Index: pbx.c
===================================================================
--- pbx.c	(revision 8412)
+++ pbx.c	(working copy)
@@ -929,7 +929,8 @@
 
 /*! \brief takes a substring. It is ok to call with value == workspace.
  *
- * offset < 0 means start from the end of the string.
+ * offset < 0 means start from the end of the string and set the beginning
+ *   to be that many characters back.
  * length is the length of the substring, -1 means unlimited
  * (we take any negative value).
  * Always return a copy in workspace.
@@ -946,8 +947,11 @@
 
 	lr = strlen(ret); /* compute length after copy, so we never go out of the workspace */
 
-	if (offset < 0)		/* translate negative offset into positive ones */
-		offset = lr - offset;
+	if (offset < 0)	{	/* translate negative offset into positive ones */
+		offset = lr + offset;
+		if (offset < 0) /* If the negative offset was greater than the length of the string, just start at the beginning */
+			offset = 0;
+	}
 
 	/* too large offset result in empty string so we know what to return */
 	if (offset >= lr)