined in mupdf!fz_parse_css_properties+0x26]:
00007ff6`3c78eae6 48894c2420      mov     qword ptr [rsp+20h],rcx ss:000000dd`c6400dc0=????????????????


static void css_lex_init(fz_context *ctx, struct lexbuf *buf, fz_pool *pool, const char *s, const char *file)
{
	buf->ctx = ctx;
	buf->pool = pool;
	buf->s = (const unsigned char *)s;
	buf->lookahead = EOF;
	buf->start = buf->s;
	buf->c = -1;
	buf->file = file;
	buf->line = 1;
	buf->nest = 0;
	css_lex_next(buf);

	buf->string_len = 0;
}


fz_css_property *fz_parse_css_properties(fz_context *ctx, fz_pool *pool, const char *source)
{
	struct lexbuf buf;
	css_lex_init(ctx, &buf, pool, source, "<inline>");
	next(&buf);
	return parse_declaration_list(&buf);
}

Cause of crash :-
Each <div> with style="display:block" forces MuPDF’s CSS/XHTML engine to parse and apply CSS properties recursively.

Functions like fz_parse_css_properties → css_lex_init → css_lex_next do recursive descent parsing.

With 1500 nested <div> elements, the parser keeps recursing deeper without a nesting limit.

Eventually, the call stack grows until it hits Windows’ per-thread stack limit (~1 MB by default).

Quick Fix :-
- Add a nesting-depth limit (quickest patch)

- Track a depth counter in the CSS/XHTML parsing code (css-parse.c /css_lex_next).

- Increment on entering a new nested element (e.g. <div>).

- If depth > MAX_DEPTH (say 256 or 512), abort parsing gracefully with an error instead of recursing further.

- Decrement on exit

The crash analysis is done on release build, if needed for debug build, I will provide it