Fixed a possible memory corruption in substr_replace()

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 1ffbaa9663a2f15caad12a52d75e28d1558fecb2..250af0702eebd29e0a0050c352a88aaf40949f54 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2219,12 +2219,21 @@ PHP_FUNCTION(substr_replace)
        }
        
        if (Z_TYPE_PP(str) != IS_ARRAY) {
+               if (Z_ISREF_PP(str)) {
+                       SEPARATE_ZVAL(str);
+               }
                convert_to_string_ex(str);
        }
        if (Z_TYPE_PP(repl) != IS_ARRAY) {
+               if (Z_ISREF_PP(repl)) {
+                       SEPARATE_ZVAL(repl);
+               }
                convert_to_string_ex(repl);
        }
        if (Z_TYPE_PP(from) != IS_ARRAY) {
+               if (Z_ISREF_PP(from)) {
+                       SEPARATE_ZVAL(from);
+               }
                convert_to_long_ex(from);
        }