From 07337df1d74e2e0dafc89d387653cf52da4604b7 Mon Sep 17 00:00:00 2001 From: Julien Voisin Date: Tue, 23 Apr 2024 09:50:24 +0000 Subject: [PATCH] Add two checks for zend_mm_heap's integrity (#13943) --- Zend/zend_alloc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c index 09d161e62c1..f92458328de 100644 --- a/Zend/zend_alloc.c +++ b/Zend/zend_alloc.c @@ -1065,6 +1065,9 @@ get_chunk: found: if (steps > 2 && pages_count < 8) { + ZEND_MM_CHECK(chunk->next->prev == chunk, "zend_mm_heap corrupted"); + ZEND_MM_CHECK(chunk->prev->next == chunk, "zend_mm_heap corrupted"); + /* move chunk into the head of the linked-list */ chunk->prev->next = chunk->next; chunk->next->prev = chunk->prev; @@ -1116,6 +1119,9 @@ static zend_never_inline void *zend_mm_alloc_large(zend_mm_heap *heap, size_t si static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_chunk *chunk) { + ZEND_MM_CHECK(chunk->next->prev == chunk, "zend_mm_heap corrupted"); + ZEND_MM_CHECK(chunk->prev->next == chunk, "zend_mm_heap corrupted"); + chunk->next->prev = chunk->prev; chunk->prev->next = chunk->next; heap->chunks_count--;