fix bug #33076 (str_ireplace() incorrectly counts result string length and may cause segfault)

add test

ext/standard/string.c

@@ -2991,7 +2991,7 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l
 	char *source, *target, *tmp, *source_end=str+len, *tmp_end = NULL;
 	
 	for (source = str; source < source_end; source++) {
-		if (*source == from) {
+		if ((case_sensitivity && *source == from) || (!case_sensitivity && tolower(*source) == tolower(from))) {
 			char_count++;
 		}
 	}

ext/standard/tests/strings/bug33076.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #33076 (str_ireplace() incorrectly counts result string length and may cause segfault)
+--FILE--
+<?php
+
+$value = str_ireplace("t", "bz", "Text");
+
+var_dump($value);
+
+echo "Done\n";
+?>
+--EXPECT--	
+string(6) "bzexbz"
+Done