From 7b7b3071c8ae48a8d3db8da6e9580496cc8f8905 Mon Sep 17 00:00:00 2001
From: "mrbkap%gmail.com"
 <mrbkap%gmail.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Wed, 2 Nov 2005 01:10:37 +0000
Subject: [PATCH] bug 313823: Handle illegal forms of meta charset tags better.
 r+sr=jst

git-svn-id: svn://10.0.0.236/trunk@183377 18797224-902f-48f8-a5cc-f745e15eee43
---
 mozilla/parser/htmlparser/src/nsParser.cpp | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/mozilla/parser/htmlparser/src/nsParser.cpp b/mozilla/parser/htmlparser/src/nsParser.cpp
index 6c419b97a74..00865dfed13 100644
--- a/mozilla/parser/htmlparser/src/nsParser.cpp
+++ b/mozilla/parser/htmlparser/src/nsParser.cpp
@@ -2322,9 +2322,19 @@ nsParser::DetectMetaTag(const char* aBytes,
     if (!FindCharInReadable('<', currPos, end)) 
       break; // no tag found in this buffer
 
-    if (GetNextChar(currPos, end) == '!' && 
-        GetNextChar(currPos, end) == '-' &&
-        GetNextChar(currPos, end) == '-') {
+    if (GetNextChar(currPos, end) == '!') {
+      if (GetNextChar(currPos, end) != '-' ||
+          GetNextChar(currPos, end) != '-') {
+        // If we only see a <! not followed by --, just skip to the next >.
+        if (!FindCharInReadable('>', currPos, end)) {
+          return PR_FALSE; // No more tags to follow.
+        }
+        
+        // Continue searching for a meta tag following this "comment".
+        ++currPos;
+        continue;
+      }
+
       // Found MDO ( <!-- ). Now search for MDC ( --[*s]> )
       PRBool foundMDC = PR_FALSE;
       PRBool foundMatch = PR_FALSE; 
@@ -2353,14 +2363,16 @@ nsParser::DetectMetaTag(const char* aBytes,
     if ( (*currPos != 'm' && *currPos != 'M') ||
          (*(++currPos) != 'e' && *currPos != 'E') ||
          (*(++currPos) != 't' && *currPos != 'T') ||
-         (*(++currPos) != 'a' && *currPos != 'A') ) {
+         (*(++currPos) != 'a' && *currPos != 'A') ||
+         !nsCRT::IsAsciiSpace(*(++currPos))) {
       currPos = tagEnd;
       continue;
     }
 
     // If could not find "charset" in this tag, skip this tag and try next
     tokEnd = tagEnd;
-    if (!CaseInsensitiveFindInReadable(NS_LITERAL_CSTRING("CHARSET"), currPos, tokEnd)) {
+    if (!CaseInsensitiveFindInReadable(NS_LITERAL_CSTRING("CHARSET"),
+                                       currPos, tokEnd)) {
       currPos = tagEnd;
       continue;
     }