From: Ilia Alshanetsky Date: Fri, 6 Aug 2010 19:11:34 +0000 (+0000) Subject: Use correct order of operations. Second of many fixes for bug #52550 X-Git-Tag: php-5.4.0alpha1~191^2~1144 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=fa4bf064bd37f9c2cb3c6d217f7478ed8160e91c;p=php Use correct order of operations. Second of many fixes for bug #52550 --- diff --git a/ext/standard/string.c b/ext/standard/string.c index 6f35ce44fb..30567dc2b5 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -1873,7 +1873,7 @@ PHP_FUNCTION(strrpos) p = haystack + offset; e = haystack + haystack_len - needle_len; } else { - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); RETURN_FALSE; } @@ -1951,7 +1951,7 @@ PHP_FUNCTION(strripos) e = haystack + haystack_len - 1; } else { p = haystack; - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string"); RETURN_FALSE; } @@ -1983,7 +1983,7 @@ PHP_FUNCTION(strripos) p = haystack_dup + offset; e = haystack_dup + haystack_len - needle_len; } else { - if (-offset > haystack_len || offset < -INT_MAX) { + if (offset < -INT_MAX || -offset > haystack_len) { efree(needle_dup); efree(haystack_dup); php_error_docref(NULL TSRMLS_CC, E_WARNING, "Offset is greater than the length of haystack string");