Fix bug #72221 (segfault, past-the-end access)

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 50557e56d80dbd97fd46f2e347e157f266e85498..a02551b1bdd5f7f86769675a4073a30bcdfff2e7 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -2927,6 +2927,9 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
                if (i == needle_len) {
                        return p;
                }
+               if (UNEXPECTED(p == end)) {
+                       return NULL;
+               }
                p += td[(unsigned char)(p[needle_len])];
        }