Introduce a checked version of zend_string_alloc()
Introduce a checked version of zend_string_alloc()

PHP <= 7.2.5 doesn't check for overflow before rounding the allocated
string size.

As a result, allocating a string of size >= SIZE_MAX - 18 actually
only reserves 0, 4, 8, 12 or 16 bytes and returns a valid pointer
instead of an OOM.

Hopefully the same nasty bug isn't present in other PHP memory
allocation functions.

paragonie/libsodium-php,paragonie/libsodium-php,jedisct1/libsodium-php,jedisct1/libsodium-php,jedisct1/libsodium-php,paragonie/libsodium-php