diff --git a/NEWS b/NEWS index babea324fe8..a8428f0099e 100644 --- a/NEWS +++ b/NEWS @@ -14,6 +14,7 @@ PHP NEWS (nielsdos) . Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs). (nielsdos) + . Fix is_zend_ptr() huge block comparison. (nielsdos) - Curl: . Fixed bug GH-16802 (open_basedir bypass using curl extension). (nielsdos) diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c index 50f1bbbb69c..d531270d445 100644 --- a/Zend/zend_alloc.c +++ b/Zend/zend_alloc.c @@ -2471,8 +2471,8 @@ ZEND_API bool is_zend_ptr(const void *ptr) zend_mm_huge_list *block = AG(mm_heap)->huge_list; while (block) { - if (ptr >= (void*)block - && ptr < (void*)((char*)block + block->size)) { + if (ptr >= block->ptr + && ptr < (void*)((char*)block->ptr + block->size)) { return 1; } block = block->next;