String offset starts with 0, fix isset($str[$len])

diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
index dd6739728c9bfa0354f32b91a9aba779b481eef1..228c2d355da0e9c177961d2fef2fac0a4be1355f 100644 (file)
--- a/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@ -4410,12 +4410,12 @@ static int zend_isset_isempty_dim_prop_obj_handler(int prop_dim, ZEND_OPCODE_HAN
                } else if ((*container)->type == IS_STRING) { /* string offsets */
                        switch (opline->extended_value) {
                                case ZEND_ISSET:
-                                       if (offset->value.lval <= Z_STRLEN_PP(container)) {
+                                       if (offset->value.lval < Z_STRLEN_PP(container)) {
                                                result = 1;
                                        }
                                        break;
                                case ZEND_ISEMPTY:
-                                       if (offset->value.lval <= Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
+                                       if (offset->value.lval < Z_STRLEN_PP(container) && Z_STRVAL_PP(container)[offset->value.lval] != '0') {
                                                result = 1;
                                        }
                                        break;