Cast to size_t before performing operations instead of afterwards.
--- /dev/null
+--TEST--
+Accessing PHP_INT_MAX and PHP_INT_MIN as string offsets
+--FILE--
+<?php
+
+$str = "";
+var_dump($str[PHP_INT_MAX]);
+var_dump($str[PHP_INT_MIN]);
+
+?>
+--EXPECTF--
+Notice: Uninitialized string offset: %d in %s on line %d
+string(0) ""
+
+Notice: Uninitialized string offset: -%d in %s on line %d
+string(0) ""
offset = Z_LVAL_P(dim);
}
- if (UNEXPECTED(Z_STRLEN_P(container) < (size_t)((offset < 0) ? -offset : (offset + 1)))) {
+ if (UNEXPECTED(Z_STRLEN_P(container) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
if (type != BP_VAR_IS) {
zend_error(E_NOTICE, "Uninitialized string offset: " ZEND_LONG_FMT, offset);
ZVAL_EMPTY_STRING(result);