diff --git a/pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch b/pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch
new file mode 100644
index 0000000..cafbba0
--- /dev/null
+++ b/pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch
@@ -0,0 +1,73 @@
+From 3f4e0af094ac3d6facb7b8e581ba4bdf47d7d45d Mon Sep 17 00:00:00 2001
+From: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
+Date: Fri, 9 Dec 2016 18:19:38 +0000
+Subject: [PATCH] Fix OOB error in substitute with start offset longer than
+ length.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Petr Pisar: Port to 10.22:
+
+commit a27071aeed86de6febe845edb6c7376faa2176ba
+Author: ph10 <ph10@6239d852-aaf2-0410-a92c-79f79f948069>
+Date:   Fri Dec 9 18:19:38 2016 +0000
+
+    Fix OOB error in substitute with start offset longer than length.
+
+    git-svn-id: svn://vcs.exim.org/pcre2/code/trunk@616 6239d852-aaf2-0410-a92c-79f79f948069
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ src/pcre2_substitute.c | 6 ++++++
+ testdata/testinput2    | 3 +++
+ testdata/testoutput2   | 4 ++++
+ 3 files changed, 13 insertions(+)
+
+diff --git a/src/pcre2_substitute.c b/src/pcre2_substitute.c
+index 0bf781e..2467d16 100644
+--- a/src/pcre2_substitute.c
++++ b/src/pcre2_substitute.c
+@@ -287,6 +287,12 @@ options &= ~SUBSTITUTE_OPTIONS;
+ 
+ /* Copy up to the start offset */
+ 
++if (start_offset > length)
++  {
++  match_data->leftchar = 0;
++  rc = PCRE2_ERROR_BADOFFSET;
++  goto EXIT;
++  }
+ CHECKMEMCPY(subject, start_offset);
+ 
+ /* Loop for global substituting. */
+diff --git a/testdata/testinput2 b/testdata/testinput2
+index a7c1ab3..e2865b2 100644
+--- a/testdata/testinput2
++++ b/testdata/testinput2
+@@ -4831,4 +4831,7 @@ a)"xI
+ /(\x0e00\000000\xc)/replace=\P,substitute_extended
+ \x0e00\000000\xc
+ 
++//replace=0
++\=offset=7
++
+ # End of testinput2 
+diff --git a/testdata/testoutput2 b/testdata/testoutput2
+index 9c478bb..29de949 100644
+--- a/testdata/testoutput2
++++ b/testdata/testoutput2
+@@ -15235,6 +15235,10 @@ No match
+ \x0e00\000000\xc
+ Failed: error -57 at offset 2 in replacement: bad escape sequence in replacement string
+ 
++//replace=0
++\=offset=7
++Failed: error -33: bad offset value
++
+ # End of testinput2 
+ Error -63: PCRE2_ERROR_BADDATA (unknown error number)
+ Error -62: bad serialized data
+-- 
+2.7.4
+
diff --git a/pcre2.spec b/pcre2.spec
index 7b443f3..d64d11a 100644
--- a/pcre2.spec
+++ b/pcre2.spec
@@ -70,6 +70,9 @@ Patch15:    pcre2-10.22-Fix-crash-in-pcre2test-when-displaying-a-wide-charac.pat
 # Fix a crash when doing an extended substitution for \p, \P, or \X,
 # in upstream after 10.22, upstream bug #1977
 Patch16:    pcre2-10.22-Fix-NULL-defer-in-extended-substition-for-p-P-or-X.patch
+# Fix a crash in substitution if starting offest was specified beyond the
+# subject end, in upstream after 10.22, upstream bug #1992
+Patch17:    pcre2-10.22-Fix-OOB-error-in-substitute-with-start-offset-longer.patch
 # New libtool to get rid of RPATH and to use distribution autotools
 BuildRequires:  autoconf
 BuildRequires:  automake
@@ -163,6 +166,7 @@ Utilities demonstrating PCRE2 capabilities like pcre2grep or pcre2test.
 %patch14 -p1
 %patch15 -p1
 %patch16 -p1
+%patch17 -p1
 # Because of multilib patch
 libtoolize --copy --force
 autoreconf -vif
@@ -262,6 +266,8 @@ make %{?_smp_mflags} check VERBOSE=yes
 * Fri Dec 16 2016 Petr Pisar <ppisar@redhat.com> - 10.22-8
 - Fix a crash when doing an extended substitution for \p, \P, or \X
   (upstream bug #1977)
+- Fix a crash in substitution if starting offest was specified beyond the
+  subject end (upstream bug #1992)
 
 * Fri Dec 09 2016 Petr Pisar <ppisar@redhat.com> - 10.22-7
 - Fix pcre2-config --libs-posix output (upstream bug #1924)