More checks for php_strip_tags_ex

php · Jan 23, 2020 · 2dc170e · 2dc170e
1 parent 7e2bd95
commit 2dc170e
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -4816,7 +4816,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 				switch (state) {
 					case 1: /* HTML/XML */
 						lc = '>';
-						if (is_xml && *(p -1) == '-') {
+						if (is_xml && p >= buf + 1 && *(p-1) == '-') {
 							break;
 						}
 						in_q = state = is_xml = 0;
@@ -4837,7 +4837,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 						break;
 
 					case 2: /* PHP */
-						if (!br && lc != '\"' && *(p-1) == '?') {
+						if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') {
 							in_q = state = 0;
 							tp = tbuf;
 						}