[php-src] PR #23773: Bound the LRUN page count in the zend_mm_gc() page scan (Zend/zend_al…

Pull Request: https://github.com/php/php-src/pull/23773 Author: jvoisin …loc.c) The final loop of zend_mm_gc() walks the pages of each chunk, and dispatches on the page map entry to decide how far to advance: if (info & ZEND_MM_IS_SRUN) { ... i += bin_pages[bin_num]; } else /* if (info & ZEND_MM_IS_LRUN) */ { i += ZEND_MM_LRUN_PAGES(info); } This is the same "reach the large-run case by elimination" pattern that 0c87849da5a promoted to a real check in zend_mm_free_heap(), zend_mm_size() and zend_mm_realloc_heap(), except this one was left behind. Promote the comment to a ZEND_MM_CHECK() that requires both the ZEND_MM_IS_LRUN bit and a non-zero page count before advancing, which guarantees forward progress and only fires on a corrupted heap. It costs a test and a branch.