Skip to content

Commit 5880428

Browse files
committed
Fix potential memory issue with USE_ZEND_ALLOC=0
The PHP core and extensions are written with the assumption that memory allocation either succeeds, or the allocator bails out (i.e. the allocator is infallible). Therefore the result of emalloc() and friends are not checked for NULL values. However, with USE_ZEND_ALLOC=0, malloc() and friends are used as allocators, but these are fallible, i.e. they return NULL instead of bailing out if they fail. This easily leads to invalid memory accesses in the following, such as in <https://bugs.php.net/73032>. Some of these cases may constitute exploitable vulnerabilities. Therefore we make the infallible __zend_alloc() and friends the default for USE_ZEND_ALLOC=0.
1 parent dad7936 commit 5880428

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

Zend/zend_alloc.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2726,9 +2726,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals TSRMLS_DC)
27262726
alloc_globals->mm_heap = malloc(sizeof(struct _zend_mm_heap));
27272727
memset(alloc_globals->mm_heap, 0, sizeof(struct _zend_mm_heap));
27282728
alloc_globals->mm_heap->use_zend_alloc = 0;
2729-
alloc_globals->mm_heap->_malloc = malloc;
2729+
alloc_globals->mm_heap->_malloc = __zend_malloc;
27302730
alloc_globals->mm_heap->_free = free;
2731-
alloc_globals->mm_heap->_realloc = realloc;
2731+
alloc_globals->mm_heap->_realloc = __zend_realloc;
27322732
} else {
27332733
alloc_globals->mm_heap = zend_mm_startup();
27342734
}

0 commit comments

Comments
 (0)