From fb9945422ea057511d6be34ad84130025867fc92 Mon Sep 17 00:00:00 2001
From: Stanislav Malyshev <stas@php.net>
Date: Tue, 5 Aug 2008 21:23:20 +0000
Subject: [PATCH] fix memnstr bug by Laurent Gaffie

---
 Zend/zend_operators.h                       |  3 +++
 ext/standard/tests/strings/explode_bug.phpt | 15 +++++++++++++++
 2 files changed, 18 insertions(+)
 create mode 100644 ext/standard/tests/strings/explode_bug.phpt

diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index d23e0f342c..2d1614b14f 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -234,6 +234,9 @@ zend_memnstr(char *haystack, char *needle, int needle_len, char *end)
 	if (needle_len == 1) {
 		return (char *)memchr(p, *needle, (end-p));
 	}
+	if(needle_len > end-haystack) {
+		return NULL;
+	}
 
 	end -= needle_len;
 
diff --git a/ext/standard/tests/strings/explode_bug.phpt b/ext/standard/tests/strings/explode_bug.phpt
new file mode 100644
index 0000000000..9766f0b8f4
--- /dev/null
+++ b/ext/standard/tests/strings/explode_bug.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Explode/memnstr bug
+--INI--
+error_reporting=2047
+memory_limit=256M
+--FILE--
+<?php
+$res = explode(str_repeat("A",145999999),1);
+var_dump($res);
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  string(1) "1"
+}
-- 
2.50.1