Rangecheck bookmarks

Fixes #1576

CHANGES

@@ -4,6 +4,9 @@ jsoup changelog
   * Bugfix [Fuzz]: fixed a slow parse when a tag has thousands of null characters in it.
     <https://github.com/jhy/jsoup/issues/1580>
 
+  * Bugfix [Fuzz]: the adoption agency algorithm can have an incorrect bookmark position
+    <https://github.com/jhy/jsoup/issues/1576>
+
 *** Release 1.14.1 [2021-Jul-10]
   * Change: updated the minimum supported Java version from Java 7 to Java 8.
 

src/main/java/org/jsoup/parser/HtmlTreeBuilder.java

@@ -631,13 +631,18 @@ Element removeLastFormattingElement() {
 
     // active formatting elements
     void pushActiveFormattingElements(Element in) {
-        this.checkActiveFormattingElements(in);
+        checkActiveFormattingElements(in);
         formattingElements.add(in);
     }
 
-    void pushWithBookmark(Element in,int bookmark){
-        this.checkActiveFormattingElements(in);
-        formattingElements.add(bookmark, in);
+    void pushWithBookmark(Element in, int bookmark){
+        checkActiveFormattingElements(in);
+        // catch any range errors and assume bookmark is incorrect - saves a redundant range check.
+        try {
+            formattingElements.add(bookmark, in);
+        } catch (IndexOutOfBoundsException e) {
+            formattingElements.add(in);
+        }
     }
 
     void checkActiveFormattingElements(Element in){

src/test/java/org/jsoup/integration/FuzzFixesTest.java

@@ -78,4 +78,15 @@ public void parseTimeout1580() throws IOException {
         Document doc = Jsoup.parse(in, "UTF-8");
         assertNotNull(doc);
     }
+
+    @Test
+    public void bookmark() {
+        // https://github.com/jhy/jsoup/issues/1576
+        String html = "<?a<U<P<A ";
+        Document doc = Jsoup.parse(html);
+        assertNotNull(doc);
+
+        Document xmlDoc = Parser.xmlParser().parseInput(html, "");
+        assertNotNull(xmlDoc);
+    }
 }