Introduce zend_safe_string_address_guarded()

This is a variant of `zend_safe_address_guarded()` which also caters to
`ZSTR_MAX_LEN`.  We put it into zend_multiply.h instead of zend_string.h
to avoid inclusion issues (zend.h includes zend_string.h and vice versa).

Author: cmb69

Zend/zend_multiply.h

@@ -340,4 +340,16 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
 	return ret;
 }
 
+static zend_always_inline size_t zend_safe_string_address_guarded(size_t nmemb, size_t size, size_t offset)
+{
+	int overflow;
+	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+	if (UNEXPECTED(overflow) || ret > ZSTR_MAX_LEN) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		return 0;
+	}
+	return ret;
+}
+
 #endif /* ZEND_MULTIPLY_H */

ext/pcre/php_pcre.c

@@ -1719,15 +1719,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su
 			}
 
 			if (new_len >= alloc_len) {
-				alloc_len = zend_safe_address_guarded(2, new_len, 0);
-				if (UNEXPECTED(alloc_len > ZSTR_MAX_LEN)) {
-					zend_throw_error(NULL, "String size overflow");
-					if (result != NULL) {
-						zend_string_release_ex(result, 0);
-						result = NULL;
-					}
-					break;
-				}
+				alloc_len = zend_safe_string_address_guarded(2, new_len, 0);
 				if (result == NULL) {
 					result = zend_string_alloc(alloc_len, 0);
 				} else {
@@ -1963,17 +1955,9 @@ static zend_string *php_pcre_replace_func_impl(pcre_cache_entry *pce, zend_strin
 				pcre2_get_mark(match_data), flags);
 
 			ZEND_ASSERT(eval_result);
-			new_len = zend_safe_address_guarded(1, ZSTR_LEN(eval_result), new_len);
+			new_len = zend_safe_string_address_guarded(1, ZSTR_LEN(eval_result), new_len);
 			if (new_len >= alloc_len) {
-				alloc_len = zend_safe_address_guarded(2, new_len, 0);
-				if (UNEXPECTED(alloc_len > ZSTR_MAX_LEN)) {
-					zend_throw_error(NULL, "String size overflow");
-					if (result != NULL) {
-						zend_string_release_ex(result, 0);
-						result = NULL;
-					}
-					break;
-				}
+				alloc_len = zend_safe_string_address_guarded(2, new_len, 0);
 				if (result == NULL) {
 					result = zend_string_alloc(alloc_len, 0);
 				} else {