Merge branch 'PHP-8.5' into PHP-8.6

* PHP-8.5:
  zend_alloc: move a small block shrunk to the size of the bin below

Author: ndossche

NEWS

@@ -7,6 +7,9 @@ PHP                                                                        NEWS
     in its previous chain. (Edmond)
   . Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an
     enclosing function). (ndossche)
+  . Fixed memory manager keeping a block reallocated to exactly the size of
+    the next smaller bin in its larger bin, which efree_size() then freed
+    into the wrong one. (Marc Bennewitz)
 
 - Opcache:
   . Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a

Zend/tests/zend_alloc_realloc_shrink_boundary.phpt

@@ -0,0 +1,40 @@
+--TEST--
+erealloc() of a small block keeps it in the bin its new size maps to
+--EXTENSIONS--
+zend_test
+--SKIPIF--
+<?php
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip requires zmm");
+?>
+--FILE--
+<?php
+
+// The largest request of each small bin, found from fresh allocations.
+$largest = [];
+for ($n = 1; $n <= 3072; $n++) {
+    [, $block] = zend_test_erealloc_block_size($n, $n);
+    if ($block > 3072) {
+        break;
+    }
+    $largest[$block] = $n;
+}
+var_dump(count($largest) > 20);
+
+// Shrink a block of each bin to every smaller size, down to the size of the
+// bin below, which efree_size() maps to that bin.
+$mismatches = [];
+foreach ($largest as $old_size) {
+    for ($new_size = 1; $new_size < $old_size; $new_size++) {
+        [$block, $fresh] = zend_test_erealloc_block_size($old_size, $new_size);
+        if ($block !== $fresh) {
+            $mismatches[] = "$old_size -> $new_size: block of $block, expected $fresh";
+        }
+    }
+}
+var_dump(array_slice($mismatches, 0, 5));
+
+?>
+--EXPECT--
+bool(true)
+array(0) {
+}

Zend/zend_alloc.c

@@ -1786,8 +1786,9 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
 
 				/* Check if requested size fits into current bin */
 				if (size <= old_size) {
-					/* Check if truncation is necessary */
-					if (old_bin_num > 0 && size < bin_data_size[old_bin_num - 1]) {
+					/* Check if truncation is necessary. A size that fits the
+					 * bin below moves there, as efree_size() maps it to that bin. */
+					if (old_bin_num > 0 && size <= bin_data_size[old_bin_num - 1]) {
 						/* truncation */
 						ret = zend_mm_alloc_small(heap, ZEND_MM_SMALL_SIZE_TO_BIN(size) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 						copy_size = use_copy_size ? MIN(size, copy_size) : size;

ext/zend_test/test.c

@@ -197,6 +197,37 @@ static ZEND_FUNCTION(zend_leak_bytes)
 	emalloc(leakbytes);
 }
 
+/* Reallocate a block of old_size bytes to new_size bytes and return its block
+ * size, along with the block size of a fresh allocation of new_size bytes. */
+static ZEND_FUNCTION(zend_test_erealloc_block_size)
+{
+	zend_long old_size, new_size;
+
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_LONG(old_size)
+		Z_PARAM_LONG(new_size)
+	ZEND_PARSE_PARAMETERS_END();
+
+	if (old_size < 1) {
+		zend_argument_value_error(1, "must be greater than 0");
+		RETURN_THROWS();
+	}
+	if (new_size < 1) {
+		zend_argument_value_error(2, "must be greater than 0");
+		RETURN_THROWS();
+	}
+
+	void *ptr = erealloc(emalloc(old_size), new_size);
+	void *fresh = emalloc(new_size);
+
+	array_init(return_value);
+	add_next_index_long(return_value, zend_mem_block_size(ptr));
+	add_next_index_long(return_value, zend_mem_block_size(fresh));
+
+	efree(fresh);
+	efree(ptr);
+}
+
 /* Leak a refcounted variable */
 static ZEND_FUNCTION(zend_leak_variable)
 {

ext/zend_test/test.stub.php

@@ -299,6 +299,8 @@ function zend_leak_bytes(int $bytes = 3): void {}
 
     function zend_delref(mixed $variable): void {}
 
+    function zend_test_erealloc_block_size(int $old_size, int $new_size): array {}
+
 	function zend_bool(bool $param): bool {}
 	function zend_bool_or_null(bool|null $param): bool|null {}
 	function zend_bool_slow_zpp(bool $param): bool {}