Skip to content

zend_alloc: read the in-place limit of a small realloc from a table #24331

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
marc-mabe wants to merge 1 commit into from
Closed

zend_alloc: read the in-place limit of a small realloc from a table #24331

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion Zend/zend_alloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -370,6 +370,14 @@ static const uint32_t bin_data_size[] = {
ZEND_MM_BINS_INFO(_BIN_DATA_SIZE, x, y)
};

/* Reallocation keeps a small block in place down to one byte above the size of
* the bin below it, as efree_size() maps that size to the bin below. */
#define _BIN_KEEP_SIZE(num, size, elements, pages, x, y) (size) + 1,
static const uint32_t bin_keep_size[] = {
0,
ZEND_MM_BINS_INFO(_BIN_KEEP_SIZE, x, y)
};

#define _BIN_DATA_ELEMENTS(num, size, elements, pages, x, y) elements,
static const uint32_t bin_elements[] = {
ZEND_MM_BINS_INFO(_BIN_DATA_ELEMENTS, x, y)
Expand Down Expand Up @@ -1788,7 +1796,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
if (size <= old_size) {
/* Check if truncation is necessary. A size that fits the
* bin below moves there, as efree_size() maps it to that bin. */
if (old_bin_num > 0 && size <= bin_data_size[old_bin_num - 1]) {
if (UNEXPECTED(size < bin_keep_size[old_bin_num])) {
/* truncation */
ret = zend_mm_alloc_small(heap, ZEND_MM_SMALL_SIZE_TO_BIN(size) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
copy_size = use_copy_size ? MIN(size, copy_size) : size;
Expand Down
Loading