Fix off-by-one in ReflectionType::__toString()

Review mistake...

Author: nikic

ext/reflection/php_reflection.c

@@ -3040,14 +3040,16 @@ ZEND_METHOD(reflection_type, __toString)
 	if (param->arg_info->type_hint == IS_OBJECT
 		&& !zend_string_equals_literal_ci(param->arg_info->class_name, "self")
 		&& !zend_string_equals_literal_ci(param->arg_info->class_name, "parent")) {
-		str = zend_string_extend(str, ZSTR_LEN(str) + 1, 0);
-		memmove(ZSTR_VAL(str) + 1, ZSTR_VAL(str), ZSTR_LEN(str) + 1);
+		size_t orig_len = ZSTR_LEN(str);
+		str = zend_string_extend(str, orig_len + 1, 0);
+		memmove(ZSTR_VAL(str) + 1, ZSTR_VAL(str), orig_len + 1);
 		ZSTR_VAL(str)[0] = '\\';
 	}
 
 	if (param->arg_info->allow_null) {
-		str = zend_string_extend(str, ZSTR_LEN(str) + 1, 0);
-		memmove(ZSTR_VAL(str) + 1, ZSTR_VAL(str), ZSTR_LEN(str) + 1);
+		size_t orig_len = ZSTR_LEN(str);
+		str = zend_string_extend(str, orig_len + 1, 0);
+		memmove(ZSTR_VAL(str) + 1, ZSTR_VAL(str), orig_len + 1);
 		ZSTR_VAL(str)[0] = '?';
 	}