Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2: Fix is_zend_ptr() huge block comparison
2024-11-26 19:24:31 +01:00
parent e43a398149 18674e39ad
commit 02b1056714
2 changed files with 3 additions and 2 deletions
--- a/1
+++ b/1
@ -14,6 +14,7 @@ PHP                                                                        NEWS
    (nielsdos)
  . Fixed bug GH-16630 (UAF in lexer with encoding translation and heredocs).
    (nielsdos)
+  . Fix is_zend_ptr() huge block comparison. (nielsdos)

 - Curl:
  . Fixed bug GH-16802 (open_basedir bypass using curl extension). (nielsdos)
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@ -2471,8 +2471,8 @@ ZEND_API bool is_zend_ptr(const void *ptr)

 	zend_mm_huge_list *block = AG(mm_heap)->huge_list;
 	while (block) {
-		if (ptr >= (void*)block
-				&& ptr < (void*)((char*)block + block->size)) {
+		if (ptr >= block->ptr
+				&& ptr < (void*)((char*)block->ptr + block->size)) {
 			return 1;
 		}
 		block = block->next;