From: Anatol Belski <ab@php.net>
Date: Mon, 29 Jun 2015 08:27:13 +0000 (+0200)
Subject: fix negative zend_long to size_t cast
X-Git-Tag: php-7.1.0alpha3~25^2~123
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5060060317b0fd8c8d806c81e673b37ffb830159;p=php

fix negative zend_long to size_t cast
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 6c5e58e2bb..101e88b6b3 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2484,9 +2484,10 @@ PHP_FUNCTION(substr_replace)
 			 * of the string
 			 */
 			if (f < 0) {
-				f = Z_STRLEN_P(str) + f;
-				if (f < 0) {
+				if (f < 0 && -f > Z_STRLEN_P(str)) {
 					f = 0;
+				} else {
+					f = Z_STRLEN_P(str) + f;
 				}
 			} else if (f > Z_STRLEN_P(str)) {
 				f = Z_STRLEN_P(str);