Fix bounds check in strip_tags()

nikic · nikic · commit 4e0134c66188 · 2016-02-13T17:47:30.000+01:00
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
 				 * state == 2 (PHP). Switch back to HTML.
 				 */
 
-				if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
+				if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
 					state = 1; is_xml=1;
 					break;
 				}

Original file line number	Diff line number	Diff line change
`@@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char rbuf, int len, int stateptr, char *allow,`
`4822`	`4822`	`* state == 2 (PHP). Switch back to HTML.`
`4823`	`4823`	`*/`
`4824`	`4824`
`4825`		`- if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {`
	`4825`	`+ if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {`
`4826`	`4826`	`state = 1; is_xml=1;`
`4827`	`4827`	`break;`
`4828`	`4828`	`}`