From eb8455d7a191de0a8629e02ef968266602b6c65f Mon Sep 17 00:00:00 2001
From: TSUYUSATO Kitsune <make.just.on@gmail.com>
Date: Thu, 13 Jun 2024 15:47:12 +0900
Subject: [PATCH] Add a "Malformed comment" check for too short comment

`Document.new("<a><!-->")` raises `undefined method `[]' for nil`.
This commit fixes it and adds a test for it.
---
 lib/rexml/parsers/baseparser.rb |  5 ++---
 test/parse/test_comment.rb      | 13 +++++++++++++
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
index eae0db8b..272d8a6b 100644
--- a/lib/rexml/parsers/baseparser.rb
+++ b/lib/rexml/parsers/baseparser.rb
@@ -406,12 +406,11 @@ def pull_event
               if md[0][0] == ?-
                 md = @source.match(/--(.*?)-->/um, true)
 
-                case md[1]
-                when /--/, /-\z/
+                if md.nil? || /--|-\z/.match?(md[1])
                   raise REXML::ParseException.new("Malformed comment", @source)
                 end
 
-                return [ :comment, md[1] ] if md
+                return [ :comment, md[1] ]
               else
                 md = @source.match(/\[CDATA\[(.*?)\]\]>/um, true)
                 return [ :cdata, md[1] ] if md
diff --git a/test/parse/test_comment.rb b/test/parse/test_comment.rb
index 8f143495..ce6678e8 100644
--- a/test/parse/test_comment.rb
+++ b/test/parse/test_comment.rb
@@ -68,6 +68,19 @@ def test_doctype_malformed_comment_end
         DETAIL
       end
 
+      def test_after_doctype_malformed_comment_short
+        exception = assert_raise(REXML::ParseException) do
+          parse("<a><!-->")
+        end
+        assert_equal(<<~DETAIL.chomp, exception.to_s)
+          Malformed comment
+          Line: 1
+          Position: 8
+          Last 80 unconsumed characters:
+          -->
+        DETAIL
+      end
+
       def test_after_doctype_malformed_comment_inner
         exception = assert_raise(REXML::ParseException) do
           parse("<a><!-- -- -->")