Fix

Author: danog

Zend/zend_alloc.c

@@ -174,7 +174,7 @@ static size_t _real_page_size = ZEND_MM_PAGE_SIZE;
 #ifdef __SANITIZE_ADDRESS__
 # include <sanitizer/asan_interface.h>
 
-#if 1
+#if 0
 
 #define ZEND_MM_POISON_DEBUG(_type, _ptr, _size) do { \
 	fprintf(stderr, "%s %p - %p in %d\n", (_type), (_ptr), (void*) (((size_t)_ptr)+((size_t)_size)), __LINE__); \
@@ -1271,7 +1271,15 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 				heap->last_chunks_delete_count++;
 			}
 		}
+
+		if (heap->cached_chunks) {
+			ZEND_MM_UNPOISON_CHUNK_HDR(heap->cached_chunks);
+		}
+
 		if (!heap->cached_chunks || chunk->num > heap->cached_chunks->num) {
+			if (heap->cached_chunks) {
+				ZEND_MM_POISON_CHUNK_HDR(heap->cached_chunks, heap);
+			}
 			zend_mm_chunk_free(heap, chunk, ZEND_MM_CHUNK_SIZE);
 		} else {
 //TODO: select the best chunk to delete???
@@ -1296,11 +1304,12 @@ static zend_always_inline void zend_mm_free_pages_ex(zend_mm_heap *heap, zend_mm
 		chunk->free_tail = page_num;
 	}
 	bool should_free = free_chunk && chunk != heap->main_chunk && chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE;
-	ZEND_MM_POISON_CHUNK_HDR(chunk, heap);
 	ZEND_MM_POISON(ZEND_MM_PAGE_ADDR(chunk, page_num), pages_count * ZEND_MM_PAGE_SIZE);
 
 	if (should_free) {
 		zend_mm_delete_chunk(heap, chunk);
+	} else {
+		ZEND_MM_POISON_CHUNK_HDR(chunk, heap);
 	}
 }