fix: keep large tables in writeHTML() by dropping table image align without a backtracking regex

Author: nicolaasuni

tcpdf.php

@@ -2,7 +2,7 @@
 
 //============================================================+
 // File name    : tcpdf.php
-// Version      : 7.0.15
+// Version      : 7.0.16
 // Author       : Nicola Asuni - Tecnick.com LTD - www.tecnick.com - info@tecnick.com
 // License      : GNU-LGPL v3 (https://www.gnu.org/copyleft/lesser.html)
 // Copyright (C): 2002-2026 Nicola Asuni - Tecnick.com LTD
@@ -15,7 +15,7 @@
  * See: https://tcpdf.org
  * @package com.tecnick.tcpdf
  * @author Nicola Asuni
- * @version 7.0.15
+ * @version 7.0.16
  */
 
 // TCPDF configuration
@@ -7653,16 +7653,26 @@ protected function normalizeHtmlMarkup(string $html): string
         // first line box of the table cell, which makes them overlap the
         // row borders; the vertical-align attribute is dropped inside
         // tables so the rows contain their images (legacy parity for the
-        // dominant image-only cell case).
-        $html = (string) preg_replace_callback(
-            '#<table\b.*?</table>#is',
-            static fn(array $match): string => (string) preg_replace(
-                '/(<img\b[^>]*?)\s+align="(top|middle|bottom|absmiddle|baseline)"/i',
-                '$1',
-                $match[0] ?? '',
-            ),
-            $html,
-        );
+        // dominant image-only cell case). The markup is split on table tags
+        // (odd indexes) to track the nesting depth in a single linear pass.
+        $parts = preg_split('#(</?table\b[^>]*>)#i', $html, -1, PREG_SPLIT_DELIM_CAPTURE);
+        if (is_array($parts)) {
+            $depth = 0;
+            foreach ($parts as $idx => $part) {
+                if (($idx % 2) === 1) {
+                    $depth = ($part[1] ?? '') === '/' ? max(0, $depth - 1) : $depth + 1;
+                    continue;
+                }
+
+                if ($depth > 0 && stripos($part, '<img') !== false) {
+                    $parts[$idx] =
+                        preg_replace('/(<img\b[^>]*?)\s+align="(top|middle|bottom|absmiddle|baseline)"/i', '$1', $part)
+                        ?? $part;
+                }
+            }
+
+            $html = implode('', $parts);
+        }
 
         // Legacy HTML images may carry base64 data with an '@' prefix; the
         // engine expects raw bytes after '@' but decodes data URIs.

test/TcpdfHtmlMarkupTest.php

@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * HTML markup normalization tests for writeHTML().
+ *
+ * @package com.tecnick.tcpdf
+ */
+
+require_once __DIR__ . '/TcpdfTestCase.php';
+
+class TcpdfHtmlMarkupTest extends TcpdfTestCase
+{
+    /**
+     * Run the protected markup normalization on the given HTML.
+     */
+    private function normalize(string $html): string
+    {
+        $pdf = new class('P', 'mm', 'A4', true, 'UTF-8', false) extends TCPDF {
+            public function normalize(string $html): string
+            {
+                return $this->normalizeHtmlMarkup($html);
+            }
+        };
+
+        return $pdf->normalize($html);
+    }
+
+    /**
+     * The test runs in a separate process: the JIT does not honour the backtrack
+     * limit, and turning it off only affects patterns compiled afterwards.
+     * The limits are restored before returning, as PHPUnit itself calls
+     * preg_replace() after the test method.
+     *
+     * @mago-expect lint:no-ini-set
+     */
+    #[\PHPUnit\Framework\Attributes\RunInSeparateProcess]
+    #[\PHPUnit\Framework\Attributes\PreserveGlobalState(false)]
+    public function testTableLargerThanBacktrackLimitIsKept(): void
+    {
+        $html = '<table border="1">';
+        for ($row = 1; $row <= 200; ++$row) {
+            $html .= '<tr><td>Row ' . $row . '</td><td><img src="data:," align="middle"></td></tr>';
+        }
+
+        $html .= '</table>';
+
+        $jit = (string) ini_get('pcre.jit');
+        $limit = (string) ini_get('pcre.backtrack_limit');
+        ini_set('pcre.jit', '0');
+        ini_set('pcre.backtrack_limit', '1000');
+        try {
+            $out = $this->normalize($html);
+        } finally {
+            ini_set('pcre.backtrack_limit', $limit);
+            ini_set('pcre.jit', $jit);
+        }
+
+        $this->assertSame(200, substr_count($out, '<tr>'), 'every table row must be kept');
+        $this->assertStringContainsString('Row 200</td>', $out);
+        $this->assertStringEndsWith('</table>', $out);
+        $this->assertStringNotContainsString('align=', $out);
+    }
+
+    public function testImageAlignIsDroppedOnlyInsideTables(): void
+    {
+        $out = $this->normalize(
+            '<p><img src="data:," align="middle"></p>'
+            . '<TABLE><tr><td>'
+            . '<table><tr><td><img src="data:," align="top"></td></tr></table>'
+            . '<img src="data:," align="bottom">'
+            . '</td></tr></TABLE>'
+            . '<img src="data:," align="baseline">'
+            . '<tablex><img src="data:," align="top"></tablex>',
+        );
+
+        $this->assertStringContainsString('<p><img src="data:," align="middle"></p>', $out);
+        $this->assertStringContainsString('<td><img src="data:,"></td></tr></table><img src="data:,"></td>', $out);
+        $this->assertStringContainsString('</TABLE><img src="data:," align="baseline">', $out);
+        $this->assertStringContainsString('<tablex><img src="data:," align="top"></tablex>', $out);
+    }
+}