Memory corruption in String::replace

What steps will reproduce the problem?
1. String hello = "hello";
2. hello.replace("hello","hello, world");

What is the expected output? What do you see instead?
This causes random memory to get overwritten.  replace() will call 
lastIndexOf() with an index of -1.  but since lastIndexOf() takes an UNSIGNED 
as the 2nd parameter, MAXINT is actually passed, and chaos ensues.

What version of the Arduino software are you using?
git head

Please provide any additional information below.
Attached a patch which is one possible way of solving it.

Original issue reported on code.google.com by maniac...@ymail.com on 24 Oct 2011 at 4:02

Attachments:

0002-Fix-bug-in-replace.patch

edward0429 / arduino

Memory corruption in String::replace #694