MFH: fix #39621 (str_replace() is not binary safe on strings with equal length)

2 files changed, 24 insertions, 7 deletions

diff --git a/ext/standard/string.c b/ext/standard/string.c
index adf0077e4a..34c874e1c4 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -3338,16 +3338,33 @@ nothing_todo:
 		new_str = estrndup(haystack, length);
 		return new_str;
 	} else {
-		if (case_sensitivity ? strncmp(haystack, needle, length) : strncasecmp(haystack, needle, length)) {
+		if (case_sensitivity && memcmp(haystack, needle, length)) {
 			goto nothing_todo;
-		} else {
-			*_new_length = str_len;
-			new_str = estrndup(str, str_len);
-			if (replace_count) {
-				(*replace_count)++;
+		} else if (!case_sensitivity) {
+			char *l_haystack, *l_needle;
+
+			l_haystack = estrndup(haystack, length);
+			l_needle = estrndup(needle, length);
+
+			php_strtolower(l_haystack, length);
+			php_strtolower(l_needle, length);
+
+			if (memcmp(l_haystack, l_needle, length)) {
+				efree(l_haystack);
+				efree(l_needle);
+				goto nothing_todo;
 			}
-			return new_str;
+			efree(l_haystack);
+			efree(l_needle);
 		}
+
+		*_new_length = str_len;
+		new_str = estrndup(str, str_len);
+
+		if (replace_count) {
+			(*replace_count)++;
+		}
+		return new_str;
 	}
 
 }
diff --git a/ext/standard/tests/strings/bug39621.phpt b/ext/standard/tests/strings/bug39621.phpt
new file mode 100644
index 0000000000..1a33147b68
--- /dev/null
+++ b/ext/standard/tests/strings/bug39621.phpt