From: Sara Golemon <pollita@php.net>
Date: Mon, 23 Feb 2004 20:06:01 +0000 (+0000)
Subject: Bugfix #27276: When using str_replace to expand a string, count occurances of needle... 
X-Git-Tag: RELEASE_0_2_0~206
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=5144a1f522e8fdee42c535ef80d6de21d0cd57cf;p=php

Bugfix #27276: When using str_replace to expand a string, count occurances of needle in haystack to avoid massive overallocation
---

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 661dd8fa72..05649e2742 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3001,7 +3001,14 @@ PHPAPI char *php_str_to_str_ex(char *haystack, int length,
 			if (str_len < needle_len) {
 				new_str = emalloc(length + 1);
 			} else {
-				new_str = safe_emalloc((length / needle_len + 1), str_len, 0);
+				int count = 0;
+				char *o = haystack, *endp = haystack + length;
+
+				while ((o = php_memnstr(o, needle, needle_len, endp))) {
+					o += needle_len;
+					count++;
+				}
+				new_str = safe_emalloc(count, str_len - needle_len, length + 1);
 			}
 
 			e = s = new_str;