MFH:

fix bug #33076 (str_ireplace() incorrectly counts result string length and may cause segfault)
add test

NEWS

@@ -11,6 +11,8 @@ PHP                                                                        NEWS
 - Fixed ext/mysqli to allocate less memory when fetching bound params
   of type (MEDIUM|LONG)BLOB/(MEDIUM|LONG)TEXT. (Andrey)
 - Fixed memory corruption in ImageTTFText() with 64bit systems. (Andrey)
+- Fixed bug #33076 (str_ireplace() incorrectly counts result string length 
+  and may cause segfault). (Tony)
 - Fixed bug #33059 (crash when moving xml attribute set in dtd). (Ilia)
 - Fixed bug #33057 (Don't send extraneous entity-headers on a 304 as per
   RFC 2616 section 10.3.5) (Rasmus, Choitel)

ext/standard/string.c

@@ -2943,7 +2943,7 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l
 	char *source, *target, *tmp, *source_end=str+len, *tmp_end = NULL;
 	
 	for (source = str; source < source_end; source++) {
-		if (*source == from) {
+		if ((case_sensitivity && *source == from) || (!case_sensitivity && tolower(*source) == tolower(from))) {
 			char_count++;
 		}
 	}

ext/standard/tests/strings/bug33076.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #33076 (str_ireplace() incorrectly counts result string length and may cause segfault)
+--FILE--
+<?php
+
+$value = str_ireplace("t", "bz", "Text");
+
+var_dump($value);
+
+echo "Done\n";
+?>
+--EXPECT--	
+string(6) "bzexbz"
+Done