Skip to content

IndexOutOfBoundsException in fragment parse #2406

Closed

Description

@jhy
== Java Exception: java.lang.IndexOutOfBoundsException: Index 1 out of bounds for length 0
	at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)
	at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)
	at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:266)
	at java.base/java.util.Objects.checkIndex(Objects.java:359)
	at java.base/java.util.ArrayList.get(ArrayList.java:427)
	at org.jsoup.parser.HtmlTreeBuilderState$7.inBodyStartTag(HtmlTreeBuilderState.java:401)
	at org.jsoup.parser.HtmlTreeBuilderState$7.process(HtmlTreeBuilderState.java:308)
	at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:249)
	at org.jsoup.parser.HtmlTreeBuilderState$9.anythingElse(HtmlTreeBuilderState.java:1107)
	at org.jsoup.parser.HtmlTreeBuilderState$9.process(HtmlTreeBuilderState.java:1072)
	at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:174)
	at org.jsoup.parser.HtmlTreeBuilderState$12.anythingElse(HtmlTreeBuilderState.java:1247)
	at org.jsoup.parser.HtmlTreeBuilderState$12.process(HtmlTreeBuilderState.java:1206)
	at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:174)
	at org.jsoup.parser.TreeBuilder.stepParser(TreeBuilder.java:124)
	at org.jsoup.parser.TreeBuilder.runParser(TreeBuilder.java:105)
	at org.jsoup.parser.TreeBuilder.parseFragment(TreeBuilder.java:83)
	at org.jsoup.parser.Parser.parseFragmentInput(Parser.java:117)
	at org.jsoup.parser.Parser.parseFragmentInput(Parser.java:102)
	at FragmentHtmlFuzzer.fuzzerTestOneInput(FragmentHtmlFuzzer.java:28)
DEDUP_TOKEN: 74baaf414c6c03f2
== libFuzzer crashing input ==
MS: 2 ManualDict-Custom- DE: "<frameset>"-; base unit: 343fc9b875de60bd1e423fd3792599e8572f159e
0x63,0x6f,0x6c,0x67,0x72,0x6f,0x75,0x70,0x5c,0x76,0x3c,0x66,0x72,0x61,0x6d,0x65,0x73,0x65,0x74,0x3e,0x3e,0x6c,0x0,0x3c,0x0,0x3c,0x64,0x69,0x74,0x6c,0x3e,0x0,0x3c,0x20,0x5c,
colgroup\\v<frameset>>l\000<\000<ditl>\000< \\
artifact_prefix='/tmp/tmpqzien9lb/'; Test unit written to /tmp/tmpqzien9lb/crash-358805f5163c0c2d56e4ee7af3fd5bd1a54fe6e1
Base64: Y29sZ3JvdXBcdjxmcmFtZXNldD4+bAA8ADxkaXRsPgA8IFw=
stat::number_of_executed_units: 323325
stat::average_exec_per_sec:     14696
stat::new_units_added:          3001
stat::slowest_unit_time_sec:    0
stat::peak_rss_mb:              983
reproducer_path='.'; Java reproducer written to ./Crash_358805f5163c0c2d56e4ee7af3fd5bd1a54fe6e1.java

Activity

  1. self-assigned this
    on Sep 23, 2025
  2. jhy commented on Sep 23, 2025

    @jhy
    OwnerAuthor

    Identified via google/oss-fuzz#14041

  3. jhy commented on Sep 23, 2025

    @jhy
    OwnerAuthor

    Fixed by c4bf5ba

  4. added
    bugA confirmed bug, that we should fix
    fixedAn {bug|improvement} that has been {fixed|implemented}
    on Sep 23, 2025
  5. added this to the 1.22.1 milestone on Sep 23, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugA confirmed bug, that we should fixfixedAn {bug|improvement} that has been {fixed|implemented}

Projects

No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions