From 06f93f77f38bf445a2a4024c44e97674559231f4 Mon Sep 17 00:00:00 2001
From: Nuno Lopes <nlopess@php.net>
Date: Thu, 15 Jun 2006 15:35:50 +0000
Subject: [PATCH] MFB: fix bug #37800

---
 ext/pcre/php_pcre.c          |  2 +-
 ext/pcre/tests/bug37800.phpt | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 ext/pcre/tests/bug37800.phpt

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 14583c3e60..a704cf4e53 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -1083,7 +1083,7 @@ PHPAPI char *php_pcre_replace(char *regex,   int regex_len,
 			if (limit != -1)
 				limit--;
 
-		} else if (count == PCRE_ERROR_NOMATCH) {
+		} else if (count == PCRE_ERROR_NOMATCH || limit == 0) {
 			/* If we previously set PCRE_NOTEMPTY after a null match,
 			   this is not necessarily the end. We need to advance
 			   the start offset, and continue. Fudge the offset values
diff --git a/ext/pcre/tests/bug37800.phpt b/ext/pcre/tests/bug37800.phpt
new file mode 100644
index 0000000000..e8a0036ebe
--- /dev/null
+++ b/ext/pcre/tests/bug37800.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #37800 (preg_replace() limit parameter odd behaviour)
+--FILE--
+<?php
+$s_string = '1111111111';
+$s_search = '/1/';
+$s_replace = 'One ';
+$i_limit = 1;
+$i_count = 0;
+
+$s_output = preg_replace($s_search, $s_replace, $s_string, $i_limit,
+$i_count);
+echo "Output = " . var_export($s_output, True) . "\n";
+echo "Count  = $i_count\n";
+var_dump(preg_last_error() === PREG_NO_ERROR);
+
+$i_limit = strlen($s_string);
+$s_output = preg_replace($s_search, $s_replace, $s_string, $i_limit,
+$i_count);
+echo "Output = " . var_export($s_output, True) . "\n";
+echo "Count  = $i_count\n";
+var_dump(preg_last_error() === PREG_NO_ERROR);
+
+?>
+--EXPECT--
+Output = 'One 111111111'
+Count  = 1
+bool(true)
+Output = 'One One One One One One One One One One '
+Count  = 10
+bool(true)
-- 
2.40.0