Use correct order of operations. Second of many fixes for bug #52550

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 6f35ce44fbdf4256c9d0be9b834ba5571e6a4b49..30567dc2b579d6f397a380a9efd4e17fa9abfe43 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1873,7 +1873,7 @@ PHP_FUNCTION(strrpos)
                p = haystack + offset;
                e = haystack + haystack_len - needle_len;
        } else {
-               if (-offset > haystack_len || offset < -INT_MAX) {
+               if (offset < -INT_MAX || -offset > haystack_len) {
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string");
                        RETURN_FALSE;
                }
@@ -1951,7 +1951,7 @@ PHP_FUNCTION(strripos)
                        e = haystack + haystack_len - 1;
                } else {
                        p = haystack;
-                       if (-offset > haystack_len || offset < -INT_MAX) {
+                       if (offset < -INT_MAX || -offset > haystack_len) {
                                php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string");
                                RETURN_FALSE;
                        }
@@ -1983,7 +1983,7 @@ PHP_FUNCTION(strripos)
                p = haystack_dup + offset;
                e = haystack_dup + haystack_len - needle_len;
        } else {
-               if (-offset > haystack_len || offset < -INT_MAX) {
+               if (offset < -INT_MAX || -offset > haystack_len) {
                        efree(needle_dup);
                        efree(haystack_dup);
                        php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string");