[2.1.3] Fix possible error in DirectLex reported by Nate Abele

git-svn-id: http://htmlpurifier.org/svnroot/htmlpurifier/trunk@1438 48356398-32a2-884e-a903-53898d9a118a

NEWS

@@ -27,8 +27,9 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 - Spurious internal content reorganization error suppressed
 - HTMLDefinition->addElement now returns a reference to the created
   element object, as implied by the documentation
-- Phorum mod's HTML Purifier help message expanded, however, a new tarball
+- Phorum mod's HTML Purifier help message expanded (unreleased elsewhere)
-  was not released
+- Fix a theoretical class of infinite loops from DirectLex reported
+  by Nate Abele
 . %Core.AcceptFullDocuments renamed to %Core.ConvertDocumentToFragment 
   to better communicate its purpose
 . Error unit tests can now specify the expectation of no errors. Future

library/HTMLPurifier/Lexer/DirectLex.php

@@ -160,9 +160,15 @@ class HTMLPurifier_Lexer_DirectLex extends HTMLPurifier_Lexer
                 
                 $segment = substr($html, $cursor, $strlen_segment);
                 
+                if ($segment === false) {
+                    // somehow, we attempted to access beyond the end of
+                    // the string, defense-in-depth, reported by Nate Abele
+                    break;
+                }
+                
                 // Check if it's a comment
                 if (
-                    substr($segment, 0, 3) == '!--'
+                    substr($segment, 0, 3) === '!--'
                 ) {
                     // re-determine segment length, looking for -->
                     $position_comment_end = strpos($html, '-->', $cursor);