From: Ilia Alshanetsky <iliaa@php.net>
Date: Tue, 22 Dec 2009 02:04:12 +0000 (+0000)
Subject: Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).
X-Git-Tag: php-5.4.0alpha1~191^2~2184
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c0dd0e94f2e5b01527d34aae500a5dfcf88fb640;p=php

Fixed bug #45599 (strip_tags() truncates rest of string with invalid attribute).
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index a727507bee..35a28e86bc 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -6406,7 +6406,7 @@ PHPAPI int php_u_strip_tags(UChar *rbuf, int len, int *stateptr, UChar *allow, i
 				tp = ((tp-tbuf) >= UBYTES(PHP_TAG_BUF_SIZE) ? tbuf: tp);
 				*(tp++) = ch;
 			}
-			if (state && prev1 != 0x5C /*'\\'*/ && (!in_q || ch == in_q)) {
+			if (state && (state ==1 || prev1 != 0x5C /*'\\'*/) && (!in_q || ch == in_q)) {
 				if (in_q) {
 					in_q = 0;
 				} else {
@@ -6650,7 +6650,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
 					tp = ((tp-tbuf) >= PHP_TAG_BUF_SIZE ? tbuf: tp);
 					*(tp++) = c;
 				}
-				if (state && p != buf && *(p-1) != '\\' && (!in_q || *p == in_q)) {
+				if (state && p != buf && (state == 1 || *(p-1) != '\\') && (!in_q || *p == in_q)) {
 					if (in_q) {
 						in_q = 0;
 					} else {