This is the patch, updated to apply to 5.1.2-1 in Debian.
Regards, Allard Hoeve
Index: ext/standard/html.c =================================================================== --- ext/standard/html.c (revision 36) +++ ext/standard/html.c (working copy) @@ -884,7 +884,7 @@ unsigned char replacement[15]; int replacement_len; - ret = estrdup(old); + ret = estrdup(old, oldlen); retlen = oldlen; if (!retlen) { goto empty_source;