@@ -2770,7 +2770,8 @@ ZEND_API size_t ZEND_FASTCALL _zend_mm_block_size(zend_mm_heap *heap, void *ptr
27702770
27712771typedef struct _zend_alloc_globals {
27722772 zend_mm_heap * mm_heap ;
2773- uint32_t use_userinput_zone ;
2773+ uint32_t userinput_zone_activated ; /* Whether the userinput zone is currently active */
2774+ bool enable_userinput_isolation ; /* Whether to switch to the userinput zone before handling user inputs */
27742775} zend_alloc_globals ;
27752776
27762777#ifdef ZTS
@@ -2841,25 +2842,34 @@ ZEND_API bool is_zend_ptr(const void *ptr)
28412842ZEND_API void zend_mm_userinput_begin (void )
28422843{
28432844#if ZEND_MM_HEAP_PROTECTION
2844- AG (use_userinput_zone )++ ;
2845- AG (mm_heap )-> zone_free_slot = ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_USERINPUT );
2845+ if (AG (enable_userinput_isolation )) {
2846+ AG (userinput_zone_activated )++ ;
2847+ AG (mm_heap )-> zone_free_slot = ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_USERINPUT );
2848+ }
28462849#endif
28472850}
28482851
28492852ZEND_API void zend_mm_userinput_end (void )
28502853{
28512854#if ZEND_MM_HEAP_PROTECTION
2852- AG (use_userinput_zone )-- ;
2853- if (!AG (use_userinput_zone )) {
2854- AG (mm_heap )-> zone_free_slot = ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_DEFAULT );
2855+ if (AG (enable_userinput_isolation )) {
2856+ AG (userinput_zone_activated )-- ;
2857+ if (!AG (userinput_zone_activated )) {
2858+ AG (mm_heap )-> zone_free_slot = ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_DEFAULT );
2859+ }
28552860 }
28562861#endif
28572862}
28582863
28592864ZEND_API void zend_mm_check_in_userinput (void )
28602865{
28612866#if ZEND_MM_HEAP_PROTECTION
2862- ZEND_ASSERT (AG (use_userinput_zone ));
2867+ if (AG (enable_userinput_isolation )) {
2868+ ZEND_ASSERT (AG (userinput_zone_activated ));
2869+ ZEND_ASSERT (AG (mm_heap )-> zone_free_slot == ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_USERINPUT ));
2870+ } else {
2871+ ZEND_ASSERT (AG (mm_heap )-> zone_free_slot == ZEND_MM_ZONE_FREE_SLOT (AG (mm_heap ), ZEND_MM_ZONE_DEFAULT ));
2872+ }
28632873#endif
28642874}
28652875
@@ -3160,9 +3170,11 @@ ZEND_API void shutdown_memory_manager(bool silent, bool full_shutdown)
31603170 zend_mm_shutdown (AG (mm_heap ), full_shutdown , silent );
31613171
31623172 if (!full_shutdown ) {
3163- ZEND_ASSERT (AG (use_userinput_zone ) == 0 || silent );
3164- AG (use_userinput_zone ) = 0 ;
3165- zend_mm_userinput_begin ();
3173+ if (AG (enable_userinput_isolation )) {
3174+ ZEND_ASSERT (AG (userinput_zone_activated ) == 0 || silent );
3175+ AG (userinput_zone_activated ) = 0 ;
3176+ zend_mm_userinput_begin ();
3177+ }
31663178 }
31673179}
31683180
@@ -3477,7 +3489,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
34773489{
34783490 char * tmp ;
34793491
3480- alloc_globals -> use_userinput_zone = 0 ;
3492+ tmp = getenv ("ZEND_MM_USERINPUT_ISOLATION" );
3493+ alloc_globals -> enable_userinput_isolation = !(tmp && !ZEND_ATOL (tmp ));
3494+ alloc_globals -> userinput_zone_activated = 0 ;
34813495
34823496#if ZEND_MM_CUSTOM
34833497 tmp = getenv ("USE_ZEND_ALLOC" );
0 commit comments