diff options
| author | Andrei Zmievski <andrei@php.net> | 2006-10-02 19:42:42 +0000 |
|---|---|---|
| committer | Andrei Zmievski <andrei@php.net> | 2006-10-02 19:42:42 +0000 |
| commit | c36d94aac251298cf78d37a52799cfed61ea7eea (patch) | |
| tree | fcf4bdef3eb5a609be18e992f6c75dab284fe8fb /ext/standard | |
| parent | 9c1b3c6d881fef417ab4eff0dde9655be9ed18d0 (diff) | |
| download | php-git-c36d94aac251298cf78d37a52799cfed61ea7eea.tar.gz | |
Fix invalid memory access in strrpos().
Diffstat (limited to 'ext/standard')
| -rw-r--r-- | ext/standard/string.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/ext/standard/string.c b/ext/standard/string.c index 4ce916715a..a59115765f 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1767,13 +1767,18 @@ PHP_FUNCTION(strrpos) } if (offset >= 0) { + if (offset > haystack_len) { + RETURN_FALSE; + } p = haystack + offset; e = haystack + haystack_len - needle_len; } else { - p = haystack; if (-offset > haystack_len) { - e = haystack - needle_len; - } else if (needle_len > -offset) { + RETURN_FALSE; + } + + p = haystack; + if (needle_len > -offset) { e = haystack + haystack_len - needle_len; } else { e = haystack + haystack_len + offset; |