streams/memory: Ensure internal string is NUL terminated (#20812)

ndossche · web-flow · commit 5484ebcc49a4 · 2026-01-02T18:03:17.000+01:00
zend_string_truncate() doesn't put a NUL byte.
diff --git a/main/streams/memory.c b/main/streams/memory.c
@@ -247,8 +247,8 @@ static int php_stream_memory_set_option(php_stream *stream, int option, int valu
 						size_t old_size = ZSTR_LEN(ms->data);
 						ms->data = zend_string_realloc(ms->data, newsize, 0);
 						memset(ZSTR_VAL(ms->data) + old_size, 0, newsize - old_size);
-						ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';
 					}
+					ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';
 					return PHP_STREAM_OPTION_RETURN_OK;
 			}
 	}

Original file line number	Diff line number	Diff line change
`@@ -247,8 +247,8 @@ static int php_stream_memory_set_option(php_stream *stream, int option, int valu`
`247`	`247`	`size_t old_size = ZSTR_LEN(ms->data);`
`248`	`248`	`ms->data = zend_string_realloc(ms->data, newsize, 0);`
`249`	`249`	`memset(ZSTR_VAL(ms->data) + old_size, 0, newsize - old_size);`
`250`		`- ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';`
`251`	`250`	`}`
	`251`	`+ ZSTR_VAL(ms->data)[ZSTR_LEN(ms->data)] = '\0';`
`252`	`252`	`return PHP_STREAM_OPTION_RETURN_OK;`
`253`	`253`	`}`
`254`	`254`	`}`