@@ -2824,7 +2824,7 @@ ZEND_API void* ZEND_FASTCALL _zend_mm_alloc(zend_mm_heap *heap, size_t size ZEND
2824
2824
ZEND_MM_UNPOISON_HEAP (heap );
2825
2825
void * ptr = zend_mm_alloc_heap (heap , size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC );
2826
2826
if (EXPECTED (ptr )) {
2827
- ZEND_MM_UNPOISON (ret , size );
2827
+ ZEND_MM_UNPOISON (ptr , size );
2828
2828
}
2829
2829
ZEND_MM_POISON_HEAP (heap );
2830
2830
return ptr ;
@@ -2984,7 +2984,9 @@ ZEND_API bool is_zend_ptr(const void *ptr)
2984
2984
ZEND_MM_UNPOISON_HEAP(AG(mm_heap)); \
2985
2985
ZEND_MM_CUSTOM_ALLOCATOR(_size); \
2986
2986
if (_size < _min_size) { \
2987
- return _emalloc_ ## _min_size(); \
2987
+ void *ret = _emalloc_ ## _min_size(); \
2988
+ ZEND_MM_POISON_HEAP(AG(mm_heap)); \
2989
+ return ret; \
2988
2990
} \
2989
2991
void *ptr = zend_mm_alloc_small(AG(mm_heap), _num ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC); \
2990
2992
ZEND_MM_POISON_HEAP(AG(mm_heap)); \
@@ -3081,8 +3083,6 @@ ZEND_API void ZEND_FASTCALL _efree_large(void *ptr, size_t size)
3081
3083
ZEND_MM_UNPOISON_HEAP (AG (mm_heap ));
3082
3084
zend_mm_free_large (AG (mm_heap ), chunk , page_num , pages_count );
3083
3085
ZEND_MM_POISON_HEAP (AG (mm_heap ));
3084
-
3085
- ZEND_MM_POISON_HEAP (AG (mm_heap ));
3086
3086
}
3087
3087
}
3088
3088
@@ -3107,7 +3107,7 @@ ZEND_API void* ZEND_FASTCALL _emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI
3107
3107
#endif
3108
3108
void * ptr = zend_mm_alloc_heap (AG (mm_heap ), size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC );
3109
3109
if (EXPECTED (ptr )) {
3110
- ZEND_MM_UNPOISON (ret , size );
3110
+ ZEND_MM_UNPOISON (ptr , size );
3111
3111
}
3112
3112
ZEND_MM_POISON_HEAP (AG (mm_heap ));
3113
3113
return ptr ;
@@ -3259,8 +3259,10 @@ ZEND_API zend_result zend_set_memory_limit(size_t memory_limit)
3259
3259
heap -> cached_chunks_count -- ;
3260
3260
heap -> real_size -= ZEND_MM_CHUNK_SIZE ;
3261
3261
} while (memory_limit < heap -> real_size );
3262
+ ZEND_MM_POISON_HEAP (AG (mm_heap ));
3262
3263
return SUCCESS ;
3263
3264
}
3265
+ ZEND_MM_POISON_HEAP (AG (mm_heap ));
3264
3266
return FAILURE ;
3265
3267
}
3266
3268
AG (mm_heap )-> limit = memory_limit ;
0 commit comments