Re: cvs: php4 /ext/standard string.c
| From: | Gavin Sherry | Date: | Wed, 22 Aug 2001 05:21:57 +0000 |
| Subject: | Re: cvs: php4 /ext/standard string.c | ||
| References: | 1 | Groups: | php.cvs |
| Request: | Send a blank email to php-cvs+get-7011@lists.php.net to get a copy of this message | ||
On Wed, 22 Aug 2001, Derick Rethans wrote:
> On Wed, 22 Aug 2001, Gavin Sherry wrote:
>
> > swm Tue Aug 21 22:03:15 2001 EDT
> >
> > Modified files:
> > /php4/ext/standard string.c
> > Log:
> > Changed php_strip_tags() to check if <? was XML code.
> >
> > case '?':
> > - if (state==1 && *(p-1)=='<') {
> > + if (state==1 && *(p-1)=='<' && *(p+1) != 'x'
> > + && *(p+2) != 'm' && *(p+3) != 'l') {
>
> Are you sure this is safe? *(p+1..3) do not need to be available. And so
> this code may crash PHP.
>
> Derick
This is true. I'll fix it now.
Gavin