- Always \0 terminate data returned from _php_stream_copy_to_mem().

diff --git a/main/streams.c b/main/streams.c
index b65f39feef15688c171a30473a283f0f3da049c2..3381791c8922dce4055ad8756344ac8163459611 100755 (executable)
--- a/main/streams.c
+++ b/main/streams.c
@@ -441,7 +441,8 @@ PHPAPI size_t _php_stream_copy_to_mem(php_stream *src, char **buf, size_t maxlen
                }
        }
        if (len) {
-               *buf = perealloc_rel_orig(*buf, len, persistent);
+               *buf = perealloc_rel_orig(*buf, len + 1, persistent);
+               (*buf)[len] = '\0';
        } else {
                pefree(*buf, persistent);
                *buf = NULL;