MFH: made strip_tags() binary safe

diff --git a/ext/standard/php_string.h b/ext/standard/php_string.h
index df2bd6376a18097fae937520e330ed09bf23eaf0..b2d146c056212c61d46ec6aa3499c04c606c0b7c 100644 (file)
--- a/ext/standard/php_string.h
+++ b/ext/standard/php_string.h
@@ -125,7 +125,7 @@ PHPAPI char *php_stristr(unsigned char *s, unsigned char *t, size_t s_len, size_
 PHPAPI char *php_str_to_str(char *haystack, int length, char *needle,
                int needle_len, char *str, int str_len, int *_new_length);
 PHPAPI char *php_trim(char *c, int len, char *what, int what_len, zval *return_value, int mode TSRMLS_DC);
-PHPAPI void php_strip_tags(char *rbuf, int len, int *state, char *allow, int allow_len);
+PHPAPI size_t php_strip_tags(char *rbuf, int len, int *state, char *allow, int allow_len);
 PHPAPI int php_char_to_str(char *str, uint len, char from, char *to, int to_len, pval *result);
 PHPAPI void php_implode(zval *delim, zval *arr, zval *return_value);
 PHPAPI void php_explode(zval *delim, zval *str, zval *return_value, int limit);

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 762476f0a2e6f63f3c152efc32f79bd38086b697..d4c31fe2500ef452be418e34f02ed10d6e4d1a62 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3038,6 +3038,7 @@ PHP_FUNCTION(strip_tags)
        zval **str, **allow=NULL;
        char *allowed_tags=NULL;
        int allowed_tags_len=0;
+       size_t retval_len;
 
        switch (ZEND_NUM_ARGS()) {
                case 1:
@@ -3059,8 +3060,8 @@ PHP_FUNCTION(strip_tags)
        }
        convert_to_string_ex(str);
        buf = estrndup(Z_STRVAL_PP(str), Z_STRLEN_PP(str));
-       php_strip_tags(buf, Z_STRLEN_PP(str), NULL, allowed_tags, allowed_tags_len);
-       RETURN_STRING(buf, 0);
+       retval_len = php_strip_tags(buf, Z_STRLEN_PP(str), NULL, allowed_tags, allowed_tags_len);
+       RETURN_STRINGL(buf, retval_len, 0);
 }
 /* }}} */
 
@@ -3294,7 +3295,7 @@ int php_tag_find(char *tag, int len, char *set) {
        swm: Added ability to strip <?xml tags without assuming it PHP
        code.
 */
-PHPAPI void php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int allow_len)
+PHPAPI size_t php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int allow_len)
 {
        char *tbuf, *buf, *p, *tp, *rp, c, lc;
        int br, i=0, depth=0;
@@ -3484,12 +3485,16 @@ reg_char:
                c = *(++p);
                i++;
        }       
-       *rp = '\0';
+       if (rp < rbuf + len) {
+               *rp = '\0';
+       }
        efree(buf);
        if (allow)
                efree(tbuf);
        if (stateptr)
                *stateptr = state;
+
+       return (size_t)(rp - rbuf);
 }
 /* }}} */