defuse/php-encryption — pull request #22 by narfbg (2014-07-12 15:48:23+00:00)
Title: Fix issue #13 (multibyte strings)

Quoting the issue description:

> Do they affect us? There are $string[$index] stuff going on in this code, so maybe it could?

Yes, you are affected, given that `mbstring.func_overload` is enabled in php.ini and a multibyte chacater set is used. If that condition is present, then `strlen()`, `substr()` (and a few other string functions) are effectively replaced by their `mb_*()` equivalents, using the mbstring character set.

This patch fixes the issue.

Note: There's no point in checking for `substr(...) === FALSE`, as FALSE is only returned if you pass parameters that are invalid (such as an array for the input string), but I recall you giving me the opposite advice, so I've left that out until you convince yourself. :)