Skip to content

test: panic on <![C followed by empty &#;#206

Open
ChristianMurphy wants to merge 1 commit intowooorm:mainfrom
ChristianMurphy:test/empty-numeric-char-ref-decode-numeric-panic
Open

test: panic on <![C followed by empty &#;#206
ChristianMurphy wants to merge 1 commit intowooorm:mainfrom
ChristianMurphy:test/empty-numeric-char-ref-decode-numeric-panic

Conversation

@ChristianMurphy
Copy link
Copy Markdown
Collaborator

to_html_with_options("<![C&#;", &Options::default()) panics in 1.0.0 release at src/util/character_reference.rs:83 with ParseIntError { kind: Empty }. The 4-byte prefix <![C dispatches as if it were the CDATA-block start sequence (spec requires <![CDATA[), letting an empty &#; reach decode_numeric against its documented "never panics" contract (src/util/character_reference.rs:70-76).

Verified to fail against markdown = "=1.0.0" in release. Found via in-tree fuzzing campaign.

`to_html_with_options("<![C&#;", &Options::default())` panics in 1.0.0
release at `src/util/character_reference.rs:83` with
`ParseIntError { kind: Empty }`. The 4-byte prefix `<![C` dispatches as
if it were the CDATA-block start sequence (spec requires `<![CDATA[`),
letting an empty `&#;` reach `decode_numeric` against its documented
"never panics" contract (`src/util/character_reference.rs:70-76`).

Verified to fail against `markdown = "=1.0.0"` in release. Found via
in-tree fuzzing campaign.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant