Fix GH-11567: mb_str_pad causes access violation

When not providing a pad string, *and* not having other defaulted
arguments, the function would crash on a NULL pad zend_string*.
Despite testing with an empty pad string, the issue wasn't found because
when using named arguments the pad string *is* filled in.

Author: ndossche

ext/mbstring/mbstring.c

@@ -5529,7 +5529,7 @@ PHP_FUNCTION(mb_chr)
 
 PHP_FUNCTION(mb_str_pad)
 {
-	zend_string *input, *encoding_str = NULL, *pad = NULL;
+	zend_string *input, *encoding_str = NULL, *pad = ZSTR_CHAR(' ');
 	zend_long pad_to_length;
 	zend_long pad_type_val = PHP_STR_PAD_RIGHT;
 

ext/mbstring/tests/mb_str_pad.phpt

@@ -46,6 +46,12 @@ var_dump(mb_str_pad('▶▶', 1, ' ', STR_PAD_BOTH));
 var_dump(mb_str_pad('▶▶', 0, ' ', STR_PAD_BOTH));
 var_dump(mb_str_pad('▶▶', -1, ' ', STR_PAD_BOTH));
 
+echo "--- No pad string ---\n";
+var_dump(mb_str_pad('▶▶', 4));
+var_dump(mb_str_pad('▶▶', 3));
+var_dump(mb_str_pad('▶▶', 2));
+var_dump(mb_str_pad('▶▶', 1));
+
 echo "--- Empty input string ---\n";
 var_dump(mb_str_pad('', 2, ' ', STR_PAD_BOTH));
 var_dump(mb_str_pad('', 1, ' ', STR_PAD_BOTH));
@@ -98,6 +104,11 @@ string(6) "▶▶"
 string(6) "▶▶"
 string(6) "▶▶"
 string(6) "▶▶"
+--- No pad string ---
+string(8) "▶▶  "
+string(7) "▶▶ "
+string(6) "▶▶"
+string(6) "▶▶"
 --- Empty input string ---
 string(2) "  "
 string(1) " "