php-5.2.17-bug-55366.patch

   1 diff -up php-5.2.17/ext/standard/string.c.bug-55366 php-5.2.17/ext/standard/string.c
   2 --- php-5.2.17/ext/standard/string.c.bug-55366  2012-01-12 10:35:09.000000000 +0700
   3 +++ php-5.2.17/ext/standard/string.c    2012-01-12 10:36:38.000000000 +0700
   4 @@ -2462,6 +2462,10 @@ PHP_FUNCTION(substr_replace)
   5                         RETURN_STRINGL(Z_STRVAL_PP(str), Z_STRLEN_PP(str), 1);
   6                 }
   7         } else { /* str is array of strings */
   8 +               char *str_index = NULL;
   9 +               uint str_index_len;
  10 +               ulong num_index;
  11 +
  12                 array_init(return_value);
  13
  14                 if (Z_TYPE_PP(from) == IS_ARRAY) {
  15 @@ -2599,7 +2603,13 @@ PHP_FUNCTION(substr_replace)
  16                         }
  17
  18                         result[result_len] = '\0';
  19 -                       add_next_index_stringl(return_value, result, result_len, 0);
  20 +
  21 +                       if (zend_hash_get_current_key_ex(Z_ARRVAL_PP(str), &str_index, &str_index_len, &num_index, 0, &pos_str) == HASH_KEY_IS_STRING) {
  22 +                               add_assoc_stringl_ex(return_value, str_index, str_index_len, result, result_len, 0);
  23 +                       } else {
  24 +                               add_index_stringl(return_value, num_index, result, result_len, 0);
  25 +                       }
  26 +
  27                         if(Z_TYPE_PP(tmp_str) != IS_STRING) {
  28                                 zval_dtor(orig_str);
  29                         }