- MFH for bug #21311

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 69f1e89e967004c6ae83f429aa33c2df40741998..b37e2697bcae68b1a8f7bece817cd2f78cd5bf3c 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1399,6 +1399,9 @@ PHP_FUNCTION(strstr)
        if (Z_TYPE_PP(needle) == IS_STRING) {
                if (!Z_STRLEN_PP(needle)) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty delimiter.");
+                       efree(haystack_orig);
+                       zval_ptr_dtor(haystack);
+                       zval_ptr_dtor(needle);
                        RETURN_FALSE;
                }
 
@@ -3509,11 +3512,12 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int
                                /* JavaScript & Other HTML scripting languages */
                                if (state == 1 && *(p-1) == '<') { 
                                        state = 3;
+                                       lc = c;
                                } else {
                                        *(rp++) = c;
                                }       
                                break;
-                       
+
                        case '?':
 
                                if (state == 1 && *(p-1)=='<') { 
@@ -3522,13 +3526,28 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int
                                        break;
                                }
 
+                       case 'E':
+                       case 'e':
+                               /* !DOCTYPE exception */
+                               if (state==3 && p > buf+6
+                                                    && tolower(*(p-1)) == 'p'
+                                                && tolower(*(p-2)) == 'y'
+                                                    && tolower(*(p-3)) == 't'
+                                                    && tolower(*(p-4)) == 'c'
+                                                    && tolower(*(p-5)) == 'o'
+                                                    && tolower(*(p-6)) == 'd') {
+                                       state = 1;
+                                       break;
+                               }
+                               /* fall-through */
+
                        case 'l':
 
                                /* swm: If we encounter '<?xml' then we shouldn't be in
                                 * state == 2 (PHP). Switch back to HTML.
                                 */
 
-                               if (state == 2 && *(p-1) == 'm' && *(p-2) == 'x') {
+                               if (state == 2 && p > buf+2 && *(p-1) == 'm' && *(p-2) == 'x') {
                                        state = 1;
                                        break;
                                }