op2 is null terminated string

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index b40d3b14d69cdbb4c92f1fa8f0f4e9ecbd6a356f..d64cc6280e32c694b5dfb8d1e8a981d78aed2d7c 100644 (file)
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1581,15 +1581,13 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 
                Z_STR_P(result) = STR_REALLOC(Z_STR_P(result), res_len, 0 );
                Z_TYPE_INFO_P(result) = IS_STRING_EX;
-               memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), op2_len);
-               Z_STRVAL_P(result)[res_len]=0;
+               memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), op2_len + 1);
        } else {
                int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
                zend_string *buf = STR_ALLOC(length, 0);
 
                memcpy(buf->val, Z_STRVAL_P(op1), Z_STRLEN_P(op1));
-               memcpy(buf->val + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
-               buf->val[length] = 0;
+               memcpy(buf->val + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
                ZVAL_NEW_STR(result, buf);
        }
        if (use_copy1) {