Limit how far up the stack the formatting adoption agency algorithm w…

…ill travel

Fixes jhy#234

CHANGES

@@ -26,6 +26,10 @@ jsoup changelog
  * When cloning an Element, reset the classnames set so as not to hold a pointer to the source's.
    <https://github.com/jhy/jsoup/issues/278>
 
+ * Limit how far up the stack the formatting adoption agency algorithm will travel, to prevent the chance of a run-away
+   parse when the HTML stack is hopelessly deep.
+   <https://github.com/jhy/jsoup/issues/234>
+
 *** Release 1.7.1 [2012-Sep-23]
  * Improved parse time, now 2.3x faster than previous release, with lower memory consumption.
 

src/main/java/org/jsoup/parser/HtmlTreeBuilderState.java

@@ -664,7 +664,9 @@ else if (!tb.onStack(formatEl)) {
                             Element commonAncestor = null;
                             boolean seenFormattingElement = false;
                             LinkedList<Element> stack = tb.getStack();
-                            for (int si = 0; si < stack.size(); si++) {
+                            // the spec doesn't limit to < 64, but in degenerate cases (9000+ stack depth) this prevents
+                            // run-aways
+                            for (int si = 0; si < stack.size() && si < 64; si++) {
                                 Element el = stack.get(si);
                                 if (el == formatEl) {
                                     commonAncestor = stack.get(si - 1);