Index: ext/standard/string.c
===================================================================
RCS file: /repository/php-src/ext/standard/string.c,v
retrieving revision 1.445.2.14.2.52
diff -u -p -d -r1.445.2.14.2.52 string.c
--- ext/standard/string.c	10 Mar 2007 20:07:50 -0000	1.445.2.14.2.52
+++ ext/standard/string.c	12 Mar 2007 23:22:54 -0000
@@ -2077,6 +2077,10 @@ PHP_FUNCTION(substr)
 		RETURN_FALSE;
 	}
 
+	if (l < 0 && (l + Z_STRLEN_PP(str) - f) < 0) {
+		RETURN_FALSE;
+	}
+
 	/* if "from" position is negative, count start position from the end
 	 * of the string
 	 */