@@ -2824,7 +2824,7 @@ ZEND_API void* ZEND_FASTCALL _zend_mm_alloc(zend_mm_heap *heap, size_t size ZEND
28242824 ZEND_MM_UNPOISON_HEAP (heap );
28252825 void * ptr = zend_mm_alloc_heap (heap , size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC );
28262826 if (EXPECTED (ptr )) {
2827- ZEND_MM_UNPOISON (ret , size );
2827+ ZEND_MM_UNPOISON (ptr , size );
28282828 }
28292829 ZEND_MM_POISON_HEAP (heap );
28302830 return ptr ;
@@ -2984,7 +2984,9 @@ ZEND_API bool is_zend_ptr(const void *ptr)
29842984 ZEND_MM_UNPOISON_HEAP(AG(mm_heap)); \
29852985 ZEND_MM_CUSTOM_ALLOCATOR(_size); \
29862986 if (_size < _min_size) { \
2987- return _emalloc_ ## _min_size(); \
2987+ void *ret = _emalloc_ ## _min_size(); \
2988+ ZEND_MM_POISON_HEAP(AG(mm_heap)); \
2989+ return ret; \
29882990 } \
29892991 void *ptr = zend_mm_alloc_small(AG(mm_heap), _num ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
29902992 ZEND_MM_POISON_HEAP(AG(mm_heap)); \
@@ -3081,8 +3083,6 @@ ZEND_API void ZEND_FASTCALL _efree_large(void *ptr, size_t size)
30813083 ZEND_MM_UNPOISON_HEAP (AG (mm_heap ));
30823084 zend_mm_free_large (AG (mm_heap ), chunk , page_num , pages_count );
30833085 ZEND_MM_POISON_HEAP (AG (mm_heap ));
3084-
3085- ZEND_MM_POISON_HEAP (AG (mm_heap ));
30863086 }
30873087}
30883088
@@ -3107,7 +3107,7 @@ ZEND_API void* ZEND_FASTCALL _emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI
31073107#endif
31083108 void * ptr = zend_mm_alloc_heap (AG (mm_heap ), size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC );
31093109 if (EXPECTED (ptr )) {
3110- ZEND_MM_UNPOISON (ret , size );
3110+ ZEND_MM_UNPOISON (ptr , size );
31113111 }
31123112 ZEND_MM_POISON_HEAP (AG (mm_heap ));
31133113 return ptr ;
@@ -3259,8 +3259,10 @@ ZEND_API zend_result zend_set_memory_limit(size_t memory_limit)
32593259 heap -> cached_chunks_count -- ;
32603260 heap -> real_size -= ZEND_MM_CHUNK_SIZE ;
32613261 } while (memory_limit < heap -> real_size );
3262+ ZEND_MM_POISON_HEAP (AG (mm_heap ));
32623263 return SUCCESS ;
32633264 }
3265+ ZEND_MM_POISON_HEAP (AG (mm_heap ));
32643266 return FAILURE ;
32653267 }
32663268 AG (mm_heap )-> limit = memory_limit ;
0 commit comments