MFH: avoid reading str[-1], add warning when invalid format specified

add test

3 files changed, 63 insertions, 33 deletions

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 29ef9c107c..499fcefa7c 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4848,7 +4848,7 @@ PHP_FUNCTION(str_word_count)
 	long type = 0;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ls", &str, &str_len, &type, &char_list, &char_list_len) == FAILURE) {
-		WRONG_PARAM_COUNT;
+		return;
 	}
 
 	if (char_list) {
@@ -4857,9 +4857,18 @@ PHP_FUNCTION(str_word_count)
 	
 	p = str;
 	e = str + str_len;
-		
-	if (type == 1 || type == 2) {
-		array_init(return_value);
+	
+	switch(type) {
+		case 1:
+		case 2:
+			array_init(return_value);
+			break;
+		case 0:
+			/* nothing to be done */
+			break;
+		default:
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid format value %ld", type);
+			RETURN_FALSE;
 	}
 
 	/* first character cannot be ' or -, unless explicitly allowed by the user */
@@ -4867,7 +4876,7 @@ PHP_FUNCTION(str_word_count)
 		p++;
 	}
 	/* last character cannot be -, unless explicitly allowed by the user */
-	if (*(e - 1) == '-' && (!char_list || !ch['-'])) {
+	if (str_len && *(e - 1) == '-' && (!char_list || !ch['-'])) {
 		e--;
 	}
 
diff --git a/ext/standard/tests/strings/str_word_count.phpt b/ext/standard/tests/strings/str_word_count.phpt
index 9d41fc147b..11e1bb65eb 100644
--- a/ext/standard/tests/strings/str_word_count.phpt
+++ b/ext/standard/tests/strings/str_word_count.phpt
@@ -12,7 +12,7 @@ var_dump(str_word_count($str));
 var_dump(str_word_count($str, 3)); 
 var_dump(str_word_count($str, 123));
 var_dump(str_word_count($str, -1));
-var_dump(str_word_count($str, 99999999999999999));
+var_dump(str_word_count($str, 999999999));
 var_dump(str_word_count($str, array()));
 var_dump(str_word_count($str, $b));
 var_dump($str);
@@ -41,6 +41,8 @@ var_dump(str_word_count("'foo'", 2));
 var_dump(str_word_count("'foo'", 2, "'"));
 var_dump(str_word_count("-foo-", 2));
 var_dump(str_word_count("-foo-", 2, "-"));
+
+echo "Done\n";
 ?>
 --EXPECTF--
 array(6) {
@@ -72,19 +74,23 @@ array(6) {
   string(5) "today"
 }
 int(6)
-NULL
-NULL
-NULL
-NULL
 
-Warning: str_word_count() expects parameter 2 to be long, array given in %s on line 13
+Warning: str_word_count(): Invalid format value 3 in %s on line %d
+bool(false)
 
-Warning: Wrong parameter count for str_word_count() in %s on line 13
-NULL
+Warning: str_word_count(): Invalid format value 123 in %s on line %d
+bool(false)
 
-Warning: str_word_count() expects parameter 2 to be long, string given in %s on line 14
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
 
-Warning: Wrong parameter count for str_word_count() in %s on line 14
+Warning: str_word_count(): Invalid format value 999999999 in %s on line %d
+bool(false)
+
+Warning: str_word_count() expects parameter 2 to be long, array given in %s on line %d
+NULL
+
+Warning: str_word_count() expects parameter 2 to be long, string given in %s on line %d
 NULL
 string(55) "Hello friend, you're  
     looking          good today!"
@@ -92,14 +98,10 @@ int(5)
 int(6)
 int(5)
 
-Warning: str_word_count() expects parameter 3 to be string, array given in %s on line 21
-
-Warning: Wrong parameter count for str_word_count() in %s on line 21
+Warning: str_word_count() expects parameter 3 to be string, array given in %s on line %d
 NULL
 
-Warning: str_word_count() expects parameter 3 to be string, object given in %s on line 22
-
-Warning: Wrong parameter count for str_word_count() in %s on line 22
+Warning: str_word_count() expects parameter 3 to be string, object given in %s on line %d
 NULL
 int(7)
 array(5) {
@@ -141,14 +143,10 @@ array(5) {
   string(3) "foo"
 }
 
-Warning: str_word_count() expects parameter 3 to be string, array given in %s on line 27
-
-Warning: Wrong parameter count for str_word_count() in %s on line 27
+Warning: str_word_count() expects parameter 3 to be string, array given in %s on line %d
 NULL
 
-Warning: str_word_count() expects parameter 3 to be string, object given in %s on line 28
-
-Warning: Wrong parameter count for str_word_count() in %s on line 28
+Warning: str_word_count() expects parameter 3 to be string, object given in %s on line %d
 NULL
 array(7) {
   [0]=>
@@ -205,14 +203,10 @@ array(5) {
   string(3) "foo"
 }
 
-Warning: str_word_count() expects parameter 3 to be string, array given in %s on line 33
-
-Warning: Wrong parameter count for str_word_count() in %s on line 33
+Warning: str_word_count() expects parameter 3 to be string, array given in %s on line %d
 NULL
 
-Warning: str_word_count() expects parameter 3 to be string, object given in %s on line 34
-
-Warning: Wrong parameter count for str_word_count() in %s on line 34
+Warning: str_word_count() expects parameter 3 to be string, object given in %s on line %d
 NULL
 array(7) {
   [0]=>
@@ -252,3 +246,4 @@ array(1) {
   [0]=>
   string(5) "-foo-"
 }
+Done
diff --git a/ext/standard/tests/strings/str_word_count1.phpt b/ext/standard/tests/strings/str_word_count1.phpt
new file mode 100644
index 0000000000..5f49fcfbf3
--- /dev/null
+++ b/ext/standard/tests/strings/str_word_count1.phpt
@@ -0,0 +1,26 @@
+--TEST--
+str_word_count() and invalid arguments
+--FILE--
+<?php
+
+var_dump(str_word_count(""));
+var_dump(str_word_count("", -1));
+var_dump(str_word_count("", -1, $a));
+var_dump($a);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+int(0)
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Notice: Undefined variable: a in %s on line %d
+
+Warning: str_word_count(): Invalid format value -1 in %s on line %d
+bool(false)
+
+Notice: Undefined variable: a in %s on line %d
+NULL
+Done