fix negative zend_long to size_t cast

ctz · Jun 29, 2015 · 5060060 · 5060060
1 parent 8271890
commit 5060060
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -2484,9 +2484,10 @@ PHP_FUNCTION(substr_replace)
 			 * of the string
 			 */
 			if (f < 0) {
-				f = Z_STRLEN_P(str) + f;
-				if (f < 0) {
+				if (f < 0 && -f > Z_STRLEN_P(str)) {
 					f = 0;
+				} else {
+					f = Z_STRLEN_P(str) + f;
 				}
 			} else if (f > Z_STRLEN_P(str)) {
 				f = Z_STRLEN_P(str);