From 7b27550c015c3d87e7d65bf15bb62d1e9eabe6e9 Mon Sep 17 00:00:00 2001
From: Weilin Du <weilindu@php.net>
Date: Thu, 1 Oct 2026 00:58:13 +0800
Subject: [PATCH 1/2] ext/intl: Fix overlapping grapheme matches with negative
 search offsets

---
 ext/intl/grapheme/grapheme_util.c             |  6 ++++
 ...pheme_strrpos_negative_offset_overlap.phpt | 32 +++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 ext/intl/tests/grapheme_strrpos_negative_offset_overlap.phpt

diff --git a/ext/intl/grapheme/grapheme_util.c b/ext/intl/grapheme/grapheme_util.c
index dbe80d962765..cd337055d45d 100644
--- a/ext/intl/grapheme/grapheme_util.c
+++ b/ext/intl/grapheme/grapheme_util.c
@@ -184,6 +184,12 @@ int32_t grapheme_strpos_utf16(char *haystack, size_t haystack_len, char *needle,
 					break;
 				}
 				prev_pos = char_pos;
+				int32_t next_pos = ubrk_following(bi, char_pos);
+				if (next_pos == UBRK_DONE) {
+					break;
+				}
+				usearch_setOffset(src, next_pos, &status);
+				STRPOS_CHECK_STATUS(status, "Invalid search offset");
 			} while(1);
 		}
 	} else {
diff --git a/ext/intl/tests/grapheme_strrpos_negative_offset_overlap.phpt b/ext/intl/tests/grapheme_strrpos_negative_offset_overlap.phpt
new file mode 100644
index 000000000000..aa7fb349ba4d
--- /dev/null
+++ b/ext/intl/tests/grapheme_strrpos_negative_offset_overlap.phpt
@@ -0,0 +1,32 @@
+--TEST--
+grapheme_strrpos() and grapheme_strripos() find overlapping matches with negative offsets
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+foreach (['a', "\u{00E9}", "e\u{0301}", "\u{1F600}"] as $grapheme) {
+    foreach (['grapheme_strrpos', 'grapheme_strripos'] as $function) {
+        $positions = [];
+        foreach ([0, 1, -1, -2, -3] as $offset) {
+            $positions[] = $function(str_repeat($grapheme, 3), str_repeat($grapheme, 2), $offset);
+        }
+        echo $function, ': ', implode(', ', $positions), "\n";
+    }
+}
+
+var_dump(grapheme_strripos("\u{00C9}\u{00E9}\u{00C9}", "\u{00E9}\u{00E9}", -1));
+var_dump(grapheme_strrpos("\u{00E9}\u{00E9}x\u{00E9}\u{00E9}", "\u{00E9}\u{00E9}", -1));
+var_dump(grapheme_strrpos("\u{00E9}\u{00E9}x\u{00E9}\u{00E9}", "\u{00E9}\u{00E9}", -3));
+?>
+--EXPECT--
+grapheme_strrpos: 1, 1, 1, 1, 0
+grapheme_strripos: 1, 1, 1, 1, 0
+grapheme_strrpos: 1, 1, 1, 1, 0
+grapheme_strripos: 1, 1, 1, 1, 0
+grapheme_strrpos: 1, 1, 1, 1, 0
+grapheme_strripos: 1, 1, 1, 1, 0
+grapheme_strrpos: 1, 1, 1, 1, 0
+grapheme_strripos: 1, 1, 1, 1, 0
+int(1)
+int(3)
+int(0)

From f167dd7a9e162ecf8077596df457a3d18f9432f0 Mon Sep 17 00:00:00 2001
From: Weilin Du <weilindu@php.net>
Date: Sat, 3 Oct 2026 00:03:13 +0800
Subject: [PATCH 2/2] [skip ci] NEWS

---
 NEWS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/NEWS b/NEWS
index 99df5910c8b5..fb0f05f502b5 100644
--- a/NEWS
+++ b/NEWS
@@ -74,6 +74,8 @@ PHP                                                                        NEWS
   . Fixed grapheme_strstr() and grapheme_strpos() missing canonically
     equivalent matches, and grapheme searches reporting ICU errors for empty
     haystacks. (Weilin Du)
+  . Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches
+    when using a negative offset. (Weilin Du)
 
 - Lexbor:
   . Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a