Unpoison custom chunk_alloc as well

Author: danog

Zend/zend_alloc.c

@@ -949,6 +949,7 @@ static void zend_mm_chunk_free(zend_mm_heap *heap, void *addr, size_t size)
 {
 #if ZEND_MM_STORAGE
 	if (UNEXPECTED(heap->storage)) {
+		ZEND_MM_UNPOISON(addr, size);
 		heap->storage->handlers.chunk_free(heap->storage, addr, size);
 		return;
 	}
@@ -961,6 +962,7 @@ static int zend_mm_chunk_truncate(zend_mm_heap *heap, void *addr, size_t old_siz
 #if ZEND_MM_STORAGE
 	if (UNEXPECTED(heap->storage)) {
 		if (heap->storage->handlers.chunk_truncate) {
+			ZEND_MM_UNPOISON((char*)addr + new_size, old_size - new_size);
 			return heap->storage->handlers.chunk_truncate(heap->storage, addr, old_size, new_size);
 		} else {
 			return 0;
@@ -1041,7 +1043,7 @@ static void zend_mm_change_huge_block_size(zend_mm_heap *heap, void *ptr, size_t
 /* Large Runs */
 /**************/
 
-static size_t zend_mm_gc_real(zend_mm_heap *heap);
+static size_t _zend_mm_gc(zend_mm_heap *heap);
 
 #if ZEND_DEBUG
 static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
@@ -1180,7 +1182,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
 			} else {
 #if ZEND_MM_LIMIT
 				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
-					if (zend_mm_gc_real(heap)) {
+					if (_zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1197,7 +1199,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
 				chunk = (zend_mm_chunk*)zend_mm_chunk_alloc(heap, ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE);
 				if (UNEXPECTED(chunk == NULL)) {
 					/* insufficient memory */
-					if (zend_mm_gc_real(heap) &&
+					if (_zend_mm_gc(heap) &&
 					    (chunk = (zend_mm_chunk*)zend_mm_chunk_alloc(heap, ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE)) != NULL) {
 						/* pass */
 					} else {
@@ -1873,7 +1875,7 @@ static zend_never_inline void *zend_mm_realloc_huge(zend_mm_heap *heap, void *pt
 		} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
 			if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
-				if (zend_mm_gc_real(heap) && new_size - old_size <= heap->limit - heap->real_size) {
+				if (_zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
 					/* pass */
 				} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -2216,7 +2218,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 
 #if ZEND_MM_LIMIT
 	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
-		if (zend_mm_gc_real(heap) && new_size <= heap->limit - heap->real_size) {
+		if (_zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -2231,7 +2233,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	ptr = zend_mm_chunk_alloc(heap, new_size, ZEND_MM_CHUNK_SIZE);
 	if (UNEXPECTED(ptr == NULL)) {
 		/* insufficient memory */
-		if (zend_mm_gc_real(heap) &&
+		if (_zend_mm_gc(heap) &&
 		    (ptr = zend_mm_chunk_alloc(heap, new_size, ZEND_MM_CHUNK_SIZE)) != NULL) {
 			/* pass */
 		} else {
@@ -2354,7 +2356,7 @@ static zend_mm_heap *zend_mm_init(void)
 	return heap;
 }
 
-static size_t zend_mm_gc_real(zend_mm_heap *heap)
+static size_t _zend_mm_gc(zend_mm_heap *heap)
 {
 	zend_mm_free_slot *p, *q;
 	zend_mm_chunk *chunk;
@@ -2500,7 +2502,7 @@ static size_t zend_mm_gc_real(zend_mm_heap *heap)
 ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 {
 	ZEND_MM_UNPOISON_HEAP(heap);
-	size_t ret = zend_mm_gc_real(heap);
+	size_t ret = _zend_mm_gc(heap);
 	ZEND_MM_POISON_HEAP(heap);
 	return ret;
 }
@@ -3610,7 +3612,7 @@ static size_t poison_gc(void)
 	_zend_mm_get_custom_handlers_ex(heap, &_malloc, &_free, &_realloc, &_gc, &_shutdown);
 	_zend_mm_set_custom_handlers_ex(heap, NULL, NULL, NULL, NULL, NULL);
 
-	size_t collected = zend_mm_gc_real(heap);
+	size_t collected = _zend_mm_gc(heap);
 
 	_zend_mm_set_custom_handlers_ex(heap, _malloc, _free, _realloc, _gc, _shutdown);