@- Fixed crash in strip_tags() and related functions. (Thies)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 9a3dacc7a9f67de4a06772448dc54c32914f5de9..3768e4fcca775376f98074ef36d90387fce9292c 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2058,7 +2058,7 @@ PHP_FUNCTION(strip_tags)
                        break;
        }
        convert_to_string_ex(str);
-       buf = estrdup((*str)->value.str.val);
+       buf = estrndup((*str)->value.str.val,(*str)->value.str.len);
        php_strip_tags(buf, (*str)->value.str.len, 0, allowed_tags, allowed_tags_len);
        RETURN_STRING(buf, 0);
 }
@@ -2210,7 +2210,7 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int state, char *allow, int allo
        char *tbuf, *buf, *p, *tp, *rp, c, lc;
        int br, i=0;
 
-       buf = estrdup(rbuf);
+       buf = estrndup(rbuf,len);
        c = *buf;
        lc = '\0';
        p = buf;