From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Mon, 12 Oct 2009 14:25:51 +0000 (+0000)
Subject: - Bug #49785: take 3 - fixed infinite loop bug (only for 5.2) (reported by T.Komura... 
X-Git-Tag: php-5.2.12RC1~72
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=18b0a7870842e9a5495f525f896a97cb02ce78db;p=php

- Bug #49785: take 3 - fixed infinite loop bug (only for 5.2) (reported by T.Komura. Thanks)
---

diff --git a/ext/standard/html.c b/ext/standard/html.c
index 9627c94555..ff01c76cd8 100644
--- a/ext/standard/html.c
+++ b/ext/standard/html.c
@@ -484,15 +484,26 @@ struct basic_entities_dec {
 			}                        \
 			mbseq[mbpos++] = (mbchar); }
 
+/* skip one byte and return */
 #define MB_FAILURE(pos) do { \
+	*newpos = pos + 1; \
 	*status = FAILURE; \
 	return 0; \
 } while (0)
 
 #define CHECK_LEN(pos, chars_need)			\
-	if((str_len - (pos)) < chars_need) {	\
-		*status = FAILURE;					\
-		return 0;							\
+	if (chars_need < 1) {						\
+		if((str_len - (pos)) < chars_need) {	\
+			*newpos = pos;						\
+			*status = FAILURE;					\
+			return 0;							\
+		}										\
+	} else {									\
+		if((str_len - (pos)) < chars_need) {	\
+			*newpos = pos + 1;					\
+			*status = FAILURE;					\
+			return 0;							\
+		}										\
 	}
 
 /* {{{ get_next_char