Index: includes/parser/StripState.php
===================================================================
--- includes/parser/StripState.php	(revision 114159)
+++ includes/parser/StripState.php	(working copy)
@@ -87,16 +87,29 @@
 	 */
 	protected function unstripType( $type, $text ) {
 		// Shortcut 
-		if ( !count( $this->data[$type] ) ) {
+		$numbStripItems = count( $this->data[$type] );
+		if ( $numbStripItems === 0 ) {
 			return $text;
 		}
 
 		wfProfileIn( __METHOD__ );
 		$this->tempType = $type;
-		do {
+
+		// Only do unstrip a max of $numbStripItems.
+		// Most of the time, this loop would only be
+		// needed to execute once, but in the worst
+		// case it might need to be executed once for
+		// each item. Limitting to $numbStripItems
+		// prevents someone from maliciously making
+		// cyclic strip item references. (bug 35315)
+		for ( $i = 0; $i < $numbStripItems; $i++ ) {
 			$oldText = $text;
 			$text = preg_replace_callback( $this->regex, array( $this, 'unstripCallback' ), $text );
-		} while ( $text !== $oldText );
+			if ( $text === $oldText ) {
+				// No changes so we can exit the loop
+				break;
+			}
+		}
 		$this->tempType = null;
 		wfProfileOut( __METHOD__ );
 		return $text;