php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #1812 Crash when a switch is within a for loop parsing thru a string. :)
Submitted: 1999-07-21 19:46 UTC Modified: 1999-07-23 14:41 UTC
From: C dot Just at its dot uq dot edu dot au Assigned:
Status: Closed Package: Reproducible Crash
PHP Version: 4.0 Beta 1 OS: Win32 (Pretty sure it's Independ
Private report: No CVE-ID: None
 [1999-07-21 19:46 UTC] C dot Just at its dot uq dot edu dot au
Here is a sequence of code which I found doesn't work.
I have a better way of performing this function with regexp's but this should work without crashing anyway.

I have had a play with this function removing bits here and there to find out exactly where the problem is.
It seems that if you remove this section.
-----------
      case "<":
        $stack++;
        break;
      case ">":
        $stack--;
        break;
-----------
There is no crash.
Also if the for loop is removed there is no crash.
Also if I replace the switch statement line with this
------------
    $temp = $str[$i];
    switch($temp) {
------------
It works too.

Thought that might make it a bit easier to track down.

Here is the function below.
------------------------------
function StripHTML($str) {
  $dest = "";
  $stack = 0;
  for ($i=0;$i<strlen($str);$i++) {
    switch($str[$i]) {
      case "<":
        $stack++;
        break;
      case ">":
        $stack--;
        break;
      default:
        if (!$stack) {
          $dest .= $str[$i];
        }
        break;
    }
  }
  return $dest;
}
---------------------------

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [1999-07-23 14:41 UTC] zeev at cvs dot php dot net
Reproduced & fixed
This case currently results in a memory leak, we'll work on it soon
(no crash anymore though)
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun May 26 16:01:29 2024 UTC