Confirm current el is frameset before attempting to pop

Fixes #2397

Author: jhy

CHANGES.md

@@ -11,6 +11,7 @@
 * When using the JDK HttpClient, any system default proxy (`ProxySelector.getDefault()`) was ignored. Now, the system proxy is used if a per-request proxy is not set. [#2388](https://github.com/jhy/jsoup/issues/2388), [#2390](https://github.com/jhy/jsoup/pull/2390)
 * A ValidationException could be thrown in the adoption agency algorithm with particularly broken input. Now logged as a parse error. [#2393](https://github.com/jhy/jsoup/issues/2393)
 * Null characters in the HTML body were not consistently removed; and in foreign content were not correctly replaced. [#2395](https://github.com/jhy/jsoup/issues/2395)
+* An IndexOutOfBoundsException could be thrown when parsing a body fragment with crafted input. Now logged as a parse error. [#2397](https://github.com/jhy/jsoup/issues/2397)
 
 
 ## 1.21.2 (2025-Aug-25)

src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java

@@ -1687,7 +1687,7 @@ else if (name.equals("col")) {
                         return false;
                 }
             } else if (t.isEndTag() && t.asEndTag().normalName().equals("frameset")) {
-                if (tb.currentElementIs("html")) { // frag
+                if (!tb.currentElementIs("frameset")) { // spec checks if el is html; deviate to confirm we are about to pop the frameset el
                     tb.error(this);
                     return false;
                 } else {

src/test/java/org/jsoup/integration/FuzzFixesTest.java

@@ -56,6 +56,14 @@ void testHtmlParse(File file) throws IOException {
         assertNotNull(doc);
     }
 
+    @ParameterizedTest
+    @MethodSource("testFiles")
+    void testHtmlFragmentParse(File file) throws IOException {
+        String html = ParseTest.getFileAsString(file);
+        Document doc = Jsoup.parseBodyFragment(html);
+        assertNotNull(doc);
+    }
+
     @ParameterizedTest
     @MethodSource("testFiles")
     void testXmlParse(File file) throws IOException {