Mantis - Quercus
Viewing Issue Advanced Details
3185 minor always 12-16-08 22:43 12-17-08 10:01
koreth  
nam  
normal  
closed 4.0.0  
fixed  
none    
none 4.0.0  
0003185: NPE after str_replace() in compiled mode
<?php
function foo() {
  $x = "ax";
  $search = array('a', 'b');
  $replace = array(' ', '-');
  $y = str_replace($search, $replace, $x);
  print var_export($y, true);
}
foo();

In compiled mode, this throws an NPE because str_replace() returns an actual Java null (not a NullValue instance). Looks like this is due to StringModule.strReplaceImpl() assuming that "result" has been initialized if the count is greater than 0, when in fact the count can be initialized to a nonzero value.

Patch:

--- a/modules/quercus/src/com/caucho/quercus/lib/string/StringModule.java
+++ b/modules/quercus/src/com/caucho/quercus/lib/string/StringModule.java
@@ -2728,7 +2728,7 @@ public class StringModule extends AbstractQuercusModule {
       count++;
     }
 
- if (count != 0) {
+ if (count != 0 && result != null) {
       countV.set(LongValue.create(count));
 
       int subjectLength = subject.length();

Notes
(0003664)
nam   
12-17-08 10:01   
php/113n