fix #71287 (substr_replace bug when length type is string)

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 7b6ad8ed9ceba7215921837dd490077e0879610e..24c3862bf55550925796cf96d30825e70bad1159 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2469,6 +2469,7 @@ PHP_FUNCTION(substr_replace)
 
        if (argc > 3) {
                if (Z_TYPE_P(len) != IS_ARRAY) {
+                       convert_to_long_ex(len);
                        l = zval_get_long(len);
                }
        } else {
@@ -2482,12 +2483,12 @@ PHP_FUNCTION(substr_replace)
                        (argc == 3 && Z_TYPE_P(from) == IS_ARRAY) ||
                        (argc == 4 && Z_TYPE_P(from) != Z_TYPE_P(len))
                ) {
-                       php_error_docref(NULL, E_WARNING, "'from' and 'len' should be of same type - numerical or array ");
+                       php_error_docref(NULL, E_WARNING, "'start' and 'length' should be of same type - numerical or array ");
                        RETURN_STR_COPY(Z_STR_P(str));
                }
                if (argc == 4 && Z_TYPE_P(from) == IS_ARRAY) {
                        if (zend_hash_num_elements(Z_ARRVAL_P(from)) != zend_hash_num_elements(Z_ARRVAL_P(len))) {
-                               php_error_docref(NULL, E_WARNING, "'from' and 'len' should have the same number of elements");
+                               php_error_docref(NULL, E_WARNING, "'start' and 'length' should have the same number of elements");
                                RETURN_STR_COPY(Z_STR_P(str));
                        }
                }
@@ -2559,7 +2560,7 @@ PHP_FUNCTION(substr_replace)
                        }
                        RETURN_NEW_STR(result);
                } else {
-                       php_error_docref(NULL, E_WARNING, "Functionality of 'from' and 'len' as arrays is not implemented");
+                       php_error_docref(NULL, E_WARNING, "Functionality of 'start' and 'length' as arrays is not implemented");
                        RETURN_STR_COPY(Z_STR_P(str));
                }
        } else { /* str is array of strings */

diff --git a/ext/standard/tests/bug71827.phpt b/ext/standard/tests/bug71827.phpt
new file mode 100644 (file)
index 0000000..eedb9fb
--- /dev/null
+++ b/ext/standard/tests/bug71827.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #71827 (substr_replace bug when length type is string )
+--FILE--
+<?php
+$line  = str_repeat(' ',20); $value ='03'; $pos=0; $len='2';
+$line = substr_replace($line,$value,$pos,$len);
+echo "[$line]\n";
+?>
+--EXPECT--
+[03                  ]

diff --git a/ext/standard/tests/strings/substr_replace_error.phpt b/ext/standard/tests/strings/substr_replace_error.phpt
index fd314cbd9d275640703a0e3ab8d3cf362459ccce..0a15035af2e5fc9e12623182585d5a8fceb4e1e4 100644 (file)
--- a/ext/standard/tests/strings/substr_replace_error.phpt
+++ b/ext/standard/tests/strings/substr_replace_error.phpt
@@ -52,19 +52,19 @@ NULL
 
 -- Testing substr_replace() function with start and length different types --
 
-Warning: substr_replace(): 'from' and 'len' should be of same type - numerical or array  in %s on line %d
+Warning: substr_replace(): 'start' and 'length' should be of same type - numerical or array  in %s on line %d
 string(12) "Good morning"
 
-Warning: substr_replace(): 'from' and 'len' should be of same type - numerical or array  in %s on line %d
+Warning: substr_replace(): 'start' and 'length' should be of same type - numerical or array  in %s on line %d
 string(12) "Good morning"
 
 -- Testing substr_replace() function with start and length with a different number of elements --
 
-Warning: substr_replace(): 'from' and 'len' should have the same number of elements in %s on line %d
+Warning: substr_replace(): 'start' and 'length' should have the same number of elements in %s on line %d
 string(12) "Good morning"
 
 -- Testing substr_replace() function with start and length as arrays but string not--
 
-Warning: substr_replace(): Functionality of 'from' and 'len' as arrays is not implemented in %s on line %d
+Warning: substr_replace(): Functionality of 'start' and 'length' as arrays is not implemented in %s on line %d
 string(12) "Good morning"
-===DONE===
\ No newline at end of file
+===DONE===