diff options
| author | Anatol Belski <ab@php.net> | 2015-06-29 11:35:36 +0200 |
|---|---|---|
| committer | Anatol Belski <ab@php.net> | 2015-06-29 12:15:21 +0200 |
| commit | c783645b99f35da3735977a05c9b7d0da372ce6b (patch) | |
| tree | 7a1e15285759bf86a1e15ab6e6048f42ea2f9c05 | |
| parent | c2ac0304a9699dfa41d87bdfcdd93585003eb8d3 (diff) | |
| download | php-git-c783645b99f35da3735977a05c9b7d0da372ce6b.tar.gz | |
fix more places with subtle negative zend_long to size_t cast
| -rw-r--r-- | ext/standard/string.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c index 0a5e8bec4d..1ce301e9cc 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -2563,9 +2563,10 @@ PHP_FUNCTION(substr_replace) f = zval_get_long(tmp_from); if (f < 0) { - f = orig_str->len + f; - if (f < 0) { + if (-f > orig_str->len) { f = 0; + } else { + f = orig_str->len + f; } } else if (f > orig_str->len) { f = orig_str->len; @@ -2577,9 +2578,10 @@ PHP_FUNCTION(substr_replace) } else { f = Z_LVAL_P(from); if (f < 0) { - f = orig_str->len + f; - if (f < 0) { + if (-f > orig_str->len) { f = 0; + } else { + f = orig_str->len + f; } } else if (f > orig_str->len) { f = orig_str->len; |