Fix bounds check in strip_tags()

This commit is contained in:
Nikita Popov 2016-02-13 17:47:30 +01:00
parent adcdb4f7ba
commit 4e0134c661

View file

@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
* state == 2 (PHP). Switch back to HTML.
*/
if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
state = 1; is_xml=1;
break;
}