fix negative zend_long to size_t cast

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 6c5e58e2bb3dd54dbad2eaff9c9dbee9d6145444..101e88b6b322f602072644c1c5b42ad1cd818fd1 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2484,9 +2484,10 @@ PHP_FUNCTION(substr_replace)
                         * of the string
                         */
                        if (f < 0) {
-                               f = Z_STRLEN_P(str) + f;
-                               if (f < 0) {
+                               if (f < 0 && -f > Z_STRLEN_P(str)) {
                                        f = 0;
+                               } else {
+                                       f = Z_STRLEN_P(str) + f;
                                }
                        } else if (f > Z_STRLEN_P(str)) {
                                f = Z_STRLEN_P(str);