Fix GH-24489: Restore mbstring buffer growth fix lost in merge

Author: lazerg

ext/mbstring/libmbfl/mbfl/mbfl_encoding.h

@@ -170,6 +170,9 @@ static inline zend_result mb_convert_buf_ensure(mb_convert_buf *buf, unsigned ch
 		size_t newsize = oldsize + MAX(oldsize >> 1, needed);
 		zend_string *newstr = safe_ferealloc((buf)->str, 1, newsize, _ZSTR_STRUCT_SIZE(0), /* fallible */ true);
 		if (!newstr) {
+			/* An earlier growth may have moved the buffer. */
+			buf->out = *out;
+			buf->limit = *limit;
 			return FAILURE;
 		}
 		*out = (unsigned char*)ZSTR_VAL(newstr) + (*out - (unsigned char*)ZSTR_VAL((buf)->str));

ext/mbstring/tests/oom_buf_growth.phpt

@@ -0,0 +1,17 @@
+--TEST--
+mbstring stores conversion-buffer pointers when growth fails
+--EXTENSIONS--
+mbstring
+--INI--
+memory_limit=8M
+--FILE--
+<?php
+// A single batch expands from 128 to 384 bytes, requiring two buffer growths.
+$input = str_repeat("\x80", 128);
+// The tracked allocator leaves enough space for the first growth, but not the second.
+$padding = str_repeat('a', 8 * 1024 * 1024 - memory_get_usage() - 384);
+mb_substr_count($input, 'Z', 'CP1252');
+echo "not reached\n";
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 8388608 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d