From cea6d2b1559a28ac7c1a81fc2ee6037737964e2c Mon Sep 17 00:00:00 2001 From: Marc Alexander Date: Mon, 30 Jul 2012 21:45:06 +0200 Subject: [PATCH] Fix: Infinite loop caused by smiley code with "[" Complete error description here: http://www.flying-bits.org/tracker.php?p=33&t=978 --- root/includes/trim_message/bbcodes.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/root/includes/trim_message/bbcodes.php b/root/includes/trim_message/bbcodes.php index 05d3bf66..cbb36970 100644 --- a/root/includes/trim_message/bbcodes.php +++ b/root/includes/trim_message/bbcodes.php @@ -364,7 +364,8 @@ class phpbb_trim_message_bbcodes $content_length = utf8_strlen($content); $last_smiley = false; $last_html_opening = $last_html_closing = 0; - while (($last_html_opening = utf8_strpos($content, '<', $last_html_closing)) !== false) + while (($last_html_opening = utf8_strpos($content, '<', $last_html_closing)) !== false && + utf8_strpos($content, '>', $last_html_opening) !== false) { $last_html_closing = utf8_strpos($content, '>', $last_html_opening); if (($smiley_code = utf8_substr($content, $last_html_opening + 7, ($last_html_closing - $last_html_opening - 11))) != '--')