[pull] master from php:master - #1222
Merged
Merged
Conversation
Three places dispatch on the page map entry of a pointer, and reach the
large-run case by elimination, with the assumption written down as a
comment rather than checked:
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
...
} else /* if (info & ZEND_MM_IS_LRUN) */ {
The assumption does not always hold: when ZEND_MM_IS_FRUN is 0 and
zend_mm_free_pages_ex() zeroes chunk->map[page_num], a pointer to a
large run that has already been freed has info == 0, so it fails the SRUN test,
and falls into the large-run branch. There, ZEND_MM_LRUN_PAGES(0) is 0,
and the three callers quietly degrade:
- zend_mm_free_heap() frees a run of zero pages, i.e. a double free of a
large block is accepted and does nothing at all.
- zend_mm_size() reports a block size of 0.
- zend_mm_realloc_heap() takes old_size 0 and reallocates from there.
A large-block double free or a use of a freed pointer is silently absorbed by
the allocator instead of being a hard failure. This commit promotes the comment
to a real ZEND_MM_CHECK() in all three. The value is already in a register at
that point, so it costs a test and a branch.
This was checked under GDB by allocating a large block, freeing it, and then
reusing the pointer. Before, _efree() returned normally,
_zend_mem_block_size() returned 0 and _erealloc() returned a new pointer.
After this commit, each of the three aborts with "zend_mm_heap corrupted".
Amusingly, the two comments naming ZEND_MM_IS_LARGE_RUN referred to a
macro that does not exist: the real name is ZEND_MM_IS_LRUN.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )