Bug Fix#25671 Corruption in subarrays in subject when using str_replace

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 984a5fd7cd9e48110650a3fe66e698f21e9c5bfd..0efa5e728bb6ddeea3c322cab475a496c66c3d2f 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3192,7 +3192,10 @@ static void php_str_replace_common(INTERNAL_FUNCTION_PARAMETERS, int case_sensit
                                SEPARATE_ZVAL(subject_entry);
                                php_str_replace_in_subject(*search, *replace, subject_entry, result, case_sensitivity, (argc > 3) ? &count : NULL);
                        } else {
-                               result = *subject_entry;
+                               MAKE_STD_ZVAL(result);
+                               SEPARATE_ZVAL(subject_entry);
+                               *result = **subject_entry;
+                               zval_copy_ctor(result);
                        }
                        /* Add to return array */
                        switch (zend_hash_get_current_key_ex(Z_ARRVAL_PP(subject), &string_key,