Fix bounds check in strip_tags()

diff --git a/ext/standard/string.c b/ext/standard/string.c
index bcfc3b61812e014118bb3a5a4e2c2a65d89ac4cb..d5f83e7d0f49e6a3c3ba3036f626da06d721ea68 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
                                 * state == 2 (PHP). Switch back to HTML.
                                 */
 
-                               if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
+                               if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
                                        state = 1; is_xml=1;
                                        break;
                                }