Fix a bounds error which now errors in PHP 7.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>

NEWS

@@ -17,6 +17,7 @@ NEWS ( CHANGELOG and HISTORY )                                     HTMLPurifier
 - IDNA supported natively on PHP 5.3 and later.
 - Non all-numeric top-level names (e.g., foo.1f, 1f) are now
   allowed.
+- Minor bounds error fix to squash a PHP 7 notice.
 
 4.7.0, released 2015-08-04
 # opacity is now considered a "tricky" CSS property rather than a

library/HTMLPurifier/AttrDef/CSS/URI.php

@@ -33,6 +33,9 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
             return false;
         }
         $uri_string = substr($uri_string, 4);
+        if (strlen($uri_string) == 0) {
+            return false;
+        }
         $new_length = strlen($uri_string) - 1;
         if ($uri_string[$new_length] != ')') {
             return false;