From: Antony Dovgal <tony2001@php.net>
Date: Thu, 7 Jul 2005 15:19:40 +0000 (+0000)
Subject: fix #33605 (substr_compare() crashes with negative offset & length)
X-Git-Tag: php-5.1.0b3~127
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3baf1f7632dd5fe0789707b8bbf197dc388c34f5;p=php

fix #33605 (substr_compare() crashes with negative offset & length)
---

diff --git a/NEWS b/NEWS
index 20aee85b3d..20ff8f09ac 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,8 @@ PHP                                                                        NEWS
 - Fixed memory corruption in pg_copy_from() in case the as_null parameter was
   passed. (Derick)
 - Fixed crash inside stream_get_line() when length parameter equals 0. (Ilia)
+- Fixed bug #33605 (substr_compare() crashes with negative offset and length). 
+  (Tony)
 - Fixed bug #33578 (strtotime() doesn't understand "11 Oct" format). (Derick)
 - Fixed bug #33562 (date("") crashes). (Derick)
 - Fixed bug #33536 (strtotime() defaults to now even on non time string).
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 31a6d7d295..10e9f8dbcf 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4446,6 +4446,10 @@ PHP_FUNCTION(substr_count)
 	
 	if (ac > 2) {
 		convert_to_long_ex(offset);
+		if (Z_LVAL_PP(offset) < 0) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset should be greater then or equal to 0.");
+			RETURN_FALSE;		
+		}
 		p += Z_LVAL_PP(offset);
 		if (p > endp) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset value %ld exceeds string length.", Z_LVAL_PP(offset));
@@ -4453,6 +4457,10 @@ PHP_FUNCTION(substr_count)
 		}
 		if (ac == 4) {
 			convert_to_long_ex(length);
+			if (Z_LVAL_PP(length) <= 0) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be greater than 0.");
+				RETURN_FALSE;		
+			}
 			if ((p + Z_LVAL_PP(length)) > endp) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length value %ld exceeds string length.", Z_LVAL_PP(length));
 				RETURN_FALSE;