[GIT-PULLS] [php-src] PR #22778: ext/dba: bound CDB record lengths against the file size

Pull Request: https://github.com/php/php-src/pull/22778
Author: iliaal

The cdb handler read the 32-bit key and data length fields from the file and passed them directly to zend_string_alloc(). On 32-bit a length near UINT32_MAX wraps the struct size to a few bytes while the following read copies the trailing file bytes past that allocation, a heap overflow reachable by opening a crafted .cdb (64-bit only OOMs). Capture the file size at open and reject any record length that exceeds it, in firstkey, nextkey and fetch. Reproducer: a 2048-byte header with a first-record key length of 0xFFFFFFFF plus trailing bytes segfaults dba_firstkey() on 32-bit.