- Bugfix #33733

diff --git a/sapi/cli/php_cli_readline.c b/sapi/cli/php_cli_readline.c
index 23bfea2401922b05ce274c0f34fc064daba054be..93fba4cddd84d6a83fe1ff63682a01c8724d1977 100644 (file)
--- a/sapi/cli/php_cli_readline.c
+++ b/sapi/cli/php_cli_readline.c
@@ -301,7 +301,7 @@ static char *cli_completion_generator_var(const char *text, int textlen, int *st
 
        tmp = retval = cli_completion_generator_ht(text + 1, textlen - 1, state, EG(active_symbol_table), NULL TSRMLS_CC);
        if (retval) {
-               retval = malloc(strlen(tmp) + 1);
+               retval = malloc(strlen(tmp) + 2);
                retval[0] = '$';
                strcpy(&retval[1], tmp);
                rl_completion_append_character = '\0';