php substr_replace替换指定位置字符与内存破坏漏洞

function substr_replace(sourcecon,repcon,startx,lenx) 
   dim reped 
   reped = mid(sourcecon,startx,lenx) '取出原内容同样长度 
   dim scleftx,scleft 
   scleftx = startx-1 
   if scleftx<1 then 
scleft = "" 
   else 
scleft = left(sourcecon,scleftx) 
   end if 
   substr_replace = replace(sourcecon,reped,repcon,startx,1) 
   substr_replace = scleft&substr_replace 
end function

php_function(substr_replace) 
{ 
... 
if (zend_parse_parameters(zend_num_args() tsrmls_cc, "zzz|z", &str, &repl, &from, &len) == failure) { 
return; 
} 
if (z_type_pp(str) != is_array) { 
convert_to_string_ex(str); 
} 
if (z_type_pp(repl) != is_array) { 
convert_to_string_ex(repl); 
} 
if (z_type_pp(from) != is_array) { 
convert_to_long_ex(from); 
} 
if (argc > 3) { 
separate_zval(len); 
if (z_type_pp(len) != is_array) { 
convert_to_long_ex(len); 
l = z_lval_pp(len); 
} 
} else { 
if (z_type_pp(str) != is_array) { 
l = z_strlen_pp(str); 
} 
} 
if (z_type_pp(str) == is_string) { 
if ( 
(argc == 3 && z_type_pp(from) == is_array) ||  
(argc == 4 && z_type_pp(from) != z_type_pp(len)) 
){ 
php_error_docref(null tsrmls_cc, e_warning, "'from' and 'len' should be of same type - numerical or array "); 
return_stringl(z_strval_pp(str), z_strlen_pp(str), 1);       
}