Bugfix #27276: When using str_replace to expand a string, count occurances of needle...

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 661dd8fa726e10b0b0e0649873c546ec7f680693..05649e274293a5222e4ac25c642bdcbf200ac343 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3001,7 +3001,14 @@ PHPAPI char *php_str_to_str_ex(char *haystack, int length,
                        if (str_len < needle_len) {
                                new_str = emalloc(length + 1);
                        } else {
-                               new_str = safe_emalloc((length / needle_len + 1), str_len, 0);
+                               int count = 0;
+                               char *o = haystack, *endp = haystack + length;
+
+                               while ((o = php_memnstr(o, needle, needle_len, endp))) {
+                                       o += needle_len;
+                                       count++;
+                               }
+                               new_str = safe_emalloc(count, str_len - needle_len, length + 1);
                        }
 
                        e = s = new_str;