Fix bzdecompress

Bad memory allocation, the buffer needs to be large enough to fit all
the data we've decompressed so far plus the extra storage we're
incrementally allocationg, not just the incremental part.

hphp/runtime/ext/ext_bzip2.cpp

@@ -113,7 +113,7 @@ Variant f_bzdecompress(CStrRef source, int small /* = 0 */) {
     /* compression is better then 2:1, need to allocate more memory */
     bzs.avail_out = source_len;
     size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-    dest = (char *) Util::safe_realloc(dest, bzs.avail_out + 1);
+    dest = (char *) Util::safe_realloc(dest, size + bzs.avail_out + 1);
     bzs.next_out = dest + size;
   }
 

hphp/test/test_ext_bzip2.cpp

@@ -125,5 +125,9 @@ bool TestExtBzip2::test_bzdecompress() {
   ret = f_bzdecompress(ret);
   ret = f_bzdecompress(ret);
   VS(ret, str);
+  str = StringUtil::Repeat("x", 1000);
+  ret = f_bzcompress(str);
+  ret = f_bzdecompress(ret);
+  VS(ret, str);
   return Count(true);
 }