rubys / nokogumbo

A Nokogiri interface to the Gumbo HTML5 parser.
Apache License 2.0
186 stars 114 forks source link

Gumbo crashes found by AFL #125

Closed stevecheckoway closed 5 years ago

stevecheckoway commented 5 years ago

I fuzzed our copy of Gumbo and found two crashes, both caught by assertions.

Crash 1

<b><nobr><r><d><r><ol></b><nobr> results in

Assertion failed: (handled), function handle_in_body, file src/parser.c, line 3149.

This one is related to the adoption algorithm.

Crash 2

<d0tx0i0t><option></d0tX0i0t> results in

Assertion failed: (tag != GUMBO_TAG_UNKNOWN), function node_html_tag_is, file src/parser.c, line 636.

I haven't investigated this one.