Hi!
I've found a bug in Org-Mode export to the ODT format.
Let there be a huge LaTeX formula (e.g. generated from Org-Babel) inside an Org
file. If we export it to ODT with #+OPTIONS: tex:t (to embed formulas in MathML
format), a produced huge MathML file triggers stack overflow in
re-search-forward called from org-create-math-formula. 99 Kilobytes of MathML
is enough to trigger this.
The problem is that the regexp used there must match the whole produced XML.
This is obviously universal across different versions and configurations of
Org-Mode.
I've split this regexp in two: one is searching for the beginning of MathML,
and another — for its end. A patch is attached.
Just in case, I would like to mention that such ridiculously large formulas and
the need to export them to ODT resulted from a real-world use-case.
I hope it was helpful.
Mykhailo Mishchenko
From 6d871cbff0360b8b1d7b6e86a31d0d06c17d13bf Mon Sep 17 00:00:00 2001
From: Mykhailo Mishchenko <[email protected]>
Date: Wed, 2 Sep 2026 16:16:40 +0300
Subject: [PATCH] org-create-math-formula: fix regex matching stack overflow
---
lisp/org.el | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/lisp/org.el b/lisp/org.el
index 3803971ce..0d87c93b4 100644
--- a/lisp/org.el
+++ b/lisp/org.el
@@ -16915,11 +16915,13 @@ inspection."
(insert-file-contents tmp-out-file)
(goto-char (point-min))
(when (re-search-forward
- (format "<math[^>]*?%s[^>]*?>\\(.\\|\n\\)*</math>"
- (regexp-quote
- "xmlns=\"http://www.w3.org/1998/Math/MathML\"";))
- nil t)
- (match-string 0)))))
+ (format "<math[^>]*?%s[^>]*?>"
+ (regexp-quote
+ "xmlns=\"http://www.w3.org/1998/Math/MathML\"";))
+ nil t)
+ (let ((from (match-end 0)))
+ (when (re-search-forward "</math>" nil t)
+ (buffer-substring from (match-beginning 0))))))))
(cond
(mathml
(setq mathml
base-commit: b75b790398bb3a0cbd7d25a5a2e6237e73c0bc03
--
2.39.5
