Fix #66797: mb_substr only takes 32-bit signed integer

`from` and `len` are `long`, but get passed to mbfl_substr() which expects
`int`s. Therefore we clamp the values to avoid the undefined conversion
behavior.

NEWS

@@ -31,6 +31,9 @@ PHP                                                                        NEWS
 - JSON:
   . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)
 
+- mbstring:
+  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
+
 - MSSQL:
   . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)
 

ext/mbstring/mbstring.c

@@ -2799,6 +2799,13 @@ PHP_FUNCTION(mb_substr)
 		RETURN_FALSE;
 	}
 
+	if (from > INT_MAX) {
+		from = INT_MAX;
+	}
+	if (len > INT_MAX) {
+		len = INT_MAX;
+	}
+
 	ret = mbfl_substr(&string, &result, from, len);
 	if (NULL == ret) {
 		RETURN_FALSE;

ext/mbstring/tests/bug66797.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #66797 (mb_substr only takes 32-bit signed integer)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (PHP_INT_SIZE != 8) die('skip this test is for 64bit platforms only');
+?>
+--FILE--
+<?php
+var_dump(
+    mb_substr('bar', 0, 0x7fffffff),
+    mb_substr('bar', 0, 0x80000000),
+    mb_substr('bar', 0xffffffff, 1),
+    mb_substr('bar', 0x100000000, 1)
+);
+?>
+==DONE==
+--EXPECTF--
+string(3) "bar"
+string(3) "bar"
+string(0) ""
+string(0) ""
+==DONE==