Heh. I need a break. After this: stropmodule & stringobject were more

out of synch than I realized, and I managed to break replace's "count"
argument when it was 0.  All is well again.  Maybe.
Bugfix candidate.

1 files changed, 6 insertions, 8 deletions

diff --git a/Objects/stringobject.c b/Objects/stringobject.c
index ec909db..7600c03 100644
--- a/Objects/stringobject.c
+++ b/Objects/stringobject.c
@@ -1557,8 +1557,10 @@ mymemreplace(const char *str, int len,		/* input string */
 
 	/* find length of output string */
 	nfound = mymemcnt(str, len, pat, pat_len);
-	if (count > 0)
-		nfound = nfound > count ? count : nfound;
+	if (count < 0)
+		count = INT_MAX;
+	else if (nfound > count)
+		nfound = count;
 	if (nfound == 0)
 		goto return_same;
 
@@ -1566,7 +1568,7 @@ mymemreplace(const char *str, int len,		/* input string */
 	if (new_len == 0) {
 		/* Have to allocate something for the caller to free(). */
 		out_s = (char *)PyMem_MALLOC(1);
-		if (out_s = NULL)
+		if (out_s == NULL)
 			return NULL;
 		out_s[0] = '\0';
 	}
@@ -1577,7 +1579,7 @@ mymemreplace(const char *str, int len,		/* input string */
 			return NULL;
 		out_s = new_s;
 
-		while (len > 0) {
+		for (; count > 0 && len > 0; --count) {
 			/* find index of next instance of pattern */
 			offset = mymemfind(str, len, pat, pat_len);
 			if (offset == -1)
@@ -1592,10 +1594,6 @@ mymemreplace(const char *str, int len,		/* input string */
 			new_s += offset;
 			memcpy(new_s, sub, sub_len);
 			new_s += sub_len;
-
-			/* note count==0 is effectively infinity */
-			if (--count == 0)
-				break;
 		}
 		/* copy any remaining values into output string */
 		if (len > 0)