fix bug #37800: preg_replace() limit parameter odd behaviour

#this is a regression in PHP_5_2 and HEAD branches only

2 files changed, 32 insertions, 1 deletions

diff --git a/ext/pcre/php_pcre.c b/ext/pcre/php_pcre.c
index 58225eb09e..e4dee71d4c 100644
--- a/ext/pcre/php_pcre.c
+++ b/ext/pcre/php_pcre.c
@@ -1091,7 +1091,7 @@ PHPAPI char *php_pcre_replace(char *regex,   int regex_len,
 			if (limit != -1)
 				limit--;
 
-		} else if (count == PCRE_ERROR_NOMATCH) {
+		} else if (count == PCRE_ERROR_NOMATCH || limit == 0) {
 			/* If we previously set PCRE_NOTEMPTY after a null match,
 			   this is not necessarily the end. We need to advance
 			   the start offset, and continue. Fudge the offset values
diff --git a/ext/pcre/tests/bug37800.phpt b/ext/pcre/tests/bug37800.phpt
new file mode 100644
index 0000000000..e8a0036ebe
--- /dev/null
+++ b/ext/pcre/tests/bug37800.phpt
@@ -0,0 +1,31 @@
+--TEST--
+Bug #37800 (preg_replace() limit parameter odd behaviour)
+--FILE--
+<?php
+$s_string = '1111111111';
+$s_search = '/1/';
+$s_replace = 'One ';
+$i_limit = 1;
+$i_count = 0;
+
+$s_output = preg_replace($s_search, $s_replace, $s_string, $i_limit,
+$i_count);
+echo "Output = " . var_export($s_output, True) . "\n";
+echo "Count  = $i_count\n";
+var_dump(preg_last_error() === PREG_NO_ERROR);
+
+$i_limit = strlen($s_string);
+$s_output = preg_replace($s_search, $s_replace, $s_string, $i_limit,
+$i_count);
+echo "Output = " . var_export($s_output, True) . "\n";
+echo "Count  = $i_count\n";
+var_dump(preg_last_error() === PREG_NO_ERROR);
+
+?>
+--EXPECT--
+Output = 'One 111111111'
+Count  = 1
+bool(true)
+Output = 'One One One One One One One One One One '
+Count  = 10
+bool(true)