Fixup

Author: danog

Zend/zend_alloc.c

@@ -1528,9 +1528,21 @@ static zend_always_inline zend_mm_free_slot *zend_mm_get_next_free_slot(zend_mm_
 
 #else /* ZEND_MM_HEAP_PROTECTION */
 # define zend_mm_set_next_free_slot(heap, bin_num, slot, next) do { \
-		(slot)->next_free_slot = (next);                            \
+		ZEND_MM_UNPOISON(slot, sizeof(zend_mm_free_slot*)); \
+		(slot)->next_free_slot = (next); \
+		ZEND_MM_POISON(slot, sizeof(zend_mm_free_slot*)); \
 	} while (0)
-# define zend_mm_get_next_free_slot(heap, bin_num, slot) (slot)->next_free_slot
+
+static zend_always_inline zend_mm_free_slot *zend_mm_get_next_free_slot(zend_mm_heap *heap, uint32_t bin_num, zend_mm_free_slot* slot)
+{
+	ZEND_MM_UNPOISON(slot, sizeof(zend_mm_free_slot*));
+
+	zend_mm_free_slot *next = slot->next_free_slot;
+
+	ZEND_MM_POISON(slot, sizeof(zend_mm_free_slot*));
+
+	return (zend_mm_free_slot*)next;
+}
 #endif /* ZEND_MM_HEAP_PROTECTION */
 
 static zend_never_inline void *zend_mm_alloc_small_slow(zend_mm_heap *heap, uint32_t bin_num ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)