From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 22 Dec 2009 02:04:12 +0000 (+0000)
Subject: Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).
X-Git-Tag: php-5.2.13RC1~87
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b4c18745d9db74d288d48bf8a2a19a3c5d5ca3d2;p=php

Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).
---

diff --git a/NEWS b/NEWS
index d1a016ca6e..e1d97cfeb9 100644
--- a/NEWS
+++ b/NEWS
@@ -9,7 +9,8 @@ PHP                                                                        NEWS
   (Jani)
 - Fixed bug #50394 (Reference argument converted to value in __call). (Stas)
 - Fixed bug #49851 (http wrapper breaks on 1024 char long headers). (Ilia)
-
+- Fixed bug #45599 (strip_tags() truncates rest of string with invalid
+  attribute). (Ilia, hradtke)
 
 17 Dec 2009, PHP 5.2.12
 - Updated timezone database to version 2009.19 (2009s). (Derick)
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 87c6d94216..fa8fcd2a1d 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4470,7 +4470,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
 					tp = ((tp-tbuf) >= PHP_TAG_BUF_SIZE ? tbuf: tp);
 					*(tp++) = c;
 				}
-				if (state && p != buf && *(p-1) != '\\' && (!in_q || *p == in_q)) {
+				if (state && p != buf && (state == 1 || *(p-1) != '\\') && (!in_q || *p == in_q)) {
 					if (in_q) {
 						in_q = 0;
 					} else {