Improved length parameter validation

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 9c55575bb0a56edd7fef4525e1c0370ad1c9f482..4b39d4904b737c6c610ea2bf64718c12d9a4c3a2 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4655,7 +4655,7 @@ PHP_FUNCTION(substr_count)
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be greater than 0.");
                                RETURN_FALSE;           
                        }
-                       if ((p + Z_LVAL_PP(length)) > endp) {
+                       if ((p + Z_LVAL_PP(length)) <= p || (p + Z_LVAL_PP(length)) > endp) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length.", Z_LVAL_PP(length));
                                RETURN_FALSE;
                        }