From: Gustavo André dos Santos Lopes <cataphract@php.net>
Date: Sat, 9 Apr 2011 16:59:36 +0000 (+0000)
Subject: - Fixed bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE.
X-Git-Tag: php-5.3.7RC1~186
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f2cfb997de5aa7cebaacc3f5b00454ed5fa28ba9;p=php

- Fixed bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE.
---

diff --git a/NEWS b/NEWS
index 36831c81d8..1503a1d1c2 100644
--- a/NEWS
+++ b/NEWS
@@ -41,6 +41,9 @@ PHP                                                                        NEWS
   . Fixed bug #53339 (Fails to build when compilng with gcc 4.5 and DSO
     libraries). (Clint Byrum, Raphael)
 
+- mbstring extension:
+  . Fixed bug #54494 (mb_substr() mishandles UTF-32LE and UCS-2LE). (Gustavo)
+
 - MySQL Improved extension:
   . Fixed Bug #54221 (mysqli::get_warnings segfault when used in multi queries).
     (Andrey)
diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c
index b8b1db2683..34e33644b5 100644
--- a/ext/mbstring/libmbfl/mbfl/mbfilter.c
+++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c
@@ -1202,10 +1202,10 @@ mbfl_substr(
 		len = string->len;
 		start = from;
 		end = from + length;
-		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_MWC2LE)) {
+		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
 			start *= 2;
 			end = start + length*2;
-		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_MWC4LE)) {
+		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
 			start *= 4;
 			end = start + length*4;
 		} else if (encoding->mblen_table != NULL) {
diff --git a/ext/mbstring/tests/bug54494.phpt b/ext/mbstring/tests/bug54494.phpt
new file mode 100644
index 0000000000..3d7206c3ee
--- /dev/null
+++ b/ext/mbstring/tests/bug54494.phpt
@@ -0,0 +1,52 @@
+--TEST--
+Bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+
+//declare(encoding = 'UTF-8');
+mb_internal_encoding('UTF-8');
+
+header('Content-Type: text/plain; charset=UTF-32LE');
+
+$stringOr = "hällö wörld\n";
+
+$mode = "UTF-32LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+
+
+$mode = "UCS-2LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+--EXPECT--
+UTF-32LE:
+Length: 12
+68000000e40000006c0000006c000000f60000002000000077000000f6000000720000006c000000640000000a000000
+UCS-2LE:
+Length: 12
+6800e4006c006c00f60020007700f60072006c0064000a00
+