Fix invalid read of mem reported by valgrind

Author: marc-mabe

ext/standard/math.c

@@ -1264,16 +1264,18 @@ PHPAPI zend_string *_php_math_number_format_long(zend_long num, int dec, const c
 			*t++ = '1';
 			if (thousand_sep && (count%3) == 0) {
 				memcpy(t, thousand_sep, thousand_sep_len);
-				t += thousand_sep_len;
+				memcpy(t + thousand_sep_len, ZSTR_VAL(tmpbuf)+1, reslen - thousand_sep_len - 1);
+			} else {
+				memcpy(t, ZSTR_VAL(tmpbuf)+1, reslen - 1);
 			}
-			memcpy(t, ZSTR_VAL(tmpbuf)+1, reslen - 1);
 		} else {
 			*t++ = '1';
 			if (thousand_sep && (count%3) == 0) {
 				memcpy(t, thousand_sep, thousand_sep_len);
-				t += thousand_sep_len;
+				memcpy(t + thousand_sep_len, ZSTR_VAL(tmpbuf), reslen - thousand_sep_len);
+			} else {
+				memcpy(t, ZSTR_VAL(tmpbuf), reslen);
 			}
-			memcpy(t, ZSTR_VAL(tmpbuf), reslen);
 		}
 	}