Fixed bug #44889

[bwoebi]

This PR fixes https://bugs.php.net/bug.php?id=44889

It's a simple check if it's the end of the input string and if the string is <?php. And when yes, it extends the yyleng to include the whole <?php string and moves YYCURSOR by sizeof("php").

[nikic]

Why is this only done with short tags enabled? Furthermore, it looks to me like this may dereference the string pasts its end.

[bwoebi]

@nikic There is some padding in yytext. So ./sapi/cli/php -dshort_open_tag=1 -r "print_r(token_get_all('<?a'));" doesn't segfault.

Hmm, I just see, that without short_open_tags the token is wrong without short_open_tags. Will fix.

[bwoebi]

@nikic Used YYFILL to ensure that the buffer is always filled (= no segfault triggering dereference). Also with short_open_tag=Off it works now.

[nikic]

char should be zend_bool here. The YYFILL has to come after the declaration to be C89 compatible.

[jpauli]

Not reproductible on latest 5.5 nor 5.6.
Closing