[php-src] PR #24014: zend_alloc: move a small block shrunk to the size of the bin below

From: Date: Wed, 30 Sep 2026 11:53:43 +0000
Subject: [php-src] PR #24014: zend_alloc: move a small block shrunk to the size of the bin below
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-38979@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24014 Author: marc-mabe Reallocating a small block to exactly the size of the bin below kept it in place, in its bin. efree_size() with that size then frees it into the bin below: heap->size is decreased by too little, and the slot of a run of the larger bin ends up on the free list of the smaller one. The next zend_mm_gc() counts that slot for the smaller bin and stores the run in the page map with the number of the smaller bin, so the run's remaining blocks are then freed and its pages released with the wrong layout. Truncate when the size fits the bin below, so the block lives in the bin its size maps to. This costs no instruction; it only turns a realloc to exactly the smaller bin size from in place into a copy. The test uses a new zend_test function, zend_test_erealloc_block_size(), to compare the block size after erealloc() with that of a fresh allocation of the same size. I couldn't find an actualler caller to hit the case. It needs efree_size() with a constant size after an in-place erealloc(), and later a zend_mm_gc().

« previous php.git-pulls (#38979) next »