diff --git a/‎lib/rules_core/smartquotes.mjs‎
Lines changed: 48 additions & 27 deletions b/‎lib/rules_core/smartquotes.mjs‎
Lines changed: 48 additions & 27 deletions
diff --git a/‎test/markdown-it/pathological.test.mjs‎
Lines changed: 5 additions & 0 deletions b/‎test/markdown-it/pathological.test.mjs‎
Lines changed: 5 additions & 0 deletions
@@ -6,6 +6,19 @@ import { isWhiteSpace, isPunctCharCode, isMdAsciiPunct } from '../common/utils.m
 const QUOTE_TEST_RE = /['"]/
 const QUOTE_RE = /['"]/g
 const APOSTROPHE = '\u2019' /* ’ */
+// Caps memory on malicious input
+const MAX_OPENERS = 1000
+
+function truncateStack (stack, heads, length) {
+  while (stack.length > length) {
+    const item = stack.pop()
+    if (item.isSingleQuote) {
+      heads.single = item.prevSameQuoteIdx
+    } else {
+      heads.double = item.prevSameQuoteIdx
+    }
+  }
+}
 
 function addReplacement (replacements, tokenIdx, pos, ch) {
   if (!replacements[tokenIdx]) {
@@ -35,6 +48,8 @@ function process_inlines (tokens, state) {
   let j
 
   const stack = []
+  // stack indexes of topmost openers of each type (-1 if none)
+  const heads = { single: -1, double: -1 }
   // token index -> list of replacements in the original token content
   const replacements = {}
 
@@ -46,7 +61,7 @@ function process_inlines (tokens, state) {
     for (j = stack.length - 1; j >= 0; j--) {
       if (stack[j].level <= thisLevel) { break }
     }
-    stack.length = j + 1
+    truncateStack(stack, heads, j + 1)
 
     if (token.type !== 'text') { continue }
 
@@ -150,39 +165,45 @@ function process_inlines (tokens, state) {
       }
 
       if (canClose) {
-        // this could be a closing quote, rewind the stack to get a match
-        for (j = stack.length - 1; j >= 0; j--) {
-          let item = stack[j]
-          if (stack[j].level < thisLevel) { break }
-          if (item.single === isSingle && stack[j].level === thisLevel) {
-            item = stack[j]
-
-            let openQuote
-            let closeQuote
-            if (isSingle) {
-              openQuote = state.md.options.quotes[2]
-              closeQuote = state.md.options.quotes[3]
-            } else {
-              openQuote = state.md.options.quotes[0]
-              closeQuote = state.md.options.quotes[1]
-            }
-
-            addReplacement(replacements, i, t.index, closeQuote)
-            addReplacement(replacements, item.token, item.pos, openQuote)
-
-            stack.length = j
-            continue OUTER
+        // Stack levels never decrease, so an opener of this type below
+        // the current level means there is no match
+        j = isSingle ? heads.single : heads.double
+        if (j >= 0 && stack[j].level === thisLevel) {
+          const item = stack[j]
+
+          let openQuote
+          let closeQuote
+          if (isSingle) {
+            openQuote = state.md.options.quotes[2]
+            closeQuote = state.md.options.quotes[3]
+          } else {
+            openQuote = state.md.options.quotes[0]
+            closeQuote = state.md.options.quotes[1]
           }
+
+          addReplacement(replacements, i, t.index, closeQuote)
+          addReplacement(replacements, item.tokenIdx, item.contentPos, openQuote)
+
+          truncateStack(stack, heads, j)
+          continue OUTER
         }
       }
 
       if (canOpen) {
+        if (stack.length >= MAX_OPENERS) { return }
         stack.push({
-          token: i,
-          pos: t.index,
-          single: isSingle,
-          level: thisLevel
+          tokenIdx: i,
+          contentPos: t.index,
+          isSingleQuote: isSingle,
+          level: thisLevel,
+          // stack index of the previous opener of the same quote type, -1 if none
+          prevSameQuoteIdx: isSingle ? heads.single : heads.double
         })
+        if (isSingle) {
+          heads.single = stack.length - 1
+        } else {
+          heads.double = stack.length - 1
+        }
       } else if (canClose && isSingle) {
         addReplacement(replacements, i, t.index, APOSTROPHE)
       }
 
@@ -164,5 +164,10 @@ describe('Pathological sequences speed', () => {
     it('a lot of smartquotes', async () => {
       await test_pattern('"'.repeat(160000), { typographer: true })
     })
+
+    it('smartquotes with mismatched opener and closer types', async () => {
+      await test_pattern('"a '.repeat(100000) + "b' ".repeat(100000), { typographer: true })
+      await test_pattern("'a ".repeat(100000) + 'b" '.repeat(100000), { typographer: true })
+    })
   })
 })