From cd32b4e2bb547b1f7f1a726bd2711a7932c758d4 Mon Sep 17 00:00:00 2001
From: Ilia Alshanetsky <iliaa@php.net>
Date: Sun, 5 Aug 2007 14:47:42 +0000
Subject: [PATCH] Fixed bug #42208 (substr_replace() crashes when the same
 array is passed more than once)

---
 NEWS                                     |  2 ++
 ext/standard/string.c                    |  1 +
 ext/standard/tests/strings/bug42208.phpt | 15 +++++++++++++++
 3 files changed, 18 insertions(+)
 create mode 100644 ext/standard/tests/strings/bug42208.phpt

diff --git a/NEWS b/NEWS
index 086e9b2991..7a3092eb80 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? Aug 2007, PHP 5.2.4
+- Fixed bug #42208 (substr_replace() crashes when the same array is passed 
+  more than once). (crrodriguez at suse dot de, Ilia)
 - Fixed bug #36492 (Userfilters can leak buckets). (Sara)
 
 02 Aug 2007, PHP 5.2.4RC1
diff --git a/ext/standard/string.c b/ext/standard/string.c
index 2617c681b3..e7b36a27ac 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2168,6 +2168,7 @@ PHP_FUNCTION(substr_replace)
 	}
 
 	if (argc > 3) {
+		SEPARATE_ZVAL(len);
 		if (Z_TYPE_PP(len) != IS_ARRAY) {
 			convert_to_long_ex(len);
 			l = Z_LVAL_PP(len);
diff --git a/ext/standard/tests/strings/bug42208.phpt b/ext/standard/tests/strings/bug42208.phpt
new file mode 100644
index 0000000000..72488a93d8
--- /dev/null
+++ b/ext/standard/tests/strings/bug42208.phpt
@@ -0,0 +1,15 @@
+--TEST--
+Bug #42208 (substr_replace() crashes when the same array is passed more than once)
+--FILE--
+<?php
+$a = array(1, 2);
+$c = $a;
+var_dump(substr_replace($a, 1, 1, $c));
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(2) "11"
+  [1]=>
+  string(2) "21"
+}
-- 
2.40.0