Fix bug #72221 (segfault, past-the-end access)

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index f47a14856450e1bdb9d95b15137f9991a4f1e8d6..8eb9a7b637e277de9120197df70f831eaa25e3cc 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2965,6 +2965,9 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
                if (i == needle_len) {
                        return p;
                }
+               if (UNEXPECTED(p == end)) {
+                       return NULL;
+               }
                p += td[(unsigned char)(p[needle_len])];
        }