MFH: fixed bug #21744

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 3f5ae30cc08b93d07829ce8ce5f8ffb463b0a452..b21157070fffc975c69c1b4539f3fe237aa6172f 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3515,8 +3515,16 @@ PHPAPI void php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, int
                                        state = 3;
                                        lc = c;
                                } else {
-                                       *(rp++) = c;
-                               }       
+                                       if (state == 0) {
+                                               *(rp++) = c;
+                                       } else if (allow && state == 1) {
+                                               *(tp++) = c;
+                                               if ( (tp-tbuf) >= PHP_TAG_BUF_SIZE ) {
+                                                       /* prevent buffer overflows */
+                                                       tp = tbuf;
+                                               }
+                                       }
+                               }
                                break;
 
                        case '?':