diff --git a/ChangeLog b/ChangeLog
index c9fe550..d041688 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -229,6 +229,10 @@ converted to use the new feature.
 66. In the POSIX wrapper, if regerror() was given too small a buffer, it could 
 misbehave.
 
+67. In pcre2_substitute() in UTF mode, the UTF validity check on the
+replacement string was happening before the length setting when the replacement
+string was zero-terminated.
+
 
 Version 10.20 30-June-2015
 --------------------------
diff --git a/src/pcre2_substitute.c b/src/pcre2_substitute.c
index f6175c5..7cd8ccf 100644
--- a/src/pcre2_substitute.c
+++ b/src/pcre2_substitute.c
@@ -227,6 +227,12 @@ if (match_data == NULL)
 ovector = pcre2_get_ovector_pointer(match_data);
 ovector_count = pcre2_get_ovector_count(match_data);
 
+/* Find lengths of zero-terminated strings and the end of the replacement. */
+
+if (length == PCRE2_ZERO_TERMINATED) length = PRIV(strlen)(subject);
+if (rlength == PCRE2_ZERO_TERMINATED) rlength = PRIV(strlen)(replacement);
+repend = replacement + rlength;
+
 /* Check UTF replacement string if necessary. */
 
 #ifdef SUPPORT_UNICODE
@@ -256,12 +262,6 @@ if ((options & PCRE2_SUBSTITUTE_EXTENDED) != 0)
   extended = TRUE;
   }
 
-/* Find lengths of zero-terminated strings and the end of the replacement. */
-
-if (length == PCRE2_ZERO_TERMINATED) length = PRIV(strlen)(subject);
-if (rlength == PCRE2_ZERO_TERMINATED) rlength = PRIV(strlen)(replacement);
-repend = replacement + rlength;
-
 /* Copy up to the start offset */
 
 if (start_offset > buff_length) goto NOROOM;
diff --git a/testdata/testinput5 b/testdata/testinput5
index b10d8bd..fd5e6fd 100644
--- a/testdata/testinput5
+++ b/testdata/testinput5
@@ -1686,4 +1686,7 @@
 
 /(*UCP)(*UTF)[[:>:]]X/B
 
+/abc/utf,replace=xyz
+    abc\=zero_terminate
+
 # End of testinput5 
diff --git a/testdata/testoutput5 b/testdata/testoutput5
index e2c125a..fd68c87 100644
--- a/testdata/testoutput5
+++ b/testdata/testoutput5
@@ -4058,4 +4058,8 @@ No match
         End
 ------------------------------------------------------------------
 
+/abc/utf,replace=xyz
+    abc\=zero_terminate
+ 1: xyz
+
 # End of testinput5