Changeset 62439 for trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

Timestamp:

06/01/2026 10:38:30 AM (4 months ago)

Author:

dmsnell

Message:

HTML API: Fixes for issues discovered while fuzzing.

Fuzz-testing was performed against the HTML API for finding edge cases
that might be broken in the existing parsing code. A few issues were
discovered with HTML normalization and warnings from out-of-bounds
string reads.

This patch contains new tests catching regressions on these behaviors
and adds fixes for the discovered issues.

Patch proposed by Codex and revised by dmsnell.

Developed in: ​https://github.com/WordPress/wordpress-develop/pull/11982
Discussed in: https://core.trac.wordpress.org/ticket/65372

Fixes #65372.

File:

• trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php (modified) (2 diffs)

trunk/src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1425 +1425 @@
 
                         // Fail if there is no possible tag closer.
-                        if ( false === $at || ( $at + $tag_length ) >= $doc_length ) {
+                        if ( false === $at || ( $at + 2 + $tag_length ) >= $doc_length ) {
                                 return false;
                         }
@@ -1816 +1816 @@
                                         // Abruptly-closed empty comments are a sequence of dashes followed by `>`.
                                         $span_of_dashes = strspn( $html, '-', $closer_at );
+                                        if ( $doc_length <= $span_of_dashes + $closer_at ) {
+                                                $this->parser_state = self::STATE_INCOMPLETE_INPUT;
+
+                                                return false;
+                                        }
+
                                         if ( '>' === $html[ $closer_at + $span_of_dashes ] ) {
                                                 /*