Negative size parameter in mb_split

How it was found

https://bugs.php.net/bug.php?id=77367

mb_split doesn't correctly detect the length when the $string has an unfinished multibyte character at the end of the string. This causes a crash due to a negative parameter to add_next_index_stringl, which calls zend_string_init and memcpy.

Could reproduce on master.

Impact

This could be used to cause memory corruption/leakage.