diff --git a/ChangeLog b/ChangeLog
index 848d0c7058..ef4eb15d99 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+Tue Jan  1 14:15:04 2008  Yukihiro Matsumoto  <matz@ruby-lang.org>
+
+	* string.c (rb_str_substr): offset movement bug.  a patch from
+	  Vincent Isambart <vincent.isambart at gmail.com> in
+	  [ruby-core:14647].  [ruby-core:14644]
+
 Tue Jan  1 01:29:04 2008  Nobuyoshi Nakada  <nobu@ruby-lang.org>
 
 	* encoding.c (rb_to_encoding): raises for non-nil, non-encoding,
diff --git a/string.c b/string.c
index d569ce5447..87f61a3321 100644
--- a/string.c
+++ b/string.c
@@ -832,10 +832,10 @@ rb_str_substr(VALUE str, long beg, long len)
 	if (len > -beg) len = -beg;
 	if (-beg * rb_enc_mbmaxlen(enc) < RSTRING_LEN(str) / 8) {
 	    beg = -beg;
-	    while (len++ < beg && (e = rb_enc_prev_char(s, e, enc)) != 0);
+	    while (beg-- > len && (e = rb_enc_prev_char(s, e, enc)) != 0);
 	    p = e;
 	    if (!p) return Qnil;
-	    while (beg-- > 0 && (p = rb_enc_prev_char(s, p, enc)) != 0);
+	    while (len-- > 0 && (p = rb_enc_prev_char(s, p, enc)) != 0);
 	    if (!p) return Qnil;
 	    len = e - p;
 	    goto sub;