From: Nikita Popov <nikic@php.net>
Date: Sat, 13 Feb 2016 16:47:30 +0000 (+0100)
Subject: Fix bounds check in strip_tags()
X-Git-Tag: php-7.0.4RC1~29^2
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4e0134c6618844f076d40fb346e78b89e98c825c;p=php

Fix bounds check in strip_tags()
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index bcfc3b6181..d5f83e7d0f 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
 				 * state == 2 (PHP). Switch back to HTML.
 				 */
 
-				if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
+				if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
 					state = 1; is_xml=1;
 					break;
 				}