fix off-by-one accidentally introduced by safe_emalloc() patch

diff --git a/ext/standard/string.c b/ext/standard/string.c
index 7b484e389687510aa4227142f53d43b1b871df95..e9276fc03629d4735d60c3fb5b55881cd3a765b2 100644 (file)
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -4914,7 +4914,7 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l
        }
 
        Z_STRLEN_P(result) = len + (char_count * (to_len - 1));
-       Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len);
+       Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len + 1);
        Z_TYPE_P(result) = IS_STRING;
 
        if (case_sensitivity) {