Fix StringBuffer::resize()

capacity doesnt include the terminating null, so len is
allowed to grow to capacity (not capacity - 1).

hphp/runtime/base/util/string_buffer.cpp

@@ -150,8 +150,8 @@ void StringBuffer::release() {
 }
 
 void StringBuffer::resize(int size) {
-  assert(size >= 0 && size < m_cap);
-  if (size >= 0 && size < m_cap) {
+  assert(size >= 0 && size <= m_cap);
+  if (size >= 0 && size <= m_cap) {
     m_len = size;
   }
 }

hphp/test/vm/sb_overflow.php

@@ -0,0 +1,8 @@
+<?php
+
+var_dump(iconv_mime_decode(
+           '=?utf-8?Q?...=20.....=3A=20...=20.....=20....=20'.
+           '.......=20...=20.....=2C=20....=20.......=E2=80=99s'.
+           '=20....=20......=20..=20...=E2=80=99s=20....=20.....'.
+           '=3F=2C=20...=20.......=20..=20.......=20...'.
+           '=20........?=', 2, 'UTF-8'));

hphp/test/vm/sb_overflow.php.exp

@@ -0,0 +1 @@
+string(133) "... .....: ... ..... .... ....... ... ....., .... .......’s .... ...... .. ...’s .... .....?, ... ....... .. ....... ... ........"