From 736032febfac6eb30db7d463d6ad1d124cb28417 Mon Sep 17 00:00:00 2001
From: SakiTakamachi <saki@sakiot.com>
Date: Tue, 17 Oct 2023 22:23:31 +0900
Subject: [PATCH] Fixed a bug in zend_memnistr with single character needle

Fixes GH-12457
Closes GH-12458
---
 NEWS                    |  2 ++
 Zend/tests/gh12457.phpt | 33 +++++++++++++++++++++++++++++++++
 Zend/zend_operators.h   |  2 +-
 3 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 Zend/tests/gh12457.phpt

diff --git a/NEWS b/NEWS
index 87812c65bdd..40206e4ee7c 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,8 @@ PHP                                                                        NEWS
 
 - Core:
   . Fixed double-free of non-interned enum case name. (ilutov)
+  . Fixed bug GH-12457 (Incorrect result of stripos with single character
+    needle). (SakiTakamachi)
 
 - DOM:
   . Fix registerNodeClass with abstract class crashing. (nielsdos)
diff --git a/Zend/tests/gh12457.phpt b/Zend/tests/gh12457.phpt
new file mode 100644
index 00000000000..da9165f4bef
--- /dev/null
+++ b/Zend/tests/gh12457.phpt
@@ -0,0 +1,33 @@
+--TEST--
+GH-12458 (Fix GH-12457: Fixed a bug in zend_memnistr)
+--FILE--
+<?php
+echo "Test case to ensure the issue is fixed.\n";
+var_dump(stripos('aaBBBBBb', 'b'));
+var_dump(stripos('aaBBBBBbb', 'b'));
+var_dump(stripos('aaBBBBBbbb', 'b'));
+var_dump(stristr('aaBBBBBb', 'b'));
+var_dump(stristr('aaBBBBBbb', 'b'));
+var_dump(stristr('aaBBBBBbbb', 'b'));
+
+echo "\n";
+echo "Test cases to ensure the original functionality is not broken.\n";
+var_dump(stripos('aaBBBBBbc', 'c'));
+var_dump(stripos('aaBBBBBbC', 'c'));
+var_dump(stristr('aaBBBBBbc', 'c'));
+var_dump(stristr('aaBBBBBbC', 'c'));
+?>
+--EXPECTF--
+Test case to ensure the issue is fixed.
+int(2)
+int(2)
+int(2)
+string(6) "BBBBBb"
+string(7) "BBBBBbb"
+string(8) "BBBBBbbb"
+
+Test cases to ensure the original functionality is not broken.
+int(8)
+int(8)
+string(1) "c"
+string(1) "C"
diff --git a/Zend/zend_operators.h b/Zend/zend_operators.h
index 0fc503f2c12..e98956239ec 100644
--- a/Zend/zend_operators.h
+++ b/Zend/zend_operators.h
@@ -945,7 +945,7 @@ zend_memnistr(const char *haystack, const char *needle, size_t needle_len, const
 	const char *p_upper = NULL;
 	if (first_lower != first_upper) {
 		// If the needle length is 1 we don't need to look beyond p_lower as it is a guaranteed match
-		size_t upper_search_length = end - (needle_len == 1 && p_lower != NULL ? p_lower : haystack);
+		size_t upper_search_length = needle_len == 1 && p_lower != NULL ? p_lower - haystack : end - haystack;
 		p_upper = (const char *)memchr(haystack, first_upper, upper_search_length);
 	}
 	const char *p = !p_upper || (p_lower && p_lower < p_upper) ? p_lower : p_upper;