return NULL right away if invalid length was passed

diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index a19e8f2892c79aa5aa7585b2af46da013f0697bf..626dbf010b41a03bfde772ad903ce0d9d508a0b3 100644 (file)
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -235,9 +235,13 @@ zend_memnstr(char *haystack, char *needle, int needle_len, char *end)
 
 static inline void *zend_memrchr(const void *s, int c, size_t n)
 {
-       register unsigned char *e = (unsigned char *)s + n;
+       register unsigned char *e;
 
-       for (e--; e >= (unsigned char *)s; e--) {
+       if (n <= 0) {
+               return NULL;
+       }
+
+       for (e = (unsigned char *)s + n - 1; e >= (unsigned char *)s; e--) {
                if (*e == (unsigned char)c) {
                        return (void *)e;
                }