From 1cca4cb621abcf1258536d7895d7198430ae79b4 Mon Sep 17 00:00:00 2001
From: Christian Murphy <christian.murphy.42@gmail.com>
Date: Mon, 27 Apr 2026 08:48:43 -0700
Subject: [PATCH] test: panic on `<![C` followed by empty `&#;`

`to_html_with_options("<![C&#;", &Options::default())` panics in 1.0.0
release at `src/util/character_reference.rs:83` with
`ParseIntError { kind: Empty }`. The 4-byte prefix `<![C` dispatches as
if it were the CDATA-block start sequence (spec requires `<![CDATA[`),
letting an empty `&#;` reach `decode_numeric` against its documented
"never panics" contract (`src/util/character_reference.rs:70-76`).

Verified to fail against `markdown = "=1.0.0"` in release. Found via
in-tree fuzzing campaign.
---
 tests/fuzz.rs | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/fuzz.rs b/tests/fuzz.rs
index 98a3f219..03018252 100644
--- a/tests/fuzz.rs
+++ b/tests/fuzz.rs
@@ -129,5 +129,13 @@ fn fuzz() -> Result<(), message::Message> {
         "12: mdx: handle invalid mdx without panic (GH-26)"
     );
 
+    assert!(
+        matches!(
+            to_html_with_options("<![C&#;", &Options::default()),
+            Ok(_)
+        ),
+        "13: empty `&#;` after `<![C` should not panic decode_numeric"
+    );
+
     Ok(())
 }