Repository navigation
Closed
Labels
bugA confirmed bug, that we should fixA confirmed bug, that we should fixfixedAn {bug|improvement} that has been {fixed|implemented}An {bug|improvement} that has been {fixed|implemented}
Milestone
Description
== Java Exception: java.lang.IndexOutOfBoundsException: Index 1 out of bounds for length 0
at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)
at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)
at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:266)
at java.base/java.util.Objects.checkIndex(Objects.java:359)
at java.base/java.util.ArrayList.get(ArrayList.java:427)
at org.jsoup.parser.HtmlTreeBuilderState$7.inBodyStartTag(HtmlTreeBuilderState.java:401)
at org.jsoup.parser.HtmlTreeBuilderState$7.process(HtmlTreeBuilderState.java:308)
at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:249)
at org.jsoup.parser.HtmlTreeBuilderState$9.anythingElse(HtmlTreeBuilderState.java:1107)
at org.jsoup.parser.HtmlTreeBuilderState$9.process(HtmlTreeBuilderState.java:1072)
at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:174)
at org.jsoup.parser.HtmlTreeBuilderState$12.anythingElse(HtmlTreeBuilderState.java:1247)
at org.jsoup.parser.HtmlTreeBuilderState$12.process(HtmlTreeBuilderState.java:1206)
at org.jsoup.parser.HtmlTreeBuilder.process(HtmlTreeBuilder.java:174)
at org.jsoup.parser.TreeBuilder.stepParser(TreeBuilder.java:124)
at org.jsoup.parser.TreeBuilder.runParser(TreeBuilder.java:105)
at org.jsoup.parser.TreeBuilder.parseFragment(TreeBuilder.java:83)
at org.jsoup.parser.Parser.parseFragmentInput(Parser.java:117)
at org.jsoup.parser.Parser.parseFragmentInput(Parser.java:102)
at FragmentHtmlFuzzer.fuzzerTestOneInput(FragmentHtmlFuzzer.java:28)
DEDUP_TOKEN: 74baaf414c6c03f2
== libFuzzer crashing input ==
MS: 2 ManualDict-Custom- DE: "<frameset>"-; base unit: 343fc9b875de60bd1e423fd3792599e8572f159e
0x63,0x6f,0x6c,0x67,0x72,0x6f,0x75,0x70,0x5c,0x76,0x3c,0x66,0x72,0x61,0x6d,0x65,0x73,0x65,0x74,0x3e,0x3e,0x6c,0x0,0x3c,0x0,0x3c,0x64,0x69,0x74,0x6c,0x3e,0x0,0x3c,0x20,0x5c,
colgroup\\v<frameset>>l\000<\000<ditl>\000< \\
artifact_prefix='/tmp/tmpqzien9lb/'; Test unit written to /tmp/tmpqzien9lb/crash-358805f5163c0c2d56e4ee7af3fd5bd1a54fe6e1
Base64: Y29sZ3JvdXBcdjxmcmFtZXNldD4+bAA8ADxkaXRsPgA8IFw=
stat::number_of_executed_units: 323325
stat::average_exec_per_sec: 14696
stat::new_units_added: 3001
stat::slowest_unit_time_sec: 0
stat::peak_rss_mb: 983
reproducer_path='.'; Java reproducer written to ./Crash_358805f5163c0c2d56e4ee7af3fd5bd1a54fe6e1.java
Metadata
Metadata
Assignees
Labels
bugA confirmed bug, that we should fixA confirmed bug, that we should fixfixedAn {bug|improvement} that has been {fixed|implemented}An {bug|improvement} that has been {fixed|implemented}
Activity
jhy commentedon Sep 23, 2025
Identified via google/oss-fuzz#14041
jhy commentedon Sep 23, 2025
Fixed by c4bf5ba