Fix #74604: Out of bounds in php_pcre_replace_impl

[cmb69]

Trying to allocate a zend_string with a length only slighty smaller
than SIZE_MAX causes an integer overflow; we need to ensure this does
not happen, and throw an Error instead.

[cmb69]

If there are no objections, I'll merge this by the end of the week.

[cmb69]

@dstogov, what do you think about this PR?

[dstogov]

I think this may be fixed in a simpler way:

- alloc_len = zend_safe_address_guarded(2, new_len, 0);
+ alloc_len = zend_safe_address_guarded(2, new_len, _ZSTR_HEADER_SIZE) - _ZSTR_HEADER_SIZE;

- new_len = zend_safe_address_guarded(1, ZSTR_LEN(eval_result), new_len);
+ new_len = zend_safe_address_guarded(1, ZSTR_LEN(eval_result) + _ZSTR_HEADER_SIZE, new_len) - _ZSTR_HEADER_SIZE;

I didn't test this.

[cmb69]

Thank you! I'll have a closer look.

[cmb69]

@dstogov, _ZSTR_HEADER_SIZE doesn't seem to be quite right, due to the trailing NUL byte and the alignment. I've used ZEND_MM_ALIGNED_SIZE(_ZSTR_HEADER_SIZE + 1) and added a macro for that.

[dstogov]

I think, this is fine now.