From 4e0134c6618844f076d40fb346e78b89e98c825c Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Sat, 13 Feb 2016 17:47:30 +0100
Subject: [PATCH] Fix bounds check in strip_tags()

---
 ext/standard/string.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index bcfc3b61812..d5f83e7d0f4 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4822,7 +4822,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
 				 * state == 2 (PHP). Switch back to HTML.
 				 */
 
-				if (state == 2 && p > buf+2 && strncasecmp(p-4, "<?xm", 4) == 0) {
+				if (state == 2 && p > buf+4 && strncasecmp(p-4, "<?xm", 4) == 0) {
 					state = 1; is_xml=1;
 					break;
 				}