fix: honour open_basedir and stop mutating the caller's array

[somethingwithproof]

Two behaviours that differ from the procedural functions beside them.

open_basedir. rrd_create() and RRDGraph::save() call php_check_open_basedir(); RRDCreator::save() and RRDGraph::saveVerbose() do not, though both write a file the caller names. With open_basedir=/allowed:/poc:/tmp on master, the checked pair returns false and the unchecked pair writes:

$ ls -l /outside/
-rw-r--r-- 1 root root  776 oop.rrd        <- RRDCreator::save()
-rw-r--r-- 1 root root 5488 verbose.png    <- RRDGraph::saveVerbose()

Nothing lands there after the change. Worth saying plainly: php/policies lists "requires an open_basedir bypass" under not a security issue, so this is filed as the consistency fix it is, not as a vulnerability.

Value semantics. Building the argument list calls convert_to_string() on the array elements, which rewrites them in place. The options array is shared with the caller and with any by-value copy of it, so a non-string option changes variables that were never passed in:

$a = array("--step", 300, "DS:speed:COUNTER:600:U:U", "RRA:AVERAGE:0.5:1:24");
$b = $a;
rrd_create($file, $a);
var_dump($b[1]);   // master: string(3) "300"

zval_get_string() on a released temporary leaves the caller's array alone. Same fix in RRDGraph's option builder and in RRDUpdater::update(), where the data source name also moves from smart_string_appends to smart_string_appendl so an embedded NUL stops silently truncating it.

Scope, so the title does not over-promise. These checks cover the output path each method writes. The RRD files a graph reads are named inside the options array (DEF:v=/any/path.rrd:ds:AVG) and are still unchecked, and rrd_xport has no php_check_open_basedir call at all. Both gaps are pre-existing and out of scope here; happy to file a follow-up.

One more thing in the same lines. zval_get_string() returns an empty string with an exception already pending for a value that cannot be converted, so the original Error was masked by whatever librrd reported next. zval_try_get_string() plus a bail-out lets it surface, which is what rrd_031.phpt asserts.

Validation

php:8.4-cli with librrd 1.7.2 and macOS with librrd 1.11.0: 36/36 pass on PHP 8.1, 8.3, 8.4, 8.5 and 8.6.0-dev. Stacked on #12.

Two more, found while testing this

The check was bypassable. __construct is callable again (previous PR), and the path is read once for the check and again to build the argv, with __toString in between. A value object whose __toString calls $updater->__construct('/outside.rrd') moved the write outside open_basedir:

last update of the outside file BEFORE: 920804400
last update AFTER:                      920804700
value written: 1.0000000000e+00

The path is now snapshotted straight after the check. rrd_032.phpt asserts the write lands on the checked path.

Use-after-free in the graph option walk. RRDGraph::save() iterates an array owned solely by the object, and setOptions() from inside __toString frees it mid-walk:

Invalid read of size 1
   by rrd_graph_obj_create_argv (rrd_graph.c:160)
 Address is 1,033 bytes inside a block of size 5,120 free'd
   by zim_RRDGraph_setOptions (rrd_graph.c:123)

Pre-existing, but this branch makes conversion run on every call rather than only the first, so it widens it. A reference is now held across the walk; rrd_033.phpt covers it.

And rrd_fetch on duplicate data source names. The per-timestamp walk assumes the array it built has ds_cnt entries, but it is keyed by name, so two identical names collapse into one and zend_hash_get_current_data() returns NULL into add_assoc_double(). Renaming one ds_nam over another in the header reproduces it: add_assoc_double (arg=0x0, key=0x... "920804700") at rrd.c:133. rrd_034.phpt builds such a file and asserts no crash.

---

Stack order. This is part of a series, each building on the one before. Merge order:
#11 (test suite) → #12 (memory safety) → #13 (open_basedir, value semantics) → #14 (php-src master) → #15 (librrd argv) → #16 (argument builder) → #17 (autoconf). Commits below this PR's own belong to the ones underneath it.