Commit fa3b5a14c81 for php.net

commit fa3b5a14c8112df612f02247536cf6ee3e286f0b
Author: David CARLIER <devnexen@gmail.com>
Date:   Mon May 18 11:31:18 2026 +0100

    * ext/intl: master community build fix (attempt). (#22080)

    reproducible normally with

    ```
    php -r 'var_dump(new \NumberFormatter("en", \NumberFormatter::DECIMAL)->format(INF));'
    ```

    but could not locally (asan version ?) but mostly due to uninitialised garbage.
    regression from 3ed80a154d5

diff --git a/ext/intl/intl_convertcpp.cpp b/ext/intl/intl_convertcpp.cpp
index cd7614b3a6c..70d28e5c23c 100644
--- a/ext/intl/intl_convertcpp.cpp
+++ b/ext/intl/intl_convertcpp.cpp
@@ -72,7 +72,7 @@ zend_string* intl_charFromString(const UnicodeString &from, UErrorCode *status)

 	const UChar *utf16buf = from.getBuffer();
 	int32_t actual_len;
-	u_strToUTF8WithSub(ZSTR_VAL(u8res), capacity, &actual_len, utf16buf, from.length(),
+	u_strToUTF8WithSub(ZSTR_VAL(u8res), capacity + 1, &actual_len, utf16buf, from.length(),
 		U_SENTINEL, NULL, status);

 	if (U_FAILURE(*status)) {
diff --git a/ext/intl/tests/gh21998.phpt b/ext/intl/tests/gh21998.phpt
new file mode 100644
index 00000000000..392336dab52
--- /dev/null
+++ b/ext/intl/tests/gh21998.phpt
@@ -0,0 +1,15 @@
+--TEST--
+GH-21998 (NumberFormatter::format(INF) leaves a non-NUL-terminated zend_string)
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+$fmt = new NumberFormatter("en", NumberFormatter::DECIMAL);
+var_dump($fmt->format(INF));
+var_dump($fmt->format(-INF));
+var_dump($fmt->format(NAN));
+?>
+--EXPECT--
+string(3) "∞"
+string(4) "-∞"
+string(3) "NaN"