diff --git a/ext/standard/string.c b/ext/standard/string.c index 6f35ce44fbd..30567dc2b57 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1873,7 +1873,7 @@ PHP_FUNCTION(strrpos) p = haystack + offset; e = haystack + haystack_len - needle_len; } else { - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); RETURN_FALSE; } @@ -1951,7 +1951,7 @@ PHP_FUNCTION(strripos) e = haystack + haystack_len - 1; } else { p = haystack; - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); RETURN_FALSE; } @@ -1983,7 +1983,7 @@ PHP_FUNCTION(strripos) p = haystack_dup + offset; e = haystack_dup + haystack_len - needle_len; } else { - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { efree(needle_dup); efree(haystack_dup); php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string");