@@ -1495,14 +1495,22 @@ private function skip_script_data(): bool {
1495
1495
1496
1496
while ( false !== $ at && $ at < $ doc_length ) {
1497
1497
$ at += strcspn ( $ html , '-< ' , $ at );
1498
+ /*
1499
+ * Ultimately a SCRIPT closer (`</script>`) must be found or this function will
1500
+ * return false.
1501
+ * `</script` is the longest sequence that can be matched, so subsequent length checks
1502
+ * are redundant.
1503
+ */
1504
+ if ( $ at + 8 >= $ doc_length ) {
1505
+ return false ;
1506
+ }
1498
1507
1499
1508
/*
1500
1509
* For all script states a "-->" transitions
1501
1510
* back into the normal unescaped script mode,
1502
1511
* even if that's the current state.
1503
1512
*/
1504
1513
if (
1505
- $ at + 2 < $ doc_length &&
1506
1514
'- ' === $ html [ $ at ] &&
1507
1515
'- ' === $ html [ $ at + 1 ] &&
1508
1516
'> ' === $ html [ $ at + 2 ]
@@ -1512,10 +1520,6 @@ private function skip_script_data(): bool {
1512
1520
continue ;
1513
1521
}
1514
1522
1515
- if ( $ at + 1 >= $ doc_length ) {
1516
- return false ;
1517
- }
1518
-
1519
1523
/*
1520
1524
* Everything of interest past here starts with "<".
1521
1525
* Check this character and advance position regardless.
@@ -1537,7 +1541,6 @@ private function skip_script_data(): bool {
1537
1541
* parsing after updating the state.
1538
1542
*/
1539
1543
if (
1540
- $ at + 2 < $ doc_length &&
1541
1544
'! ' === $ html [ $ at ] &&
1542
1545
'- ' === $ html [ $ at + 1 ] &&
1543
1546
'- ' === $ html [ $ at + 2 ]
@@ -1561,7 +1564,6 @@ private function skip_script_data(): bool {
1561
1564
* proceed scanning to the next potential token in the text.
1562
1565
*/
1563
1566
if ( ! (
1564
- $ at + 6 < $ doc_length &&
1565
1567
( 's ' === $ html [ $ at ] || 'S ' === $ html [ $ at ] ) &&
1566
1568
( 'c ' === $ html [ $ at + 1 ] || 'C ' === $ html [ $ at + 1 ] ) &&
1567
1569
( 'r ' === $ html [ $ at + 2 ] || 'R ' === $ html [ $ at + 2 ] ) &&
0 commit comments