From: Andrei Zmievski <andrei@php.net>
Date: Mon, 2 Oct 2006 19:42:42 +0000 (+0000)
Subject: Fix invalid memory access in strrpos().
X-Git-Tag: php-5.2.0RC5~47
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c36d94aac251298cf78d37a52799cfed61ea7eea;p=php

Fix invalid memory access in strrpos().
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 4ce916715a..a59115765f 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -1767,13 +1767,18 @@ PHP_FUNCTION(strrpos)
 	}
 
 	if (offset >= 0) {
+		if (offset > haystack_len) {
+			RETURN_FALSE;
+		}
 		p = haystack + offset;
 		e = haystack + haystack_len - needle_len;
 	} else {
-		p = haystack;
 		if (-offset > haystack_len) {
-			e = haystack - needle_len;
-		} else if (needle_len > -offset) {
+			RETURN_FALSE;
+		}
+
+		p = haystack;
+		if (needle_len > -offset) {
 			e = haystack + haystack_len - needle_len;
 		} else {
 			e = haystack + haystack_len + offset;