Really fix bug #10362.

# My previous fix caused a segfault when there were parens in an unallowed
# tag :(  Thanks Andi.

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2daac404af9e77052ac406e1e503303063e8945f..52274dc2481d5f4bdef6556b20715fc56f5e3aef 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2768,7 +2768,7 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int state, char *allow, int allo
                                                lc = '(';
                                                br++;
                                        }
-                               } else if (state == 1) {
+                               } else if (allow && state == 1) {
                                        *(tp++) = c;
                                } else if (state == 0) {
                                        *(rp++) = c;
@@ -2781,7 +2781,7 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int state, char *allow, int allo
                                                lc = ')';
                                                br--;
                                        }
-                               } else if (state == 1) {
+                               } else if (allow && state == 1) {
                                        *(tp++) = c;
                                } else if (state == 0) {
                                        *(rp++) = c;