From: Xinchen Hui <laruence@php.net>
Date: Thu, 26 Jun 2014 14:13:24 +0000 (+0800)
Subject: op2 is null terminated string
X-Git-Tag: POST_PHPNG_MERGE~131
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=387c491559f1507685740bf613070d27bce59e4d;p=php

op2 is null terminated string
---

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index b40d3b14d6..d64cc6280e 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -1581,15 +1581,13 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 
 		Z_STR_P(result) = STR_REALLOC(Z_STR_P(result), res_len, 0 );
 		Z_TYPE_INFO_P(result) = IS_STRING_EX;
-		memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), op2_len);
-		Z_STRVAL_P(result)[res_len]=0;
+		memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), op2_len + 1);
 	} else {
 		int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
 		zend_string *buf = STR_ALLOC(length, 0);
 
 		memcpy(buf->val, Z_STRVAL_P(op1), Z_STRLEN_P(op1));
-		memcpy(buf->val + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
-		buf->val[length] = 0;
+		memcpy(buf->val + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
 		ZVAL_NEW_STR(result, buf);
 	}
 	if (use_copy1) {