Fix bug #7667.

diff --git a/ext/standard/string.c b/ext/standard/string.c
index be54fde2de11d899cc18d05a1d0e8ecc5d15d304..f6452abd85c81344565062affbb9534ddcae6bef 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1270,7 +1270,9 @@ PHP_FUNCTION(substr_replace)
                if (f < 0) {
                        f = 0;
                }
-       }
+       } else if (f > (int)(*str)->value.str.len)
+               f = (int)(*str)->value.str.len;
+
 
        /* if "length" position is negative, set it to the length
         * needed to stop that many chars from the end of the string
@@ -1282,10 +1284,6 @@ PHP_FUNCTION(substr_replace)
                }
        }
 
-       if (f >= (int)(*str)->value.str.len) {
-               RETURN_STRINGL((*str)->value.str.val, (*str)->value.str.len, 1);
-       }
-
        if((f+l) > (int)(*str)->value.str.len) {
                l = (int)(*str)->value.str.len - f;
        }