From db01e840c206b900b46177502c0add92bc9eb928 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Gustavo=20Andr=C3=A9=20dos=20Santos=20Lopes?=
 <cataphract@php.net>
Date: Sat, 9 Apr 2011 16:59:36 +0000
Subject: [PATCH] - Fixed bug #54494: mb_substr() mishandles UTF-32LE and
 UCS-2LE.

---
 ext/mbstring/libmbfl/mbfl/mbfilter.c |  4 +--
 ext/mbstring/tests/bug54494.phpt     | 52 ++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 ext/mbstring/tests/bug54494.phpt

diff --git a/ext/mbstring/libmbfl/mbfl/mbfilter.c b/ext/mbstring/libmbfl/mbfl/mbfilter.c
index 85cf59656e..9eec3b4afc 100644
--- a/ext/mbstring/libmbfl/mbfl/mbfilter.c
+++ b/ext/mbstring/libmbfl/mbfl/mbfilter.c
@@ -1322,10 +1322,10 @@ mbfl_substr(
 		len = string->len;
 		start = from;
 		end = from + length;
-		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_MWC2LE)) {
+		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
 			start *= 2;
 			end = start + length*2;
-		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_MWC4LE)) {
+		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
 			start *= 4;
 			end = start + length*4;
 		} else if (encoding->mblen_table != NULL) {
diff --git a/ext/mbstring/tests/bug54494.phpt b/ext/mbstring/tests/bug54494.phpt
new file mode 100644
index 0000000000..3d7206c3ee
--- /dev/null
+++ b/ext/mbstring/tests/bug54494.phpt
@@ -0,0 +1,52 @@
+--TEST--
+Bug #54494: mb_substr() mishandles UTF-32LE and UCS-2LE
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+
+//declare(encoding = 'UTF-8');
+mb_internal_encoding('UTF-8');
+
+header('Content-Type: text/plain; charset=UTF-32LE');
+
+$stringOr = "hällö wörld\n";
+
+$mode = "UTF-32LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+
+
+$mode = "UCS-2LE";
+
+echo "$mode:\n";
+
+$string = mb_convert_encoding($stringOr, $mode);
+$length = mb_strlen($string, $mode);
+echo "Length: ", $length, "\n";
+
+
+for ($i=0; $i < $length; $i++) {
+  $t = unpack("H*",mb_substr($string, $i, 1, $mode));
+  echo $t[1];
+}
+echo "\n";
+--EXPECT--
+UTF-32LE:
+Length: 12
+68000000e40000006c0000006c000000f60000002000000077000000f6000000720000006c000000640000000a000000
+UCS-2LE:
+Length: 12
+6800e4006c006c00f60020007700f60072006c0064000a00
+
-- 
2.40.0