Avoid address calculation overflow

nikic · nikic · commit e8ae19223c99 · 2019-06-20T16:22:04.000+02:00
diff --git a/ext/standard/string.c b/ext/standard/string.c
@@ -2196,7 +2196,7 @@ PHP_FUNCTION(strripos)
 				php_error_docref(NULL, E_WARNING, "Offset is greater than the length of haystack string");
 				RETURN_FALSE;
 			}
-			e = ZSTR_VAL(haystack) + ZSTR_LEN(haystack) + (size_t)offset;
+			e = ZSTR_VAL(haystack) + (ZSTR_LEN(haystack) + (size_t)offset);
 		}
 		/* Borrow that ord_needle buffer to avoid repeatedly tolower()ing needle */
 		*ZSTR_VAL(ord_needle) = tolower(*ZSTR_VAL(needle));

Original file line number	Diff line number	Diff line change
`@@ -2196,7 +2196,7 @@ PHP_FUNCTION(strripos)`
`2196`	`2196`	`php_error_docref(NULL, E_WARNING, "Offset is greater than the length of haystack string");`
`2197`	`2197`	`RETURN_FALSE;`
`2198`	`2198`	`}`
`2199`		`- e = ZSTR_VAL(haystack) + ZSTR_LEN(haystack) + (size_t)offset;`
	`2199`	`+ e = ZSTR_VAL(haystack) + (ZSTR_LEN(haystack) + (size_t)offset);`
`2200`	`2200`	`}`
`2201`	`2201`	`/* Borrow that ord_needle buffer to avoid repeatedly tolower()ing needle */`
`2202`	`2202`	`ZSTR_VAL(ord_needle) = tolower(ZSTR_VAL(needle));`