Parsing a document containing a <meta http-equiv="Content-Type"> element whose content attribute ends with the token charset but no following = triggers an out-of-bounds index panic in extract_a_character_encoding_from_a_meta_element (html5ever/src/encoding.rs).
After the parser matches charset and skips trailing whitespace, position can equal input.len(). The code then does an unchecked byte access (input.as_bytes()[position]), which panics instead of reporting "no encoding found".
This appears in the wild — real pages ship malformed Content-Type values such as content="text/html; charset".
Repro
use html5ever::driver::parse_document;
use html5ever::tendril::TendrilSink;
use markup5ever_rcdom::RcDom;
fn main() {
// panics: index out of bounds
let html = r#"<meta http-equiv="Content-Type" content="text/html; charset">"#;
let _ = parse_document(RcDom::default(), Default::default()).one(html);
}
Panics whenever the content value ends with charset, just charset, or charset followed by trailing whitespace.
Expected
Parsing succeeds and the meta-charset step yields no encoding, per the WHATWG algorithm's step that returns nothing once position is past the end of input.
Fixed by #762.
Parsing a document containing a
<meta http-equiv="Content-Type">element whosecontentattribute ends with the tokencharsetbut no following=triggers an out-of-bounds index panic inextract_a_character_encoding_from_a_meta_element(html5ever/src/encoding.rs).After the parser matches
charsetand skips trailing whitespace,positioncan equalinput.len(). The code then does an unchecked byte access (input.as_bytes()[position]), which panics instead of reporting "no encoding found".This appears in the wild — real pages ship malformed
Content-Typevalues such ascontent="text/html; charset".Repro
Panics whenever the
contentvalue ends withcharset, justcharset, orcharsetfollowed by trailing whitespace.Expected
Parsing succeeds and the meta-charset step yields no encoding, per the WHATWG algorithm's step that returns nothing once position is past the end of input.
Fixed by #762.