REPORT: Potentially "Fatal Flaw" in SMF's bbcode parser

[dcmouser]

Great work, dougie.

[dougiefresh]

I don't have an SMF install right now, but should this line us " instead of "?

Code Select Expand

$tpos += ($pos1 = strpos(substr($message, $tpos), '"'));

Hmmmm.....  That's a good question.  Let me test and see....

Great work, dougie.

Thanks....

[dougiefresh]

UPDATE: The nightly version of SMF 2.1 Beta 2 has addressed this issue so that memory issues as described in the first post cannot crash the forum in this way....

[Joshua Dickerson]

In testing of your function, it takes about ~18% more time for the most common usages (<4 parameters). With more parameters, your implementation might be faster but there's no default BBC that has 4+ parameters and I doubt there are many mod BBC that have that. So, I think the best implementation is the one that is currently used.

[Joshua Dickerson]

In testing, I did find a bug though.

Code Select Expand

<img src="http://avatars.simplemachinesweb.com/smf/avatar_23_1337883444.png" alt="Test height=100" width="100" class="bbc_img resized" style="cursor: pointer;">