Fix off-by-one error in zend_case_fold_string().

diff --git a/Zend/zend_unicode.c b/Zend/zend_unicode.c
index 47d5f7be6b45f3c75f5e4345fb864fd9e7c78e1c..d4a389ffdf90beaabc23e5c56cc6f92528fa6a40 100644 (file)
--- a/Zend/zend_unicode.c
+++ b/Zend/zend_unicode.c
@@ -710,7 +710,7 @@ ZEND_API void zend_case_fold_string(UChar **dest, int *dest_len, UChar *src, int
        while (1) {
                *status = U_ZERO_ERROR;
                buffer = eurealloc(buffer, buffer_len+1);
-               buffer_len = u_strFoldCase(buffer, buffer_len, src, src_len, options, status);
+               buffer_len = u_strFoldCase(buffer, buffer_len+1, src, src_len, options, status);
                if (*status != U_BUFFER_OVERFLOW_ERROR) {
                        break;
                }