Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).

diff --git a/NEWS b/NEWS
index d1a016ca6e87db8eb963e252d17292082a8a14ee..e1d97cfeb92c7d3df1879f14f69c41ddd2963767 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,8 @@ PHP                                                                        NEWS
   (Jani)
 - Fixed bug #50394 (Reference argument converted to value in __call). (Stas)
 - Fixed bug #49851 (http wrapper breaks on 1024 char long headers). (Ilia)
-
+- Fixed bug #45599 (strip_tags() truncates rest of string with invalid
+  attribute). (Ilia, hradtke)
 
 17 Dec 2009, PHP 5.2.12
 - Updated timezone database to version 2009.19 (2009s). (Derick)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 87c6d942162f545c9cb5a7530fff601f7088b7bc..fa8fcd2a1d8fcf85e6e94244eb4fdea061ff8848 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4470,7 +4470,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
                                        tp = ((tp-tbuf) >= PHP_TAG_BUF_SIZE ? tbuf: tp);
                                        *(tp++) = c;
                                }
-                               if (state && p != buf && *(p-1) != '\\' && (!in_q || *p == in_q)) {
+                               if (state && p != buf && (state == 1 || *(p-1) != '\\') && (!in_q || *p == in_q)) {
                                        if (in_q) {
                                                in_q = 0;
                                        } else {