diff --git a/src/switch_channel.c b/src/switch_channel.c
index 5a469b8670..8bf1bcffdb 100644
--- a/src/switch_channel.c
+++ b/src/switch_channel.c
@@ -1599,8 +1599,8 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
 	char *p, *c = NULL;
 	char *data, *indup;
 	size_t sp = 0, len = 0, olen = 0, vtype = 0, br = 0, cpos, block = 128;
-	const char *q, *sub_val = NULL;
-	char *cloned_sub_val = NULL;
+	const char *q;
+	char *cloned_sub_val = NULL, *sub_val = NULL;
 	char *func_val = NULL;
 	int nv = 0;
 
@@ -1743,7 +1743,7 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
 						}
 					}
 
-					if ((sub_val = switch_channel_get_variable(channel, vname))) {
+					if ((sub_val = (char *) switch_channel_get_variable(channel, vname))) {
 						if (offset || ooffset) {
 							cloned_sub_val = strdup(sub_val);
 							switch_assert(cloned_sub_val);
@@ -1751,7 +1751,11 @@ SWITCH_DECLARE(char *) switch_channel_expand_variables(switch_channel_t *channel
 						}
 
 						if (offset >= 0) {
-							sub_val += offset;
+							if (offset > strlen(sub_val)) {
+								*sub_val = '\0';
+							} else {
+								sub_val += offset;
+							}
 						} else if ((size_t) abs(offset) <= strlen(sub_val)) {
 							sub_val = cloned_sub_val + (strlen(cloned_sub_val) + offset);
 						}