From: Anatol Belski <ab@php.net>
Date: Mon, 29 Jun 2015 09:35:36 +0000 (+0200)
Subject: fix more places with subtle negative zend_long to size_t cast
X-Git-Tag: php-7.1.0alpha3~25^2~114
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c783645b99f35da3735977a05c9b7d0da372ce6b;p=php

fix more places with subtle negative zend_long to size_t cast
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 0a5e8bec4d..1ce301e9cc 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2563,9 +2563,10 @@ PHP_FUNCTION(substr_replace)
 					f = zval_get_long(tmp_from);
 
 					if (f < 0) {
-						f = orig_str->len + f;
-						if (f < 0) {
+						if (-f > orig_str->len) {
 							f = 0;
+						} else {
+							f = orig_str->len + f;
 						}
 					} else if (f > orig_str->len) {
 						f = orig_str->len;
@@ -2577,9 +2578,10 @@ PHP_FUNCTION(substr_replace)
 			} else {
 				f = Z_LVAL_P(from);
 				if (f < 0) {
-					f = orig_str->len + f;
-					if (f < 0) {
+					if (-f > orig_str->len) {
 						f = 0;
+					} else {
+						f = orig_str->len + f;
 					}
 				} else if (f > orig_str->len) {
 					f = orig_str->len;