Fix a bounds error which now errors in PHP 7.

Signed-off-by: Edward Z. Yang <ezyang@cs.stanford.edu>

library/HTMLPurifier/AttrDef/CSS/URI.php

@@ -33,6 +33,9 @@ class HTMLPurifier_AttrDef_CSS_URI extends HTMLPurifier_AttrDef_URI
             return false;
         }
         $uri_string = substr($uri_string, 4);
+        if (strlen($uri_string) == 0) {
+            return false;
+        }
         $new_length = strlen($uri_string) - 1;
         if ($uri_string[$new_length] != ')') {
             return false;