From: cataphract Operating system: Any PHP version: 5.4SVN-2012-02-03 (SVN) Package: Reproducible crash Bug Type: Bug Bug description:Buffer overflow on htmlspecialchars/entities with $double=false Description: ------------ Long entities can cause a buffer overflow because the loop only guarantees 40 bytes available in beginning. Test script: ---------------