diff --git a/NEWS b/NEWS index 0a9f3bf6996..348e58cc10f 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,7 @@ PHP NEWS - Core: . Fixed bug GH-16344 (setRawValueWithoutLazyInitialization() and skipLazyInitialization() may change initialized proxy). (Arnaud) + . Fix is_zend_ptr() huge block comparison. (nielsdos) - DOM: . Fixed bug GH-16906 (Reloading document can cause UAF in iterator). diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c index 2c8023e6257..12e322d0347 100644 --- a/Zend/zend_alloc.c +++ b/Zend/zend_alloc.c @@ -2617,8 +2617,8 @@ ZEND_API bool is_zend_ptr(const void *ptr) zend_mm_huge_list *block = AG(mm_heap)->huge_list; while (block) { - if (ptr >= (void*)block - && ptr < (void*)((char*)block + block->size)) { + if (ptr >= block->ptr + && ptr < (void*)((char*)block->ptr + block->size)) { return 1; } block = block->next;