diff options
| author | Nikita Popov <nikic@php.net> | 2016-02-13 17:47:30 +0100 |
|---|---|---|
| committer | Nikita Popov <nikic@php.net> | 2016-02-13 17:47:30 +0100 |
| commit | 4e0134c6618844f076d40fb346e78b89e98c825c (patch) | |
| tree | 0bb66b3bd5490906a7fb3b100d0281bd9bbd17e7 | |
| parent | adcdb4f7bab6a0c59fbcca108fac526d8ede70e6 (diff) | |
| download | php-git-4e0134c6618844f076d40fb346e78b89e98c825c.tar.gz | |
Fix bounds check in strip_tags()
| -rw-r--r-- | ext/standard/string.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c index bcfc3b6181..d5f83e7d0f 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow, * state == 2 (PHP). Switch back to HTML. */ - if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) { + if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) { state = 1; is_xml=1; break; } |