Fixed an OOB in TreeBuilder when getting the body Element

Fixes: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48116 Caused by: e714ef1
jhy · Jun 19, 2022 · 8733445 · 8733445
1 parent e714ef1
commit 8733445
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java b/src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java
@@ -385,8 +385,9 @@ private boolean inBodyStartTag(Token t, HtmlTreeBuilder tb) {
                         return false; // ignore
                     } else {
                         tb.framesetOk(false);
-                        Element body = stack.get(1);
-                        if (startTag.hasAttributes()) {
+                        // will be on stack if this is a nested body. won't be if closed (which is a variance from spec, which leaves it on)
+                        Element body;
+                        if (startTag.hasAttributes() && (body = tb.getFromStack("body")) != null) { // we only ever put one body on stack
                             for (Attribute attribute : startTag.attributes) {
                                 if (!body.hasAttr(attribute.getKey()))
                                     body.attributes().put(attribute);

diff --git a/src/test/resources/fuzztests/48116.html.gz b/src/test/resources/fuzztests/48116.html.gz