php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #69931 substr() behaviour change
Submitted: 2015-06-25 08:44 UTC Modified: 2015-06-25 21:20 UTC
From: thekid@php.net Assigned: nikic (profile)
Status: Not a bug Package: Strings related
PHP Version: 7.0Git-2015-06-25 (Git) OS: Ubuntu
Private report: No CVE-ID: None
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If this is not your bug, you can add a comment by following this link.
If this is your bug, but you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: thekid@php.net
New email:
PHP Version: OS:

 

 [2015-06-25 08:44 UTC] thekid@php.net
Description:
------------
The substr() function behaves differently in a current PHP7 than e.g. in alpha1

Test script:
---------------
substr("Hello", 5, 1)

Expected result:
----------------
false

Actual result:
--------------
""

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2015-06-25 08:48 UTC] thekid@php.net
I believe this is what's causing the change:


@@ -2406,7 +2407,7 @@ PHP_FUNCTION(substr)
                }
        }

-       if (f >= (zend_long)str->len) {
+       if (f > (zend_long)str->len) {
                RETURN_FALSE;
        }


...which was introduced in 257054e81d4dad73bf9d09cd206d3a6727ad1777 to fix #62922

Hrm.
 [2015-06-25 08:51 UTC] thekid@php.net
-Assigned To: +Assigned To: nikic
 [2015-06-25 10:48 UTC] nikic@php.net
-Status: Assigned +Status: Not a bug
 [2015-06-25 10:48 UTC] nikic@php.net
This change is intentional. The behavior is of course BS, but this is because strpos() in general returns BS. E.g. substr("Hello", 4, 20) has always returned "o" rather than throwing an error. The change only allowed 5 as a valid start offset here (which it is).
 [2015-06-25 21:20 UTC] yohgaki@php.net
I support this change.
However, this change may bite people. It should be clearly noted in UPGRADING.
A company that I know of was bitten by strtotime() return value change by PHP 5.1 and lost few million dollars, for example.
 [2015-08-07 12:49 UTC] cmb@php.net
Automatic comment from SVN on behalf of cmb
Revision: http://svn.php.net/viewvc/?view=revision&revision=337321
Log: updated substr() documentation for PHP 7 (see #69931)
 
PHP Copyright © 2001-2020 The PHP Group
All rights reserved.
Last updated: Tue Feb 18 11:01:26 2020 UTC