|  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #67043 substr_compare falsely reports equality on negative offset
Submitted: 2014-04-08 09:40 UTC Modified: 2014-04-09 06:54 UTC
Avg. Score:5.0 ± 0.0
Reproduced:1 of 1 (100.0%)
Same Version:0 (0.0%)
Same OS:1 (100.0%)
From: php at kirk dot at Assigned: datibbaw (profile)
Status: Closed Package: Strings related
PHP Version: 5.5.11 OS: any
Private report: No CVE-ID: None
 [2014-04-08 09:40 UTC] php at kirk dot at
Since version 5.5.11 a substr_compare with a negative 3rd parameter (=offset, thus it should start counting from the end of the string) incorrectly reports equality.


I believe the bug could have been introduced in this commit:

What caught my eye is the introduced cast to an unsigned integer but I don't know if this really is the source of the bug.

Workaround: specify a length (absolute value of the negative offset)

Test script:
var_dump(substr_compare("template", "_emplate", -8));
var_dump(substr_compare("template", "_emplate", -8, 8));

Expected result:

Actual result:


Add a Patch

Pull Requests

Add a Pull Request


AllCommentsChangesGit/SVN commitsRelated reports
 [2014-04-08 09:53 UTC] php at kirk dot at
-Operating System: OS X +Operating System: any
 [2014-04-08 09:53 UTC] php at kirk dot at
Saw this bug on multiple OSes, therefore changing OS to any.
 [2014-04-08 17:54 UTC]
-Status: Open +Status: Assigned -Assigned To: +Assigned To: datibbaw
 [2014-04-08 17:54 UTC]
That does appear to be the relevant commit, per a git bisect.

Tjerk, can you have a look at this, please?
 [2014-04-08 23:44 UTC]
-Status: Assigned +Status: Closed
 [2014-04-08 23:44 UTC]
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at

 For Windows:
Thank you for the report, and for helping us make PHP better.

Noob mistake on my part. Updated the test case to also test the aspect of substr_compare() that deals with no explicit length given.
 [2014-04-09 06:54 UTC] php at kirk dot at
That was fast. thanks!
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sun Jun 23 18:01:30 2024 UTC