Fixed craches in substr_replace()

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 29ab1097b50e0f2a3564d1ac40a01c0e7547653b..bafb7d608f55f66873649d5e610b6656f9ee1319 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2626,9 +2626,16 @@ PHPAPI int32_t php_do_substr_replace(void **result, zval **str, zval **repl, int
        void *buf;
        int32_t buf_len, idx;
        UChar ch;
+       int repl_len;
+
+       if (repl) {
+               repl_len = Z_UNILEN_PP(repl);
+       } else {
+               repl_len = 0;
+       }
 
        if (Z_TYPE_PP(str) == IS_UNICODE) {
-               buf = emalloc(UBYTES(Z_USTRLEN_PP(str) -l + Z_USTRLEN_PP(repl) + 1));
+               buf = emalloc(UBYTES(Z_USTRLEN_PP(str) -l + repl_len + 1));
 
                /* buf_len is codept count here */
                buf_len = 0; idx = 0;
@@ -2637,8 +2644,8 @@ PHPAPI int32_t php_do_substr_replace(void **result, zval **str, zval **repl, int
                        buf_len += zend_codepoint_to_uchar(ch, (UChar *)buf + buf_len);
                }
                if (repl != NULL) {
-                       u_memcpy((UChar *)buf + buf_len, Z_USTRVAL_PP(repl), Z_USTRLEN_PP(repl));
-                       buf_len += Z_USTRLEN_PP(repl);
+                       u_memcpy((UChar *)buf + buf_len, Z_USTRVAL_PP(repl), repl_len);
+                       buf_len += repl_len;
                }
                U16_FWD_N(Z_USTRVAL_PP(str), idx, Z_USTRLEN_PP(str), l);
                u_memcpy((UChar *)buf + buf_len, Z_USTRVAL_PP(str) + idx, Z_USTRLEN_PP(str) - idx);
@@ -2648,14 +2655,14 @@ PHPAPI int32_t php_do_substr_replace(void **result, zval **str, zval **repl, int
                buf = erealloc(buf, UBYTES(buf_len + 1));
        } else {
                /* buf_len is char count here */
-               buf_len = Z_STRLEN_PP(str) - l + Z_STRLEN_PP(repl);
+               buf_len = Z_STRLEN_PP(str) - l + repl_len;
                buf = emalloc(buf_len + 1);
 
                memcpy(buf, Z_STRVAL_PP(str), f);
-               if (repl != NULL ) {
-                       memcpy((char *)buf + f, Z_STRVAL_PP(repl), Z_STRLEN_PP(repl));
+               if (repl != NULL) {
+                       memcpy((char *)buf + f, Z_STRVAL_PP(repl), repl_len);
                }
-               memcpy((char *)buf + f + Z_STRLEN_PP(repl), Z_STRVAL_PP(str) + f + l, Z_STRLEN_PP(str) - f - l);
+               memcpy((char *)buf + f + repl_len, Z_STRVAL_PP(str) + f + l, Z_STRLEN_PP(str) - f - l);
 
                *((char *)buf + buf_len) = '\0';
        }
@@ -2706,11 +2713,7 @@ PHP_FUNCTION(substr_replace)
                }
        } else {
                if (Z_TYPE_PP(str) != IS_ARRAY) {
-                       if (Z_TYPE_PP(str) == IS_UNICODE) {
-                               l = Z_USTRLEN_PP(str);
-                       } else {
-                               l = Z_STRLEN_PP(str);
-                       }
+                       l = Z_UNILEN_PP(str);
                }
        }
 
@@ -2744,7 +2747,7 @@ PHP_FUNCTION(substr_replace)
                                tmp_repl = repl;
                        }
 
-                       if (Z_TYPE_PP(str) != Z_TYPE_PP(tmp_repl))
+                       if (tmp_repl && Z_TYPE_PP(str) != Z_TYPE_PP(tmp_repl))
                                php_unify_string_types(str, tmp_repl TSRMLS_CC);
                        php_adjust_limits(str, &f, &l);
                        result_len = php_do_substr_replace(&result, str, tmp_repl, f, l TSRMLS_CC);
@@ -2795,20 +2798,13 @@ PHP_FUNCTION(substr_replace)
                                        l = Z_LVAL_PP(tmp_len);
                                        zend_hash_move_forward_ex(Z_ARRVAL_PP(len), &pos_len);
                                } else {
-                                       if (Z_TYPE_PP(tmp_str) == IS_UNICODE) {
-                                               l = Z_USTRLEN_PP(tmp_str);
-                                       } else {
-                                               l = Z_STRLEN_PP(tmp_str);
-                                       }
+                                       l = Z_UNILEN_PP(tmp_str);
                                }
                        } else if (argc > 3) {
                                /* 'l' parsed & set at top of funcn */
+                               l = Z_LVAL_PP(len);
                        } else {
-                               if (Z_TYPE_PP(tmp_str) == IS_UNICODE) {
-                                       l = Z_USTRLEN_PP(tmp_str);
-                               } else {
-                                       l = Z_STRLEN_PP(tmp_str);
-                               }
+                               l = Z_UNILEN_PP(tmp_str);
                        }
 
