- Fixed bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE.

diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c
index 85cf59656e727d75537f2f6d542b6d1df1dbb089..9eec3b4afc9cda963ac019aa047c1ea95c18501e 100644 (file)
--- a/ext/mbstring/libmbfl/mbfl/mbfilter.c
+++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c
@@ -1322,10 +1322,10 @@ mbfl_substr(
                len = string->len;
                start = from;
                end = from + length;
-               if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_MWC2LE)) {
+               if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
                        start *= 2;
                        end = start + length*2;
-               } else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_MWC4LE)) {
+               } else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
                        start *= 4;
                        end = start + length*4;
                } else if (encoding->mblen_table != NULL) {

diff --git a/ext/mbstring/tests/bug54494.phpt b/ext/mbstring/tests/bug54494.phpt
new file mode 100644 (file)
index 0000000..3d7206c
--- /dev/null
+++ b/ext/mbstring/tests/bug54494.phpt
@@ -0,0 +1,52 @@
+--TEST--
+Bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+
+//declare(encoding = 'UTF-8');
+mb_internal_encoding('UTF-8');
+
+header('Content-Type: text/plain; charset=UTF-32LE');
+
+$stringOr = "hällö wörld\n";
+
+$mode = "UTF-32LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+
+
+$mode = "UCS-2LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+--EXPECT--
+UTF-32LE:
+Length: 12
+68000000e40000006c0000006c000000f60000002000000077000000f6000000720000006c000000640000000a000000
+UCS-2LE:
+Length: 12
+6800e4006c006c00f60020007700f60072006c0064000a00
+