From e2401847acc5a6f9be6503808d65f88c64a9bbaf Mon Sep 17 00:00:00 2001 From: "Christoph M. Becker" Date: Tue, 18 Aug 2020 13:24:17 +0200 Subject: [PATCH] Fix #79986: str_ireplace bug with diacritics characters `tolower()` returns an `int`, so we must not convert to `char` which may be `signed` and as such may be subject to overflow (actually, implementation defined behavior). --- ext/standard/string.c | 2 +- ext/standard/tests/strings/bug79986.phpt | 13 +++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/strings/bug79986.phpt diff --git a/ext/standard/string.c b/ext/standard/string.c index b070a5e827fd5..e4361a111460f 100644 --- a/ext/standard/string.c +++ b/ext/standard/string.c @@ -3156,7 +3156,7 @@ static zend_string* php_char_to_str_ex(zend_string *str, char from, char *to, si { zend_string *result; size_t char_count = 0; - char lc_from = 0; + int lc_from = 0; const char *source, *source_end= ZSTR_VAL(str) + ZSTR_LEN(str); char *target; diff --git a/ext/standard/tests/strings/bug79986.phpt b/ext/standard/tests/strings/bug79986.phpt new file mode 100644 index 0000000000000..fcbc72148c242 --- /dev/null +++ b/ext/standard/tests/strings/bug79986.phpt @@ -0,0 +1,13 @@ +--TEST-- +Bug #79986 (str_ireplace bug with diacritics characters) +--SKIPIF-- + +--FILE-- + +--EXPECT-- +11 22 33