fixed bug of mb_substitute_character() and mb_substr() in mbstring.

2 files changed, 18 insertions, 8 deletions

diff --git a/ext/mbstring/mbfilter.c b/ext/mbstring/mbfilter.c
index 2eb1bf19a0..047ee08c73 100644
--- a/ext/mbstring/mbfilter.c
+++ b/ext/mbstring/mbfilter.c
@@ -6353,18 +6353,24 @@ mbfl_substr(
 			p = string->val;
 			if (p != NULL) {
 				/* search start position */
-				do {
+				while (k <= from) {
 					start = n;
+					if (n >= len) {
+						break;
+					}
 					m = mbtab[*p];
 					n += m;
 					p += m;
 					k++;
-				} while (k <= from && n < len);
+				}
 				/* detect end position */
 				k = 0;
 				end = start;
-				while (k < length && n <= len) {
+				while (k < length) {
 					end = n;
+					if (n >= len) {
+						break;
+					}
 					m = mbtab[*p];
 					n += m;
 					p += m;
@@ -6394,11 +6400,14 @@ mbfl_substr(
 		result->len = 0;
 		result->val = w = (unsigned char*)mbfl_malloc((n + 8)*sizeof(unsigned char));
 		if (w != NULL) {
-			result->len = n;
-			p = &(string->val[start]);
-			while (n > 0) {
-				*w++ = *p++;
-				n--;
+			p = string->val;
+			if (p != NULL) {
+				p += start;
+				result->len = n;
+				while (n > 0) {
+					*w++ = *p++;
+					n--;
+				}
 			}
 			*w++ = '\0';
 			*w++ = '\0';
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 2b9dc8d6a0..e6c9271634 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -765,6 +765,7 @@ PHP_FUNCTION(mb_substitute_character)
 			MBSTRG(current_filter_illegal_substchar) = Z_LVAL_PP(arg1);
 			break;
 		}
+		RETVAL_TRUE;
 	} else {
 		WRONG_PARAM_COUNT;
 	}