cvs: php-src(PHP_5_2) / NEWS /ext/standard string.c /ext/standard/tests/strings bug39621.phpt

tony2001 Fri Nov 24 21:59:10 2006 UTC Added files: (Branch: PHP_5_2) /php-src/ext/standard/tests/strings bug39621.phpt Modified files: /php-src NEWS /php-src/ext/standard string.c Log: MFH: fix #39621 (str_replace() is not binary safe on strings with equal length) http://cvs.php.net/viewvc.cgi/php-src/NEWS?r1=1.2027.2.547.2.375&r2=1.2027.2.547.2.376&diff_format=u Index: php-src/NEWS diff -u php-src/NEWS:1.2027.2.547.2.375 php-src/NEWS:1.2027.2.547.2.376 --- php-src/NEWS:1.2027.2.547.2.375 Fri Nov 24 12:39:39 2006 +++ php-src/NEWS Fri Nov 24 21:59:09 2006 @@ -41,6 +41,8 @@ php_filter.h). - Fixed wrong signature initialization in imagepng (Takeshi Abe) - Added optimization for imageline with horizontal and vertial lines (Pierre) +- Fixed bug #39621 (str_replace() is not binary safe on strings with equal + length). (Tony) - Fixed bug #39613 (Possible segfault in imap initialization due to missing module dependency). (wharmby at uk dot ibm dot com, Tony) - Fixed bug #39602 (Invalid session.save_handler crashes PHP). (Dmitry) http://cvs.php.net/viewvc.cgi/php-src/ext/standard/string.c?r1=1.445.2.14.2.28&r2=1.445.2.14.2.29&diff_format=u Index: php-src/ext/standard/string.c diff -u php-src/ext/standard/string.c:1.445.2.14.2.28 php-src/ext/standard/string.c:1.445.2.14.2.29 --- php-src/ext/standard/string.c:1.445.2.14.2.28 Mon Nov 6 17:21:05 2006 +++ php-src/ext/standard/string.c Fri Nov 24 21:59:09 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: string.c,v 1.445.2.14.2.28 2006/11/06 17:21:05 iliaa Exp $ */ +/* $Id: string.c,v 1.445.2.14.2.29 2006/11/24 21:59:09 tony2001 Exp $ */ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */ @@ -3338,16 +3338,33 @@ new_str = estrndup(haystack, length); return new_str; } else { - if (case_sensitivity ? strncmp(haystack, needle, length) : strncasecmp(haystack, needle, length)) { + if (case_sensitivity && memcmp(haystack, needle, length)) { goto nothing_todo; - } else { - *_new_length = str_len; - new_str = estrndup(str, str_len); - if (replace_count) { - (*replace_count)++; + } else if (!case_sensitivity) { + char *l_haystack, *l_needle; + + l_haystack = estrndup(haystack, length); + l_needle = estrndup(needle, length); + + php_strtolower(l_haystack, length); + php_strtolower(l_needle, length); + + if (memcmp(l_haystack, l_needle, length)) { + efree(l_haystack); + efree(l_needle); + goto nothing_todo; } - return new_str; + efree(l_haystack); + efree(l_needle); } + + *_new_length = str_len; + new_str = estrndup(str, str_len); + + if (replace_count) { + (*replace_count)++; + } + return new_str; } } http://cvs.php.net/viewvc.cgi/php-src/ext/standard/tests/strings/bug39621.phpt?view=markup&rev=1.1 Index: php-src/ext/standard/tests/strings/bug39621.phpt +++ php-src/ext/standard/tests/strings/bug39621.phpt --TEST-- Bug #39621 (str_replace() is not binary safe on strings with equal length) --FILE-- <?php $search = "qxxx\0qqqqqqqq"; $subject = "qxxx\0xxxxxxxx"; $replace = "any text"; $result = str_replace ( $search, $replace, $subject ); var_dump($result); $search = "QXXX\0qqqqqqqq"; $subject = "qxxx\0xxxxxxxx"; $replace = "any text"; $result = str_ireplace ( $search, $replace, $subject ); var_dump($result); $search = "qxxx\0xxxxxxxx"; $subject = "qxxx\0xxxxxxxx"; $replace = "any text"; $result = str_replace ( $search, $replace, $subject ); var_dump($result); $search = "qXxx\0xXxXxXxx"; $subject = "qxXx\0xxxxxxxx"; $replace = "any text"; $result = str_ireplace ( $search, $replace, $subject ); var_dump($result); echo "Done\n"; ?> --EXPECTF-- string(13) "qxxx string(13) "qxxx string(8) "any text" string(8) "any text" Done --UEXPECTF-- unicode(13) "qxxx unicode(13) "qxxx unicode(8) "any text" unicode(8) "any text" Done