clarify checks and error messages

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 4b39d4904b737c6c610ea2bf64718c12d9a4c3a2..91f27ee54c8458d787e9de60f971f64d884db9e5 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4655,7 +4655,7 @@ PHP_FUNCTION(substr_count)
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be greater than 0.");
                                RETURN_FALSE;           
                        }
-                       if ((p + Z_LVAL_PP(length)) <= p || (p + Z_LVAL_PP(length)) > endp) {
+                       if (Z_LVAL_PP(length) > (Z_STRLEN_PP(haystack) - Z_LVAL_PP(offset))) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length.", Z_LVAL_PP(length));
                                RETURN_FALSE;
                        }
@@ -5076,11 +5076,16 @@ PHP_FUNCTION(substr_compare)
                offset = (offset < 0) ? 0 : offset;
        }
 
-       if ((offset + len) > s1_len || (offset+len) < 0) {
+       if(offset > s1_len) {
                php_error_docref(NULL TSRMLS_CC, E_WARNING, "The start position cannot exceed initial string length");
                RETURN_FALSE;
        }
 
+       if(len > s1_len - offset) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "The length cannot exceed initial string length");
+               RETURN_FALSE;
+       }
+
        cmp_len = (uint) (len ? len : MAX(s2_len, (s1_len - offset)));
 
        if (!cs) {