[php-src] PR #23361: Randomize the layout of zend_mm small freelists

Pull Request: https://github.com/php/php-src/pull/23361 Author: jvoisin zend_mm_alloc_small_slow() carved a fresh bin into a freelist ordered by ascending address and returned the first element, so the address of every small allocation was entirely determined by the allocation sequence: the n-th allocation of a given size class always landed at bin + n*slot_size, and two consecutive allocations were always adjacent. That determinism is what makes heap feng-shui reliable. An attacker who can drive a few allocations of the right size class knows exactly where the next one lands, and can therefore place a victim object immediately after a buffer he can overflow, or reclaim a specific freed slot with an object of a chosen type. Shuffle the slot order when a bin is created: hand out the first slot of the shuffled sequence and link the remaining ones in that order. This is the ~equivalent of Linux' SLAB_FREELIST_RANDOM. Performance-wise, it: - Adds two scratch arrays of ZEND_MM_MAX_BIN_ELEMENTS entries (4KiB total) live on the stack of a non-recursive slow path. - Adds a per-bin-creation shuffleing, on the slow path. - Reduces spatial locality of allocations, but Zend/bench.php shows no measurable difference. Can be compiled out with -DZEND_MM_FREELIST_RANDOM=0.