1--TEST-- 2Bug #40754 (Overflow checks inside string functions) 3--FILE-- 4<?php 5 6$v = 2147483647; 7 8var_dump(substr("abcde", 1, $v)); 9var_dump(substr_replace("abcde", "x", $v, $v)); 10 11var_dump(strspn("abcde", "abc", $v, $v)); 12var_dump(strcspn("abcde", "abc", $v, $v)); 13 14var_dump(substr_count("abcde", "abc", $v, $v)); 15var_dump(substr_compare("abcde", "abc", $v, $v)); 16 17var_dump(stripos("abcde", "abc", $v)); 18var_dump(substr_count("abcde", "abc", $v, 1)); 19var_dump(substr_count("abcde", "abc", 1, $v)); 20var_dump(strpos("abcde", "abc", $v)); 21var_dump(stripos("abcde", "abc", $v)); 22var_dump(strrpos("abcde", "abc", $v)); 23var_dump(strripos("abcde", "abc", $v)); 24var_dump(strncmp("abcde", "abc", $v)); 25var_dump(chunk_split("abcde", $v, "abc")); 26var_dump(substr("abcde", $v, $v)); 27 28?> 29--EXPECTF-- 30%unicode|string%(4) "bcde" 31%unicode|string%(6) "abcdex" 32bool(false) 33bool(false) 34 35Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d 36bool(false) 37 38Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d 39bool(false) 40 41Warning: stripos(): Offset not contained in string in %s on line %d 42bool(false) 43 44Warning: substr_count(): Offset value 2147483647 exceeds string length in %s on line %d 45bool(false) 46 47Warning: substr_count(): Length value 2147483647 exceeds string length in %s on line %d 48bool(false) 49 50Warning: strpos(): Offset not contained in string in %s on line %d 51bool(false) 52 53Warning: stripos(): Offset not contained in string in %s on line %d 54bool(false) 55 56Warning: strrpos(): Offset is greater than the length of haystack string in %s on line %d 57bool(false) 58 59Warning: strripos(): Offset is greater than the length of haystack string in %s on line %d 60bool(false) 61int(2) 62string(8) "abcdeabc" 63bool(false) 64