🐛 Fix global OOB read in IsUtf8WhiteSpaceChar

[PGZXB]

Fixes #40420

Summary

htmlparser::kWhitespaceTable is declared as std::array<std::array<uint8_t, 255>, 10>, but Strings::IsUtf8WhiteSpaceChar indexes it with a full byte:

uint8_t c = s.at(i++);
state = kWhitespaceTable[state][c];

c ranges over 0..255, so when the DFA is in one of the multi-byte UTF-8 states and the next byte is 0xff, the lookup uses column 255, one byte past the end of the 255-column row. AddressSanitizer reports this as a global-buffer-overflow.

Fix

Widen each row to 256 entries so every possible byte value has a table entry. The additional column is value-initialized to 0 (not whitespace), so the existing 0..254 behavior is unchanged.

diff --git a/validator/cpp/htmlparser/whitespacetable.h b/validator/cpp/htmlparser/whitespacetable.h
index abdb9aa..21e62bb 100644
--- a/validator/cpp/htmlparser/whitespacetable.h
+++ b/validator/cpp/htmlparser/whitespacetable.h
@@ -33,7 +33,7 @@ namespace htmlparser {
 // 0x202f - \xe2\x80\xaf     NARROW NO-BREAK SPACE
 // 0x205f - \xe2\x81\x9f     MEDIUM MATHEMATICAL SPACE
 // 0x3000 - \xe3\x80\x80     IDEOGRAPHIC SPACE
-constexpr static std::array<std::array<uint8_t, 255>, 10> kWhitespaceTable {{
+constexpr static std::array<std::array<uint8_t, 256>, 10> kWhitespaceTable {{
     // Any first byte.
     {0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0,  // 20
      1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0,  // 40

Verification

Before the fix, the reported reproducer aborts with:

==24==ERROR: AddressSanitizer: global-buffer-overflow
SUMMARY: AddressSanitizer: global-buffer-overflow in htmlparser::Strings::IsUtf8WhiteSpaceChar

After the fix, the same reproducer runs cleanly with no sanitizer report.

[CLAassistant]

All committers have signed the CLA.