fix bug #33076 (str_ireplace() incorrectly counts result string length and may cause...

add test

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 36c3c223c3581afe8f83df8182c8263e12d725ce..e65930f04d5135cd23b3ec36f62bc86788a9d5b3 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2991,7 +2991,7 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l
        char *source, *target, *tmp, *source_end=str+len, *tmp_end = NULL;
        
        for (source = str; source < source_end; source++) {
-               if (*source == from) {
+               if ((case_sensitivity && *source == from) || (!case_sensitivity && tolower(*source) == tolower(from))) {
                        char_count++;
                }
        }

diff --git a/ext/standard/tests/strings/bug33076.phpt b/ext/standard/tests/strings/bug33076.phpt
new file mode 100644 (file)
index 0000000..dafb816
--- /dev/null
+++ b/ext/standard/tests/strings/bug33076.phpt
@@ -0,0 +1,14 @@
+--TEST--
+Bug #33076 (str_ireplace() incorrectly counts result string length and may cause segfault)
+--FILE--
+<?php
+
+$value = str_ireplace("t", "bz", "Text");
+
+var_dump($value);
+
+echo "Done\n";
+?>
+--EXPECT--     
+string(6) "bzexbz"
+Done