[php-src] PR #24473: Zend: Add opt-in request-scoped allocation no-reuse mode

From: Date: Wed, 21 Oct 2026 10:03:10 +0000
Subject: [php-src] PR #24473: Zend: Add opt-in request-scoped allocation no-reuse mode
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39652@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24473 Author: jvoisin Enable with ZEND_MM_NO_REUSE=1 before engine startup. Clear and retain freed small allocations, page runs, and huge mappings until heap shutdown. Move reallocations to fresh storage and prevent allocator GC from reclaiming retired ranges. Keep retained mappings charged against memory_limit and reject incompatible allocator overrides rather than silently allowing reuse. This mitigates UAF exploitation through allocation reclamation like CVE-2026-109618 and CVE-2026-109619, at the cost of memory usage approaching cumulative allocation volume per request. Add tests for address non-overlap, clearing, reallocations, shutdown, accounting, and configuration errors. Document usage and limitations. This provides a nice alternative to #14304.

« previous php.git-pulls (#39652) next »