Range check arguments to mb_strcut().

Test ext/mbstring/013.phpt causes a hard failure w/o this.

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index f5c1e02ebbeafdade1d38703b11768339a29ef0b..782474f4033bd9edafda149afbe888eb6da3fd88 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -2059,6 +2059,10 @@ PHP_FUNCTION(mb_strcut)
                if (from < 0) {
                        from = 0;
                }
+       } 
+       if (Z_STRLEN_PP(arg1) < from) {
+               /* keep index within string */
+               from = Z_STRLEN_PP(arg1);
        }
 
        /* if "length" position is negative, set it to the length
@@ -2070,6 +2074,10 @@ PHP_FUNCTION(mb_strcut)
                        len = 0;
                }
        }
+       if (Z_STRLEN_PP(arg1) < (from + len)) {
+               /* limit span to characters in string */
+               len = Z_STRLEN_PP(arg1) - from; 
+       }
 
        ret = mbfl_strcut(&string, &result, from, len TSRMLS_CC);
        if (ret != NULL) {