buffer: implement replace