Fix invalid memory access in strrpos().

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 4ce916715a0567b1aff862a19d05159ef495c35c..a59115765fa2bb8ebdd54d012a829ae2b8eb86b0 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1767,13 +1767,18 @@ PHP_FUNCTION(strrpos)
        }
 
        if (offset >= 0) {
+               if (offset > haystack_len) {
+                       RETURN_FALSE;
+               }
                p = haystack + offset;
                e = haystack + haystack_len - needle_len;
        } else {
-               p = haystack;
                if (-offset > haystack_len) {
-                       e = haystack - needle_len;
-               } else if (needle_len > -offset) {
+                       RETURN_FALSE;
+               }
+
+               p = haystack;
+               if (needle_len > -offset) {
                        e = haystack + haystack_len - needle_len;
                } else {
                        e = haystack + haystack_len + offset;