1--TEST-- 2strrpos() offset integer overflow 3--FILE-- 4<?php 5 6var_dump(strrpos("t", "t", PHP_INT_MAX+1)); 7var_dump(strrpos("tttt", "tt", PHP_INT_MAX+1)); 8var_dump(strrpos(100, 101, PHP_INT_MAX+1)); 9var_dump(strrpos(1024, 1024, PHP_INT_MAX+1)); 10var_dump(strrpos(1024, 1024, -PHP_INT_MAX)); 11var_dump(strrpos(1024, "te", -PHP_INT_MAX)); 12var_dump(strrpos(1024, 1024, -PHP_INT_MAX-1)); 13var_dump(strrpos(1024, "te", -PHP_INT_MAX-1)); 14 15echo "Done\n"; 16?> 17--EXPECTF-- 18Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 19bool(false) 20 21Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 22bool(false) 23 24Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 25bool(false) 26 27Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 28bool(false) 29 30Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 31bool(false) 32 33Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 34bool(false) 35 36Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 37bool(false) 38 39Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 40bool(false) 41Done 42