utf8 substr can access memory outside PVX buffer

	Message-ID: <m3iuhonl4h.fsf@furu.g.aas.no>

p4raw-id: //depot/perl@2000

diff --git a/sv.c b/sv.c
index ad38a87..97a0790 100644 (file)
--- a/sv.c
+++ b/sv.c
@@ -3134,12 +3134,16 @@ sv_pos_u2b(register SV *sv, I32* offsetp, I32* lenp)
     send = s + len;
     while (s < send && uoffset--)
        s += UTF8SKIP(s);
+    if (s >= send)
+       s = send;
     *offsetp = s - start;
     if (lenp) {
        I32 ulen = *lenp;
        start = s;
        while (s < send && ulen--)
            s += UTF8SKIP(s);
+       if (s >= send)
+           s = send;
        *lenp = s - start;
     }
     return;