[Fix] Fix overflow when appending many broken tags

diff --git a/src/libserver/html/html.cxx b/src/libserver/html/html.cxx
index 9c96f2bb9df05ffe70982532fa417d688228e256..716d944ea4955428b544c86a88dea5a5186b5bd0 100644 (file)
--- a/src/libserver/html/html.cxx
+++ b/src/libserver/html/html.cxx
@@ -1082,8 +1082,8 @@ html_append_tag_content(rspamd_mempool_t *pool,
                        tag->closing.end = tag->closing.start;
                }
                else {
-                       next_tag_offset = len;
-                       tag->closing.end = len;
+                       next_tag_offset = tag->content_offset;
+                       tag->closing.end = tag->content_offset;
                }
        }
        if (tag->closing.start == -1) {
@@ -1881,6 +1881,14 @@ html_process_input(rspamd_mempool_t *pool,
                }
        }
 
+       if (cur_tag && !(cur_tag->flags & FL_CLOSED) && cur_tag != &cur_closing_tag) {
+               cur_closing_tag.parent = cur_tag;
+               cur_closing_tag.id = cur_tag->id;
+               cur_tag = &cur_closing_tag;
+               html_check_balance(hc, cur_tag,
+                               end - start, end - start);
+       }
+
        /* Propagate styles */
        hc->traverse_block_tags([&hc, &pool](const html_tag *tag) -> bool {