return NULL right away if invalid length was passed

1 files changed, 6 insertions, 2 deletions

diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index a19e8f2892..626dbf010b 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -235,9 +235,13 @@ zend_memnstr(char *haystack, char *needle, int needle_len, char *end)
 
 static inline void *zend_memrchr(const void *s, int c, size_t n)
 {
-	register unsigned char *e = (unsigned char *)s + n;
+	register unsigned char *e;
 
-	for (e--; e >= (unsigned char *)s; e--) {
+	if (n <= 0) {
+		return NULL;
+	}
+
+	for (e = (unsigned char *)s + n - 1; e >= (unsigned char *)s; e--) {
 		if (*e == (unsigned char)c) {
 			return (void *)e;
 		}