fixed #43841 mb_strrpos offset is byte count for negative values.

diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 9932d73c87266eb2cd521fc0a98bf82dcd760027..4ded5962a5492aeca7cb875d21d8d546a1f8906d 100644 (file)
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -1726,6 +1726,13 @@ PHP_FUNCTION(mb_strrpos)
        if (needle.len <= 0) {
                RETURN_FALSE;
        }
+
+       if ((offset > 0 && offset > mbfl_strlen(&haystack)) ||
+               (offset < 0 && -offset > mbfl_strlen(&haystack))) {
+               php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Offset is greater than the length of haystack string");
+               RETURN_FALSE;
+       }
+
        n = mbfl_strpos(&haystack, &needle, offset, 1);
        if (n >= 0) {
                RETVAL_LONG(n);