Merge branch 'PHP-8.3' into PHP-8.4

* PHP-8.3: Fix is_zend_ptr() huge block comparison
php · Nov 26, 2024 · 8fdcd9f · 8fdcd9f
2 parents 118ed09 + 02b1056
commit 8fdcd9f
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/NEWS b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug GH-16344 (setRawValueWithoutLazyInitialization() and
     skipLazyInitialization() may change initialized proxy). (Arnaud)
+  . Fix is_zend_ptr() huge block comparison. (nielsdos)
 
 - DOM:
   . Fixed bug GH-16906 (Reloading document can cause UAF in iterator).

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
@@ -2617,8 +2617,8 @@ ZEND_API bool is_zend_ptr(const void *ptr)
 
 	zend_mm_huge_list *block = AG(mm_heap)->huge_list;
 	while (block) {
-		if (ptr >= (void*)block
-				&& ptr < (void*)((char*)block + block->size)) {
+		if (ptr >= block->ptr
+				&& ptr < (void*)((char*)block->ptr + block->size)) {
 			return 1;
 		}
 		block = block->next;