Make sure null elements aren't added to the stack

Fixes #1579
jhy · Jul 11, 2021 · 9031164 · 9031164
1 parent 478b568
commit 9031164
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 3 deletions.
diff --git a/CHANGES b/CHANGES
@@ -7,6 +7,9 @@ jsoup changelog
   * Bugfix [Fuzz]: the adoption agency algorithm can have an incorrect bookmark position
     <https://github.com/jhy/jsoup/issues/1576>
 
+  * Bugfiz [Fuzz]: malformed HTML could result in null elements on stack
+    <https://github.com/jhy/jsoup/issues/1579>
+
 *** Release 1.14.1 [2021-Jul-10]
   * Change: updated the minimum supported Java version from Java 7 to Java 8.
 

diff --git a/src/main/java/org/jsoup/parser/HtmlTreeBuilder.java b/src/main/java/org/jsoup/parser/HtmlTreeBuilder.java
@@ -356,6 +356,7 @@ boolean removeFromStack(Element el) {
         return false;
     }
 
+    @Nullable
     Element popStackToClose(String elName) {
         for (int pos = stack.size() -1; pos >= 0; pos--) {
             Element el = stack.get(pos);

diff --git a/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java b/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java
@@ -8,7 +8,6 @@
 import org.jsoup.nodes.Element;
 import org.jsoup.nodes.Node;
 
-import javax.annotation.Nullable;
 import java.util.ArrayList;
 
 import static org.jsoup.internal.StringUtil.inSorted;
@@ -1530,8 +1529,11 @@ boolean process(Token t, HtmlTreeBuilder tb) {
                 //  that space into body if other tags get re-added. but that's overkill for now
                 Element html = tb.popStackToClose("html");
                 tb.insert(t.asCharacter());
-                tb.stack.add(html);
-                tb.stack.add(html.selectFirst("body"));
+                if (html != null) {
+                    tb.stack.add(html);
+                    Element body = html.selectFirst("body");
+                    if (body != null) tb.stack.add(body);
+                }
             }else if (t.isEOF()) {
                 // nice work chuck
             } else {

diff --git a/src/test/java/org/jsoup/integration/FuzzFixesTest.java b/src/test/java/org/jsoup/integration/FuzzFixesTest.java
@@ -89,4 +89,15 @@ public void bookmark() {
         Document xmlDoc = Parser.xmlParser().parseInput(html, "");
         assertNotNull(xmlDoc);
     }
+
+    @Test
+    public void scope1579() {
+        // https://github.com/jhy/jsoup/issues/1579
+        String html = "<table<html\u001D<ÛÛ<tr><body\u001D<b:<select<m<input></html> </html>";
+        Document doc = Jsoup.parse(html);
+        assertNotNull(doc);
+
+        Document xmlDoc = Parser.xmlParser().parseInput(html, "");
+        assertNotNull(xmlDoc);
+    }
 }