From: Nikita Popov <nikita.ppv@gmail.com>
Date: Fri, 3 Feb 2017 16:54:39 +0000 (+0100)
Subject: Fixed bug #74041
X-Git-Tag: php-7.1.3RC1~61
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=8660e95b4c7a7a84278104bce4ad8270c1ac3464;p=php

Fixed bug #74041
---

diff --git a/NEWS b/NEWS
index 2cbbf752d8..d5ed848b36 100644
--- a/NEWS
+++ b/NEWS
@@ -23,6 +23,7 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #74005 (mail.add_x_header causes RFC-breaking lone line feed).
     (Anatol)
+  . Fixed bug #74041 (substr_count with length=0 broken). (Nikita)
 
 16 Feb 2017, PHP 7.1.2
 
diff --git a/ext/standard/string.c b/ext/standard/string.c
index debea2a0a8..565caa3bfb 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -5219,10 +5219,10 @@ PHP_FUNCTION(substr_count)
 
 	if (ac == 4) {
 
-		if (length <= 0) {
+		if (length < 0) {
 			length += (haystack_len - offset);
 		}
-		if ((length <= 0) || ((size_t)length > (haystack_len - offset))) {
+		if (length < 0 || ((size_t)length > (haystack_len - offset))) {
 			php_error_docref(NULL, E_WARNING, "Invalid length value");
 			RETURN_FALSE;
 		}
diff --git a/ext/standard/tests/strings/bug74041.phpt b/ext/standard/tests/strings/bug74041.phpt
new file mode 100644
index 0000000000..598e46d880
--- /dev/null
+++ b/ext/standard/tests/strings/bug74041.phpt
@@ -0,0 +1,12 @@
+--TEST--
+Bug #74041: substr_count with length=0 broken
+--FILE--
+<?php
+
+var_dump(substr_count("aaa", "a", 0, 0));
+var_dump(substr_count("", "a", 0, 0));
+
+?>
+--EXPECT--
+int(0)
+int(0)