Fix buffer overflow bug in HZ text conversion code

Author: alexdowad

ext/mbstring/libmbfl/filters/mbfilter_hz.c

@@ -372,7 +372,7 @@ static void mb_wchar_to_hz(uint32_t *in, size_t len, mb_convert_buf *buf, bool e
 		} else if (s < 0x80) {
 			/* ASCII */
 			if (buf->state != ASCII) {
-				MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
+				MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 3);
 				out = mb_convert_buf_add2(out, '~', '}');
 				buf->state = ASCII;
 			}
@@ -385,11 +385,12 @@ static void mb_wchar_to_hz(uint32_t *in, size_t len, mb_convert_buf *buf, bool e
 		} else {
 			/* GB 2312-80 */
 			if (buf->state != GB2312) {
-				MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
+				MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 4);
 				out = mb_convert_buf_add2(out, '~', '{');
 				buf->state = GB2312;
+			} else {
+				MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
 			}
-			MB_CONVERT_BUF_ENSURE(buf, out, limit, len + 2);
 			out = mb_convert_buf_add2(out, (s >> 8) & 0x7F, s & 0x7F);
 		}
 	}