[php-src] Issue #13123: Segfault in mb_fast_convert() when mbstring.encoding_translation is enabled

Issue: https://github.com/php/php-src/issues/13123 Author: tstangner ### Description Current versions of PHP 8.3 and 8.2 will segfault when mbstring.encoding_translation is enabled, mbstring.http_input is set to pass and multipart/form-encoded POST data input is received/encountered. Steps to reproduce: - Start PHP CLI in web server listening mode: ``` cd /tmp && echo '<?php ' > index.php; php -dmbstring.internal_encoding=UTF-8 -dmbstring.encoding_translation=On -dmbstring.http_input=pass -dmbstring.http_output=UTF-8 -S 127.0.0.1:7777 ``` - Connect to the PHP webserver and issue a multipart/form-encoded POST request (e.g. via curl): ``` curl -F 'test=test' -F 'test2=test2' http://127.0.0.1:7777 ``` This will result in a segmentation fault of the PHP process: ``` PHP compiled with build ID=API20230831,NTS,debug [Wed Jan 10 20:39:40 2024] PHP 8.3.1 Development Server (http://127.0.0.1:7777) started [Wed Jan 10 20:39:42 2024] 127.0.0.1:47288 Accepted Segmentation fault ``` A GDB backtrace is attached and shows that the segfault occurs in mbstrings' mb_fast_convert(): https://github.com/php/php-src/blob/fc16285538e96ecb35d017231051f83dcbd8b55b/ext/mbstring/libmbfl/mbfl/mbfl_convert.c#L339 A quick debugging reveals that mbfl_encoding_pass gets passed as from parameter to mb_fast_convert(). Code in mb_fast_convert() then tries to call from->to_wchar, which is defined as NULL in mbfl_encoding_pass: ``` const mbfl_encoding mbfl_encoding_pass = { mbfl_no_encoding_pass, "pass", NULL, mbfl_encoding_pass_aliases, NULL, 0, NULL, NULL, NULL, NULL, NULL }; ``` This in turn leads to the segementation fault. This bug is present in PHP 8.2 and 8.3, but not in PHP 8.1 and prior. [php83_segfault_gdb.txt](https://github.com/php/php-src/files/13892097/php83_segfault_gdb.txt) ### PHP Version PHP 8.3.1 ### Operating System Debian Linux 12