Fix heap over-read in cli_get_prompt() for empty cli.prompt

The prompt parser ran as a do-while, so an empty cli.prompt executed
the body on the terminator and scanned past it. Use a while loop and
smart_str_extract(), which returns the interned empty string when
nothing was appended. No regression test: extra unicode warnings from
the over-read depend on heap contents, so a .phpt cannot pin the bug
red-before.

Closes GH-23415

Author: iliaal

NEWS

@@ -38,6 +38,10 @@ PHP                                                                        NEWS
   . Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
     column index. (Ilia Alshanetsky)
 
+- Readline:
+  . Fixed a heap over-read in the interactive shell prompt when cli.prompt is
+    set to an empty string. (Ilia Alshanetsky)
+
 - Sockets:
   . Fixed socket_select() silently truncating sets larger than FD_SETSIZE on
     Windows. (David Carlier)

ext/readline/readline_cli.c

@@ -130,7 +130,7 @@ static zend_string *cli_get_prompt(char *block, char prompt) /* {{{ */
 	char *prompt_spec = CLIR_G(prompt) ? CLIR_G(prompt) : DEFAULT_PROMPT;
 	bool unicode_warned = false;
 
-	do {
+	while (*prompt_spec) {
 		if (*prompt_spec == '\\') {
 			switch (prompt_spec[1]) {
 			case '\\':
@@ -198,9 +198,9 @@ static zend_string *cli_get_prompt(char *block, char prompt) /* {{{ */
 				smart_str_appendc(&retval, '?');
 			}
 		}
-	} while (++prompt_spec && *prompt_spec);
-	smart_str_0(&retval);
-	return retval.s;
+		++prompt_spec;
+	}
+	return smart_str_extract(&retval);
 }
 /* }}} */