assigning to maintainer

Could you show me the mbstring related setting (mbstring.*)
in your php.ini ?

Here is the entire mbstring section of my php.ini file, I haven't
changed it from the default that comes when you download PHP.
[mbstring]
; language for internal character representation.
;mbstring.language = Japanese

; internal/script encoding.
; Some encoding cannot work as internal encoding.
; (e.g. SJIS, BIG5, ISO-2022-*)
;mbstring.internal_encoding = EUC-JP

; http input encoding.
;mbstring.http_input = auto

; http output encoding. mb_output_handler must be
; registered as output buffer to function
;mbstring.http_output = SJIS

; enable automatic encoding translation according to
; mbstring.internal_encoding setting. Input chars are
; converted to internal encoding by setting this to On.
; Note: Do _not_ use automatic encoding translation for
;       portable libs/applications.
;mbstring.encoding_translation = Off

; automatic encoding detection order.
; auto means
;mbstring.detect_order = auto

; substitute_character used when character cannot be converted
; one from another
;mbstring.substitute_character = none;

; overload(replace) single byte functions by mbstring functions.
; mail(), ereg(), etc are overloaded by mb_send_mail(), mb_ereg(),
; etc. Possible values are 0,1,2,4 or combination of them.
; For example, 7 for overload everything.
; 0: No overload
; 1: Overload mail() function
; 2: Overload str*() functions
; 4: Overload ereg*() functions
;mbstring.func_overload = 0

Thanks

I also thought I'd say now that I've committed a load of mbstring tests to CVS if you haven't seen them already. Let me know if you'd like anything changing in them.
Thanks!

Please try using this CVS snapshot:

  http://snaps.php.net/php5.3-latest.tar.gz
 
For Windows (zip):
 
  http://snaps.php.net/win32/php5.3-win32-latest.zip

For Windows (installer):

  http://snaps.php.net/win32/php5.3-win32-installer-latest.msi

I've run this test against the latest 5.2 and 5.3 snapshots and can see  that there's now bounds checking for this function and I'm getting error messages returned as with strrpos (thanks!). When $offset = -13 the multibyte string is still returning int(9) though so it looks like there is still a bug here. 
Thanks for what you've done so far

No feedback was provided for this bug for over a week, so it is
being suspended automatically. If you are able to provide the
information that was originally requested, please do so and change
the status of the bug back to "Open".

I re-tested on the latest 5.2 snap and it looks like the output still differs from the expected, I now get the following:

-- Offset is -25 --
Multibyte String:
Notice: mb_strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 11
bool(false)
ASCII String:
mb_strrpos:
Notice: mb_strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 14
bool(false)
strrpos:
Notice: strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 16
bool(false)

-- Offset is -24 --
Multibyte String:
Notice: mb_strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 11
bool(false)
ASCII String:
mb_strrpos:
Notice: mb_strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 14
bool(false)
strrpos:
Notice: strrpos(): Offset is greater than the length of haystack string in D:\Testing\test.php on line 16
bool(false)

-- Offset is -13 --
Multibyte String:       int(9)
ASCII String:
mb_strrpos:             bool(false)
strrpos:                bool(false)

-- Offset is -12 --
Multibyte String:       int(9)
ASCII String:
mb_strrpos:             int(9)
strrpos:                int(9)

This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.