Fixed bug #71190 (substr_replace converts integers in original $search array to strings)

diff --git a/NEWS b/NEWS
index 130cc4dce22ea4dedc961f3975176c27d943f687..22c41d8298e537bfe9edcfa9d70de2b120f5780b 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -63,8 +63,10 @@ PHP                                                                        NEWS
     arrays). (Nikita)
 
 - Standard:
-  . Fixed #71188 (str_replace converts integers in original $search array to
-    strings). (Laruence)
+  . Fixed bug #71190 (substr_replace converts integers in original $search
+    array to strings). (Laruence)
+  . Fixed bug #71188 (str_replace converts integers in original $search array
+    to strings). (Laruence)
 
 17 Dec 2015, PHP 7.0.1
 

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 5fa1254d9a3b60037bb736105169d28b21fb3235..34ef5a6633ddc2adc96ac92b0cc15a7f1cd2c428 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2495,8 +2495,7 @@ PHP_FUNCTION(substr_replace)
 
        if (Z_TYPE_P(str) != IS_ARRAY) {
                if (Z_TYPE_P(from) != IS_ARRAY) {
-                       size_t repl_len = 0;
-
+                       zend_string *repl_str;
                        f = Z_LVAL_P(from);
 
                        /* if "from" position is negative, count start position from the end
@@ -2537,21 +2536,23 @@ PHP_FUNCTION(substr_replace)
                                        repl_idx++;
                                }
                                if (repl_idx < Z_ARRVAL_P(repl)->nNumUsed) {
-                                       convert_to_string_ex(tmp_repl);
-                                       repl_len = Z_STRLEN_P(tmp_repl);
+                                       repl_str = zval_get_string(tmp_repl);
+                               } else {
+                                       repl_str = STR_EMPTY_ALLOC();
                                }
                        } else {
-                               repl_len = Z_STRLEN_P(repl);
+                               repl_str = Z_STR_P(repl);
                        }
 
-                       result = zend_string_alloc(Z_STRLEN_P(str) - l + repl_len, 0);
+                       result = zend_string_alloc(Z_STRLEN_P(str) - l + ZSTR_LEN(repl_str), 0);
 
                        memcpy(ZSTR_VAL(result), Z_STRVAL_P(str), f);
-                       if (repl_len) {
-                               memcpy((ZSTR_VAL(result) + f), (Z_TYPE_P(repl) == IS_ARRAY ? Z_STRVAL_P(tmp_repl) : Z_STRVAL_P(repl)), repl_len);
+                       if (ZSTR_LEN(repl_str)) {
+                               memcpy((ZSTR_VAL(result) + f), ZSTR_VAL(repl_str), ZSTR_LEN(repl_str));
                        }
-                       memcpy((ZSTR_VAL(result) + f + repl_len), Z_STRVAL_P(str) + f + l, Z_STRLEN_P(str) - f - l);
+                       memcpy((ZSTR_VAL(result) + f + ZSTR_LEN(repl_str)), Z_STRVAL_P(str) + f + l, Z_STRLEN_P(str) - f - l);
                        ZSTR_VAL(result)[ZSTR_LEN(result)] = '\0';
+                       zend_string_release(repl_str);
                        RETURN_NEW_STR(result);
                } else {
                        php_error_docref(NULL, E_WARNING, "Functionality of 'from' and 'len' as arrays is not implemented");

diff --git a/ext/standard/tests/strings/bug71190.phpt b/ext/standard/tests/strings/bug71190.phpt
new file mode 100644 (file)
index 0000000..feabe7c
--- /dev/null
+++ b/ext/standard/tests/strings/bug71190.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #71190 (substr_replace converts integers in original $search array to strings)
+--FILE--
+<?php
+$b = [0, 1, 2];
+
+var_dump($b);
+substr_replace("test", $b, "1");
+var_dump($b);
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+  [2]=>
+  int(2)
+}
+array(3) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+  [2]=>
+  int(2)
+}