|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
[2020-01-22 19:43 UTC] ryat@php.net
-Summary: OOB read in php_strip_tags_ex
+Summary: Another OOB read in php_strip_tags_ex
[2020-01-23 07:15 UTC] stas@php.net
-Status: Open
+Status: Closed
-Assigned To:
+Assigned To: stas
[2020-01-23 07:15 UTC] stas@php.net
|
|||||||||||||||||||||||||||
Copyright © 2001-2025 The PHP GroupAll rights reserved. |
Last updated: Thu Oct 30 07:00:02 2025 UTC |
Description: ------------ string.c: ``` PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const char *allow, size_t allow_len, zend_bool allow_tag_spaces) { ... case '>': ... case 2: /* PHP */ if (!br && lc != '\"' && *(p-1) == '?') { ``` PoC: ``` <?php $stream = fopen('php://memory', 'w+'); fputs($stream, "<?\n>"); rewind($stream); var_dump(fgetss($stream)); var_dump(fgetss($stream)); fclose($stream); ?> ``` Fix: ``` if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') { ```