utf8 substr can access memory outside PVX buffer

	Message-ID: <m3iuhonl4h.fsf@furu.g.aas.no>

p4raw-id: //depot/perl@2000

1 files changed, 4 insertions, 0 deletions

diff --git a/sv.c b/sv.c
index ad38a8762e..97a07909c7 100644
--- a/sv.c
+++ b/sv.c
@@ -3134,12 +3134,16 @@ sv_pos_u2b(register SV *sv, I32* offsetp, I32* lenp)
     send = s + len;
     while (s < send && uoffset--)
 	s += UTF8SKIP(s);
+    if (s >= send)
+	s = send;
     *offsetp = s - start;
     if (lenp) {
 	I32 ulen = *lenp;
 	start = s;
 	while (s < send && ulen--)
 	    s += UTF8SKIP(s);
+	if (s >= send)
+	    s = send;
 	*lenp = s - start;
     }
     return;