From a5de492617e58d3f9d15d40fcd9629e879d9fd69 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
Date: Sat, 14 Jan 2023 21:01:22 +0100
Subject: [PATCH] Fix substr_replace with slots in repl_ht being UNDEF

The check that was supposed to check whether the array slot was UNDEF
was wrong and never triggered. This resulted in a replacement with the
empty string or the wrong string instead of the correct one. The correct
check pattern can be observed higher up in the function's code.
---
 ext/standard/string.c                         |  2 +-
 .../strings/substr_replace_array_unset.phpt   | 27 +++++++++++++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/strings/substr_replace_array_unset.phpt

diff --git a/ext/standard/string.c b/ext/standard/string.c
index e171448f243e1..643094263bfcb 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -2472,7 +2472,7 @@ PHP_FUNCTION(substr_replace)
 			if (repl_ht) {
 				while (repl_idx < repl_ht->nNumUsed) {
 					tmp_repl = &repl_ht->arData[repl_idx].val;
-					if (repl_ht != IS_UNDEF) {
+					if (Z_TYPE_P(tmp_repl) != IS_UNDEF) {
 						break;
 					}
 					repl_idx++;
diff --git a/ext/standard/tests/strings/substr_replace_array_unset.phpt b/ext/standard/tests/strings/substr_replace_array_unset.phpt
new file mode 100644
index 0000000000000..ff253d3984476
--- /dev/null
+++ b/ext/standard/tests/strings/substr_replace_array_unset.phpt
@@ -0,0 +1,27 @@
+--TEST--
+substr_replace() function - array with unset
+--FILE--
+<?php
+
+$replacement = ['A', 'C', 'B'];
+unset($replacement[1]);
+$newarr = substr_replace(['1 string', '2 string'], $replacement, 0);
+print_r($newarr);
+
+$replacement = ['foo', 42 => 'bar', 'baz'];
+unset($replacement[42]);
+$newarr = substr_replace(['1 string', '2 string'], $replacement, 0);
+print_r($newarr);
+
+?>
+--EXPECT--
+Array
+(
+    [0] => A
+    [1] => B
+)
+Array
+(
+    [0] => foo
+    [1] => baz
+)