ext/mbstring: assert that mb_wchar_to_uuencode() pointer write is in bounds (#23955)

Add a hardening assertion that when `mb_wchar_to_uuencode()` needs to update
the length of the previous line, the location being written to is still part of
the same overall output string (i.e. at or after the start of the buffer's
`str`'s value pointer, and before the end of the char array).

Author: DanielEScherzer

ext/mbstring/libmbfl/filters/mbfilter_uuencode.c

@@ -287,6 +287,9 @@ static void mb_wchar_to_uuencode(uint32_t *in, size_t len, mb_convert_buf *buf,
 		if (n_cached_bits) {
 			len_byte -= (n_cached_bits == 2) ? 1 : 2;
 		}
+		/* The byte we are writing to must be part of the same buffer */
+		ZEND_ASSERT(len_byte >= (unsigned char *)ZSTR_VAL(buf->str));
+		ZEND_ASSERT(len_byte < limit);
 		*len_byte = MIN(bytes_encoded + len + (n_cached_bits ? (n_cached_bits == 2 ? 1 : 2) : 0), 45) + 32;
 
 		if (n_cached_bits) {