automata: fix validation order in dense::DFA::from_bytes

Author: Mrmaxmeier

regex-automata/src/dfa/dense.rs

@@ -2340,10 +2340,14 @@ impl<'a> DFA<&'a [u32]> {
         // table, match states and accelerators below. If any validation fails,
         // then we return an error.
         let (dfa, nread) = unsafe { DFA::from_bytes_unchecked(slice)? };
+        // Note: Validation order is important here:
+        // - MatchState::validate can be called with an untrusted DFA.
+        // - TransistionTable::validate uses dfa.ms through match_len
+        // - StartTable::validate needs a valid transition table
+        dfa.accels.validate()?;
+        dfa.ms.validate(&dfa)?;
         dfa.tt.validate(&dfa)?;
         dfa.st.validate(&dfa)?;
-        dfa.ms.validate(&dfa)?;
-        dfa.accels.validate()?;
         // N.B. dfa.special doesn't have a way to do unchecked deserialization,
         // so it has already been validated.
         for state in dfa.states() {