Fix GH-12151: str_getcsv ending with escape zero segfualt

Closes GH-12152

Author: bukka

NEWS

@@ -32,6 +32,10 @@ PHP                                                                        NEWS
   . Fixed bug GH-11972 (RecursiveCallbackFilterIterator regression in 8.1.18).
     (nielsdos)
 
+- Standard:
+  . Fixed bug GH-12151 (str_getcsv ending with escape zero segfualt).
+    (Jakub Zelenka)
+
 31 Aug 2023, PHP 8.3.0RC1
 
 - Core:

ext/standard/file.c

@@ -2023,6 +2023,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
 									if (bptr > limit) {
 										/* if the line ends with enclosure, we need to go back by
 										 * one character so the \0 character is not copied. */
+										if (hunk_begin == bptr) {
+											--hunk_begin;
+										}
 										--bptr;
 									}
 									goto quit_loop_2;
@@ -2038,6 +2041,9 @@ PHPAPI HashTable *php_fgetcsv(php_stream *stream, char delimiter, char enclosure
 									if (bptr > limit) {
 										/* if the line ends with enclosure, we need to go back by
 										 * one character so the \0 character is not copied. */
+										if (hunk_begin == bptr) {
+											--hunk_begin;
+										}
 										--bptr;
 									}
 									goto quit_loop_2;

ext/standard/tests/strings/gh12151.phpt

@@ -0,0 +1,14 @@
+--TEST--
+GH-12151 (str_getcsv ending with escape zero segfualt)
+--FILE--
+<?php
+var_export(str_getcsv("y","","y","\000"));
+var_export(str_getcsv("\0yy","y","y","\0"));
+?>
+--EXPECT--
+array (
+  0 => '' . "\0" . '',
+)array (
+  0 => '' . "\0" . '',
+  1 => '' . "\0" . '',
+)