Description:
------------
There are a NULL pointer dereference in mb_parse_str. If the num of elements is large, will be not enough space for ecalloc function. So the ecalloc will fail and val_list will be null.

227		val_list = (char **)ecalloc(num, sizeof(char *));

After that, the reference to val_list will cause program to crash.

Test script:
---------------
<?php

ini_set('memory_limit', -1);

$str = "email=kehaovista@qq.com&city=shanghai&job=Phper".str_repeat('&a', 0xffffffff/8);

mb_parse_str($str, $result);

?>

Expected result:
----------------
No Crash

Actual result:
--------------
Starting program: /home/minhrau/php-src/sapi/cli/php ~/phptestcase/testmb_parse_str.php
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".

Breakpoint 3, zend_parse_parameters (num_args=2, type_spec=0x10afdf5 "SS") at /home/minhrau/php-src/Zend/zend_API.c:957
957		int flags = 0;
(gdb) c
Continuing.

Breakpoint 3, zend_parse_parameters (num_args=2, type_spec=0x10c1012 "Sl") at /home/minhrau/php-src/Zend/zend_API.c:957
957		int flags = 0;
(gdb) c
Continuing.

Breakpoint 3, zend_parse_parameters (num_args=2, type_spec=0x107c02d "s|z/") at /home/minhrau/php-src/Zend/zend_API.c:957
957		int flags = 0;
(gdb) c
Continuing.

Breakpoint 4, zif_mb_parse_str (execute_data=0x7ffff0284100, return_value=0x7fffffffa8d0) at /home/minhrau/php-src/ext/mbstring/mbstring.c:2116
2116		if (track_vars_array != NULL) {
(gdb) c
Continuing.

Breakpoint 5, _php_mb_encoding_handler_ex (info=0x7fffffffa850, arg=0x1637a38, res=0x7fffb0283010 "email=kehaovista@qq.com&city=shanghai&job=Phper&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&a&"...) at /home/minhrau/php-src/ext/mbstring/mb_gpc.c:227
227		val_list = (char **)ecalloc(num, sizeof(char *));
(gdb) p num
$5 = 1073741828
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x000000000070a257 in _php_mb_encoding_handler_ex (info=0x7fffffffa850, arg=0x1637a38, res=0x7fffb0283010 "email") at /home/minhrau/php-src/ext/mbstring/mb_gpc.c:237
237				len_list[n] = php_url_decode(var, val-var);
(gdb) list
232		strtok_buf = NULL;
233		var = php_strtok_r(res, info->separator, &strtok_buf);
234		while (var)  {
235			val = strchr(var, '=');
236			if (val) { /* have a value */
237				len_list[n] = php_url_decode(var, val-var);
238				val_list[n] = var;
239				n++;
240	
241				*val++ = '\0';
(gdb)