Correct unchecked indexing, feedback

Props to @costdev for noting the unchecked indices.

Author: dmsnell

src/wp-includes/html-api/class-wp-html-tag-processor.php

@@ -1055,19 +1055,19 @@ private function parse_next_tag() {
 					 *
 					 * See https://html.spec.whatwg.org/#parse-error-incorrectly-closed-comment
 					 */
-					$closer_at--; // Pre-increment inside condition avoids risk of infinite looping.
+					$closer_at--; // Pre-increment inside condition below reduces risk of accidental infinite looping.
 					while ( ++$closer_at < strlen( $html ) ) {
 						$closer_at = strpos( $html, '--', $closer_at );
 						if ( false === $closer_at ) {
 							return false;
 						}
 
-						if ( '>' === $html[ $closer_at + 2 ] ) {
+						if ( $closer_at + 2 < strlen( $html ) && '>' === $html[ $closer_at + 2 ] ) {
 							$at = $closer_at + 3;
 							continue 2;
 						}
 
-						if ( '!' === $html[ $closer_at + 2 ] && '>' === $html[ $closer_at + 3 ] ) {
+						if ( $closer_at + 3 < strlen( $html ) && '!' === $html[ $closer_at + 2 ] && '>' === $html[ $closer_at + 3 ] ) {
 							$at = $closer_at + 4;
 							continue 2;
 						}

tests/phpunit/tests/html-api/wpHtmlTagProcessor.php

@@ -1777,10 +1777,42 @@ public function test_allows_incorrectly_closed_comments() {
 		$this->assertSame( 'final', $p->get_attribute( 'id' ), 'Did not skip over unopened comment-closer.' );
 	}
 
+	/**
+	 * Ensures that unclosed and invalid comments don't trigger warnings or errors.
+	 *
+	 * @ticket 58007
+	 *
+	 * @covers WP_HTML_Tag_Processor::next_tag
+	 * @dataProvider data_html_with_unclosed_comments
+	 *
+	 * @param string $html_ending_before_comment_close HTML with opened comments that aren't closed
+	 */
+	public function test_documents_may_end_with_unclosed_comment( $html_ending_before_comment_close ) {
+		$p = new WP_HTML_Tag_Processor( $html_ending_before_comment_close );
+
+		$this->assertFalse( $p->next_tag() );
+	}
+
+	/**
+	 * Data provider.
+	 *
+	 * @return array[]
+	 */
+	public function data_html_with_unclosed_comments() {
+		return array(
+			'Basic truncated comment'          => array( '<!-- this ends --' ),
+			'Comment with closer look-alike'   => array( '<!-- this ends --x' ),
+			'Comment with closer look-alike 2' => array( '<!-- this ends --!x' ),
+			'Invalid tag-closer comment'       => array( '</(when will this madness end?)' ),
+			'Invalid tag-closer comment 2'     => array( '</(when will this madness end?)--' )
+		);
+	}
+
 	/**
 	 * Ensures that abruptly-closed empty comments are properly closed.
 	 *
 	 * @ticket 58007
+	 *
 	 * @covers WP_HTML_Tag_Processor::next_tag
 	 * @dataProvider data_abruptly_closed_empty_comments
 	 *
@@ -1797,8 +1829,6 @@ public function test_closes_abrupt_closing_of_empty_comment( $html_with_after_ma
 	/**
 	 * Data provider.
 	 *
-	 * @ticket 58007
-	 *
 	 * @return array[]
 	 */
 	public function data_abruptly_closed_empty_comments() {