From ba1537374bfb6d89b02b6aaa6fd12ab25cd787b1 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Fri, 31 Jan 2025 22:51:59 +0100
Subject: [PATCH] html: Fix corner case when push-parsing HTML5 comments

---
 HTMLparser.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/HTMLparser.c b/HTMLparser.c
index 71aa2859..63199681 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -4899,8 +4899,14 @@ htmlParseLookupCommentEnd(htmlParserCtxtPtr ctxt)
 	mark = htmlParseLookupString(ctxt, 2, "--", 2, 0);
 	if (mark < 0)
             break;
+        /*
+         * <!-->    is a complete comment, but
+         * <!--!>   is not
+         * <!---!>  is not
+         * <!----!> is
+         */
         if ((NXT(mark+2) == '>') ||
-	    ((NXT(mark+2) == '!') && (NXT(mark+3) == '>'))) {
+	    ((mark >= 4) && (NXT(mark+2) == '!') && (NXT(mark+3) == '>'))) {
             ctxt->checkIndex = 0;
 	    break;
 	}