Made strip_tags() binary safe

diff --git a/ext/standard/php_string.h b/ext/standard/php_string.h
index 18e53afe2798acc38d7003190a2baf5bca22e770..8b032847aadeb934380f09507474992970cd82f8 100644 (file)
--- a/ext/standard/php_string.h
+++ b/ext/standard/php_string.h
@@ -129,7 +129,7 @@ PHPAPI char *php_str_to_str_ex(char *haystack, int length, char *needle,
 PHPAPI char *php_str_to_str(char *haystack, int length, char *needle,
                int needle_len, char *str, int str_len, int *_new_length);
 PHPAPI char *php_trim(char *c, int len, char *what, int what_len, zval *return_value, int mode TSRMLS_DC);
-PHPAPI void php_strip_tags(char *rbuf, int len, int *state, char *allow, int allow_len);
+PHPAPI size_t php_strip_tags(char *rbuf, int len, int *state, char *allow, int allow_len);
 PHPAPI int php_char_to_str(char *str, uint len, char from, char *to, int to_len, pval *result);
 PHPAPI void php_implode(zval *delim, zval *arr, zval *return_value);
 PHPAPI void php_explode(zval *delim, zval *str, zval *return_value, int limit);

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 7a188f9cae201c5f479fdc69ae27878fd3f81e3a..77966c9726371341a144bec4aeebf0b2e540bdcc 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3299,6 +3299,7 @@ PHP_FUNCTION(strip_tags)
        zval **str, **allow=NULL;
        char *allowed_tags=NULL;
        int allowed_tags_len=0;
+       size_t retval_len;
 
        switch (ZEND_NUM_ARGS()) {
                case 1:
@@ -3320,8 +3321,8 @@ PHP_FUNCTION(strip_tags)
        }
        convert_to_string_ex(str);
        buf = estrndup(Z_STRVAL_PP(str), Z_STRLEN_PP(str));
-       php_strip_tags(buf, Z_STRLEN_PP(str), NULL, allowed_tags, allowed_tags_len);
-       RETURN_STRING(buf, 0);
+       retval_len = php_strip_tags(buf, Z_STRLEN_PP(str), NULL, allowed_tags, allowed_tags_len);
+       RETURN_STRINGL(buf, retval_len, 0);
 }
 /* }}} */
 
@@ -3555,7 +3556,7 @@ int php_tag_find(char *tag, int len, char *set) {
        swm: Added ability to strip <?xml tags without assuming it PHP
        code.
 */
-PHPAPI void php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int allow_len)
+PHPAPI size_t php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int allow_len)
 {
        char *tbuf, *buf, *p, *tp, *rp, c, lc;
        int br, i=0, depth=0;
@@ -3751,6 +3752,8 @@ reg_char:
                efree(tbuf);
        if (stateptr)
                *stateptr = state;
+
+       return (size_t)(rp - rbuf);
 }
 /* }}} */