MFH(r-1.379,r-1.1): real fix and a test case for bug #22008

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 072706c26451ed56dad7f6a7ceb21734c7673311..9b759071d210993be92e96adc73cad56c9985328 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3396,11 +3396,18 @@ PHPAPI size_t php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, in
                                                }
                                                break;
                                                
-                                       case 3: /* JavaScript/CSS/etc... */
+                                       case 3:
                                                state = 0;
                                                tp = tbuf;
                                                break;
-                                       
+
+                                       case 4: /* JavaScript/CSS/etc... */
+                                               if (p >= buf + 2 && *(p-1) == '-' && *(p-2) == '-') {
+                                                       state = 0;
+                                                       tp = tbuf;
+                                               }
+                                               break;
+
                                        default:
                                                *(rp++) = c;
                                                break;
@@ -3440,6 +3447,12 @@ PHPAPI size_t php_strip_tags(char *rbuf, int len, int *stateptr, char *allow, in
                                }
                                break;
 
+                       case '-':
+                               if (state == 3 && p >= buf + 2 && *(p-1) == '-' && *(p-2) == '!') {
+                                       state = 4;
+                               }
+                               break;
+
                        case '?':
 
                                if (state == 1 && *(p-1)=='<') {