Fixing a couple of long standing bugs.

ext/ereg/ereg.c

@@ -563,7 +563,7 @@ PHP_FUNCTION(split)
 	}
 
 	/* churn through str, generating array entries as we go */
-	while ((count == -1 || count > 1) && !(err = regexec(&re, strp, 1, subs, 0))) {
+	while ((count == -1 || count > 0) && !(err = regexec(&re, strp, 1, subs, 0))) {
 		if (subs[0].rm_so == 0 && subs[0].rm_eo) {
 			/* match is at start of string, return empty string */
 			add_next_index_stringl(return_value, empty_string, 0, 1);
@@ -604,9 +604,11 @@ PHP_FUNCTION(split)
 	}
 
 	/* otherwise we just have one last element to add to the array */
-	size = endp - strp;
+	if (count == -1) {
+		size = endp - strp;
 	
-	add_next_index_stringl(return_value, strp, size, 1);
+		add_next_index_stringl(return_value, strp, size, 1);
+	}
 
 	regfree(&re);
 

ext/standard/reg.c

@@ -563,7 +563,7 @@ PHP_FUNCTION(split)
 	}
 
 	/* churn through str, generating array entries as we go */
-	while ((count == -1 || count > 1) && !(err = regexec(&re, strp, 1, subs, 0))) {
+	while ((count == -1 || count > 0) && !(err = regexec(&re, strp, 1, subs, 0))) {
 		if (subs[0].rm_so == 0 && subs[0].rm_eo) {
 			/* match is at start of string, return empty string */
 			add_next_index_stringl(return_value, empty_string, 0, 1);
@@ -604,9 +604,11 @@ PHP_FUNCTION(split)
 	}
 
 	/* otherwise we just have one last element to add to the array */
-	size = endp - strp;
+	if (count == -1) {
+		size = endp - strp;
 	
-	add_next_index_stringl(return_value, strp, size, 1);
+		add_next_index_stringl(return_value, strp, size, 1);
+	}
 
 	regfree(&re);