                        if (Z_TYPE_PP(repl) == IS_ARRAY) {
@@ -2824,7 +2820,7 @@ PHP_FUNCTION(substr_replace)
                                tmp_repl = repl;
                        }
 
-                       if (Z_TYPE_PP(tmp_str) != Z_TYPE_PP(tmp_repl))
+                       if (tmp_repl && Z_TYPE_PP(tmp_str) != Z_TYPE_PP(tmp_repl))
                                php_unify_string_types(tmp_str, tmp_repl TSRMLS_CC);
                        php_adjust_limits(tmp_str, &f, &l);
                        result_len = php_do_substr_replace(&result, tmp_str, tmp_repl, f, l TSRMLS_CC);

diff --git a/ext/standard/tests/strings/substr_replace.phpt b/ext/standard/tests/strings/substr_replace.phpt
index 27620de9644b17d8e4135be5b230ddfb94f9825f..a0c338e8eefa9cf20781ceb7a6053786596db08d 100644 (file)
--- a/ext/standard/tests/strings/substr_replace.phpt
+++ b/ext/standard/tests/strings/substr_replace.phpt
@@ -807,4 +807,365 @@ array(2) {
   [1]=>
   string(10) "trbala his"
 }
+--UEXPECT--
+substr_replace('try this', 'bala ', 2)
+unicode(7) "trbala "
+
+substr_replace('try this', 'bala ', 2, 3)
+unicode(10) "trbala his"
+
+substr_replace('try this', 'bala ', 2, 0)
+unicode(13) "trbala y this"
+
+substr_replace('try this', 'bala ', 2, -2)
+unicode(9) "trbala is"
+
+
+
+substr_replace('try this', array (  0 => 'bala ',), 4
+unicode(9) "try bala "
+
+substr_replace('try this', array (  0 => 'bala ',), 4
+unicode(10) "try bala s"
+
+
+
+
+substr_replace(array (  0 => 'ala portokala',), array (  0 => 'bala ',), array (  0 => 4,)
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+substr_replace(array (  0 => 'ala portokala',), array (  0 => 'bala ',), array (  0 => 4,), array (  0 => 3,))
+array(1) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+}
+
+substr_replace(array (  0 => 'ala portokala',), array (  0 => 'bala ',), array (  0 => 4,), array (  0 => 0,))
+array(1) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+}
+
+substr_replace(array (  0 => 'ala portokala',), array (  0 => 'bala ',), array (  0 => 4,), array (  0 => -2,))
+array(1) {
+  [0]=>
+  unicode(11) "ala bala la"
+}
 
+
+
+substr_replace(array (  0 => 'ala portokala',), 'bala ',4)
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),4, 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(5) "try s"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',4, 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(10) "try bala s"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),4, 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(8) "try this"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',4, 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(13) "try bala this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),4, -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(6) "try is"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',4, -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(11) "try bala is"
+}
+
+
+
+
+
+
+substr_replace(array (  0 => 'ala portokala',), 'bala ',array (  0 => 4,))
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,), 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(5) " this"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,), 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(10) "bala  this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,), 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(8) "try this"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,), 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(13) "bala try this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,), -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(2) "is"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,), -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(7) "bala is"
+}
+
+
+
+
+
+
+
+substr_replace(array (  0 => 'ala portokala',), 'bala ',array (  0 => 4,  1 => 2,))
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(5) "trhis"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), 3)
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(10) "trbala his"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(8) "try this"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), 0)
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(13) "trbala y this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(4) "tris"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), -2)
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(9) "trbala is"
+}
+
+
+
+
+
+
+
+substr_replace(array (  0 => 'ala portokala',), 'bala ',array (  0 => 4,  1 => 2,))
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => 3,))
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(2) "tr"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => 3,))
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(7) "trbala "
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => 0,))
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(2) "tr"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => 0,))
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(7) "trbala "
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => -2,))
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(2) "tr"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => -2,))
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(7) "trbala "
+}
+
+
+
+
+
+
+
+substr_replace(array (  0 => 'ala portokala',), 'bala ',array (  0 => 4,  1 => 2,))
+array(1) {
+  [0]=>
+  unicode(9) "ala bala "
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => 3,  1 => 2,))
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(6) "trthis"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => 3,  1 => 2,))
+array(2) {
+  [0]=>
+  unicode(15) "ala bala tokala"
+  [1]=>
+  unicode(11) "trbala this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => 0,  1 => 0,))
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(8) "try this"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => 0,  1 => 0,))
+array(2) {
+  [0]=>
+  unicode(18) "ala bala portokala"
+  [1]=>
+  unicode(13) "trbala y this"
+}
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), array (  0 => 'bala ',),array (  0 => 4,  1 => 2,), array (  0 => -2,  1 => -3,))
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(5) "trhis"
+}
+
+
+substr_replace(array (  0 => 'ala portokala',  1 => 'try this',), 'bala ',array (  0 => 4,  1 => 2,), array (  0 => -2,  1 => -3,))
+array(2) {
+  [0]=>
+  unicode(11) "ala bala la"
+  [1]=>
+  unicode(10) "trbala his"
+}