Fixed crash in substr_compare()

Fixed error messages

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 736e70a78bbfc97b0aad189149b880947a7d45f1..489ae1d2ac808ed0529b0c2d1bb789f443b1dcaa 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -7208,7 +7208,7 @@ PHP_FUNCTION(substr_count)
                                tmp = (char *)p + length;
                        }
                        if (tmp > endp) {
-                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset value %ld exceeds string length", offset);
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length", length);
                                RETURN_FALSE;
                        } else {
                                endp = tmp;
@@ -7888,8 +7888,13 @@ PHP_FUNCTION(substr_compare)
                        offset = (offset < 0) ? 0 : offset;
                }
 
-               if ((offset + len) > s1_len) {
-                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "The specified segment exceeds string length");
+               if(offset > s1_len) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "The start position cannot exceed initial string length");
+                       RETURN_FALSE;
+               }
+
+               if(len > s1_len - offset) {
+                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "The length cannot exceed initial string length");
                        RETURN_FALSE;
                }
 

diff --git a/ext/standard/tests/strings/bug40754.phpt b/ext/standard/tests/strings/bug40754.phpt
index 23a459317b474e37de0651d3e3cd31cb1eacd459..26662dbbb3a1e8da181c9fb01231214620434f8c 100644 (file)
--- a/ext/standard/tests/strings/bug40754.phpt
+++ b/ext/standard/tests/strings/bug40754.phpt
@@ -32,25 +32,25 @@ bool(false)
 bool(false)
 bool(false)
 
-Warning: substr_count(): Offset value 2147483647 exceeds string length. in %s on line %d
+Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d
 bool(false)
 
 Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d
 bool(false)
 
-Warning: stripos(): Offset not contained in string. in %s on line %d
+Warning: stripos(): Offset not contained in string in %s on line %d
 bool(false)
 
-Warning: substr_count(): Offset value 2147483647 exceeds string length. in %s on line %d
+Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d
 bool(false)
 
-Warning: substr_count(): Length value 2147483647 exceeds string length. in %s on line %d
+Warning: substr_count(): Length value 2147483647 exceeds string length in %s on line %d
 bool(false)
 
-Warning: strpos(): Offset not contained in string. in %s on line %d
+Warning: strpos(): Offset not contained in string in %s on line %d
 bool(false)
 
-Warning: stripos(): Offset not contained in string. in %s on line %d
+Warning: stripos(): Offset not contained in string in %s on line %d
 bool(false)
 
 Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
@@ -61,3 +61,38 @@ bool(false)
 int(2)
 string(8) "abcdeabc"
 bool(false)
+--UEXPECTF--   
+unicode(4) "bcde"
+bool(false)
+bool(false)
+bool(false)
+
+Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d
+bool(false)
+
+Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d
+bool(false)
+
+Warning: stripos(): Offset not contained in string in %s on line %d
+bool(false)
+
+Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d
+bool(false)
+
+Warning: substr_count(): Length value 2147483647 exceeds string length in %s on line %d
+bool(false)
+
+Warning: strpos(): Offset not contained in string in %s on line %d
+bool(false)
+
+Warning: stripos(): Offset not contained in string in %s on line %d
+bool(false)
+
+Notice: strrpos(): Offset is greater than the length of haystack string in %s on line %d
+bool(false)
+
+Notice: strripos(): Offset is greater than the length of haystack string in %s on line %d
+bool(false)
+int(2)
+unicode(8) "abcdeabc"
+bool(false)