From 0a076b11df8654df35c8cda2577b82a4dca5b59a Mon Sep 17 00:00:00 2001 From: Ilia Alshanetsky Date: Tue, 14 Mar 2006 14:55:13 +0000 Subject: [PATCH] Fixed offset/length parameter validation in substr_compare() function. --- NEWS | 1 + ext/standard/string.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/NEWS b/NEWS index ac8aa97208..d869deecfb 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Mar 2006, PHP 5.1.3RC2 +- Fixed offset/length parameter validation in substr_compare() function. (Ilia) - Added overflow checks to wordwrap() function. (Ilia) - Removed the E_STRICT deprecation notice from "var". (Ilia) - Fixed debug_zval_dump() to support private and protected members. (Dmitry) diff --git a/ext/standard/string.c b/ext/standard/string.c index 4f2897ce53..e12d5d6a0f 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -4884,7 +4884,7 @@ PHP_FUNCTION(substr_compare) RETURN_FALSE; } - if (len && offset >= s1_len) { + if (offset + len >= s1_len) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "The start position cannot exceed initial string length."); RETURN_FALSE; } -- 2.50.1