IndexOutOfBoundsException with nested anchors

[TheLQ]

The following HTML is illegal but is from a 3rd party site I do not control.

<a>
    <b>
        <div>
            <a>test</a>
        </div>
    </b>
</a>

Fails with

java.lang.IndexOutOfBoundsException: Index: 2, Size: 1
        at java.base/java.util.ArrayList.rangeCheckForAdd(ArrayList.java:756)
        at java.base/java.util.ArrayList.add(ArrayList.java:481)
        at org.jsoup.parser.HtmlTreeBuilder.pushWithBookmark(HtmlTreeBuilder.java:640)
        at org.jsoup.parser.HtmlTreeBuilderState$7.inBodyEndTagAdoption(HtmlTreeBuilderState.java:879)
        at org.jsoup.parser.HtmlTreeBuilderState$7.inBodyEndTag(HtmlTreeBuilderState.java:731)
        at org.jsoup.parser.HtmlTreeBuilderState$7.process(HtmlTreeBuilderState.java:288)
        at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:149)
        at org.jsoup.parser.TreeBuilder.processEndTag(TreeBuilder.java:108)
        at org.jsoup.parser.HtmlTreeBuilderState$7.inBodyStartTag(HtmlTreeBuilderState.java:307)
        at org.jsoup.parser.HtmlTreeBuilderState$7.process(HtmlTreeBuilderState.java:286)
        at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:149)
        at org.jsoup.parser.TreeBuilder.runParser(TreeBuilder.java:76)
        at org.jsoup.parser.TreeBuilder.parse(TreeBuilder.java:51)
        at org.jsoup.parser.Parser.parseInput(Parser.java:49)
        at org.jsoup.helper.DataUtil.parseInputStream(DataUtil.java:191)
        at org.jsoup.helper.DataUtil.load(DataUtil.java:72)
        at org.jsoup.Jsoup.parse(Jsoup.java:135)

If you remove the <b> or <div> it works fine. In the original page the first anchor and bold wasn't closed, so spilled over into the message content div, which contained a link.

Tested against 1.14.1

[jhy]

Thanks! This is the same as we found in #1576 (caught by the fuzz) and is fixed in mainline, and will be release in 1.14.2.

[TheLQ]

Thanks for being proactive with a fuzzer. It's rare that projects do that.

Not sure how I missed that ticket, I really did search first... sorry about that.

[jhy]

Thanks, and no worries at all. Plus, we got a cleaner testcase out of it.