Julian/phpbb_board3-portal_tlw
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #90 from marc1706/master

Browse Source 
Fix: Infinite loop caused by smiley code with "["
This commit is contained in:
Marc Alexander
2012-08-04 04:26:36 -07:00
parent 1c4a73efa7 ec54bb99c4
commit 7ddb84c514
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
root/includes/trim_message/bbcodes.php
View File

@@ -364,10 +364,19 @@ class phpbb_trim_message_bbcodes
$content_length = utf8_strlen($content);
$last_smiley = false;
$last_html_opening = $last_html_closing = 0;
while (($last_html_opening = utf8_strpos($content, '<', $last_html_closing)) !== false &&
utf8_strpos($content, '>', $last_html_opening) !== false)
while (($last_html_opening = utf8_strpos($content, '<', $last_html_closing)) !== false)
{
$last_html_closing = utf8_strpos($content, '>', $last_html_opening);
/**
* Abort while loop if there are no more ">" or we'll end up in an
* endless loop. The abort needs to be done here or the following
* code will produce incorrect data.
*/
if (!$last_html_closing)
{
break;
}
if (($smiley_code = utf8_substr($content, $last_html_opening + 7, ($last_html_closing - $last_html_opening - 11))) != '--')
{
if ($last_smiley == $smiley_code)
@@ -415,6 +424,15 @@ class phpbb_trim_message_bbcodes
{
// foreach markup we find in the string, we enlarge our text-size.
$last_html_closing = utf8_strpos($content, '>', $last_html_opening);
/**
* Abort while loop if there are no more ">" or the following code
* will produce incorrect data and additionally produce a PHP Notice.
*/
if (!$last_html_closing)
{
break;
}
$content_length += ($last_html_closing - $last_html_opening) + 1;
$smiley_code = utf8_substr($content, $last_html_opening + 7, ($last_html_closing - $last_html_opening - 11));