Skip to content

Remote heap feng shui / heap spraying protection #14304

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arnaud-lb wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Remote heap feng shui / heap spraying protection #14304

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
13aa3a7
Remote heap spraying / feng shui protection
arnaud-lb May 22, 2024
8df7a32
Fix zend_mm_chunk.reserve
arnaud-lb Aug 27, 2025
66bb73a
Fix non-ZEND_MM_HEAP_PROTECTION build
arnaud-lb Aug 27, 2025
24f430d
Adjust iz_zend_ptr()
arnaud-lb Aug 27, 2025
a079450
Fix new tests after rebase
arnaud-lb Oct 23, 2026
f6b7dab
Revise zend_mm_check_in_userinput()
arnaud-lb Aug 27, 2025
61a9ad0
Allow to opt-out of userinput isolation
arnaud-lb Aug 27, 2025
7d3da25
Adjust zend_mm_refresh_key_child()
arnaud-lb Aug 27, 2025
86f3294
Use alignas()
arnaud-lb Oct 23, 2026
479ae8d
Fix tests
arnaud-lb Oct 23, 2026
e999c65
Fix tests
arnaud-lb Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Zend/tests/bug70258.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
Bug #70258 (Segfault if do_resize fails to allocated memory)
--INI--
memory_limit=2M
memory_limit=4M
--SKIPIF--
<?php
if (PHP_OS_FAMILY === 'Windows') {
Expand All @@ -28,4 +28,4 @@ $a = new A;
$a->core();
?>
--EXPECTF--
Fatal error: Allowed memory size of 2097152 bytes exhausted%s(tried to allocate %d bytes) in %s on line %d
Fatal error: Allowed memory size of 4194304 bytes exhausted%s(tried to allocate %d bytes) in %s on line %d
2 changes: 1 addition & 1 deletion Zend/tests/closures/gh12073.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ function test() {
};
}

ini_set('memory_limit', '2M');
ini_set('memory_limit', '4M');

$array = [];
for ($i = 0; $i < 10_000; $i++) {
Expand Down
2 changes: 1 addition & 1 deletion Zend/tests/fibers/out-of-memory-in-fiber.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
Out of Memory in a fiber
--INI--
memory_limit=2M
memory_limit=4M
--SKIPIF--
<?php
if (getenv("USE_ZEND_ALLOC") === "0") {
Expand Down
2 changes: 1 addition & 1 deletion Zend/tests/fibers/out-of-memory-in-nested-fiber.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
Out of Memory in a nested fiber
--INI--
memory_limit=2M
memory_limit=4M
--SKIPIF--
<?php
if (getenv("USE_ZEND_ALLOC") === "0") {
Expand Down
2 changes: 1 addition & 1 deletion Zend/tests/fibers/out-of-memory-in-recursive-fiber.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
Out of Memory from recursive fiber creation
--INI--
memory_limit=2M
memory_limit=4M
--SKIPIF--
<?php
if (getenv("USE_ZEND_ALLOC") === "0") {
Expand Down
4 changes: 2 additions & 2 deletions Zend/tests/gh11189_1.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ if (PHP_OS_FAMILY === 'Windows') {
if (getenv("USE_ZEND_ALLOC") === "0") die("skip ZMM is disabled");
?>
--INI--
memory_limit=2M
memory_limit=4M
--FILE--
<?php

Expand All @@ -29,4 +29,4 @@ while (1) {

?>
--EXPECTF--
Fatal error: Allowed memory size of 2097152 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
Fatal error: Allowed memory size of 4194304 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
2 changes: 1 addition & 1 deletion Zend/tests/new_oom.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
<?php

$mb_used = (int) ceil(memory_get_usage() / (1024 ** 2));
$mb_used = (int) ceil(memory_get_usage(true) / (1024 ** 2));
ini_set('memory_limit', ($mb_used + 1) . 'M');

$class = $argv[1];
Expand Down
6 changes: 4 additions & 2 deletions Zend/tests/oom_SplFixedArray___wakeup.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
--TEST--
OOM SplFixedArray::fromArray() 003
--SKIPIF--
<?php if (PHP_INT_SIZE != 8) die("skip 64bit only"); ?>
--INI--
memory_limit=16M
memory_limit=17M
--FILE--
<?php

Expand All @@ -18,4 +20,4 @@ $a->__wakeup();
--EXPECTF--
Deprecated: Method SplFixedArray::__wakeup() is deprecated since 8.4, this method is obsolete, as serialization hooks are provided by __unserialize() and __serialize() in %s on line %d

Fatal error: Allowed memory size of 16777216 bytes exhausted %S(tried to allocate %d bytes) in %s on line 10
Fatal error: Allowed memory size of 17825792 bytes exhausted %S(tried to allocate %d bytes) in %s on line 10
4 changes: 2 additions & 2 deletions Zend/tests/oom_SplFixedArray_fromArray_002.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
OOM SplFixedArray::fromArray() 002
--INI--
memory_limit=10M
memory_limit=11M
--FILE--
<?php

Expand All @@ -11,4 +11,4 @@ SplFixedArray::fromArray($array, false);

?>
--EXPECTF--
Fatal error: Allowed memory size of 10485760 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
Fatal error: Allowed memory size of 11534336 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
4 changes: 2 additions & 2 deletions Zend/tests/oom_json_decode_001.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
OOM json_decode() array
--INI--
memory_limit=10M
memory_limit=12M
--FILE--
<?php

Expand All @@ -11,4 +11,4 @@ var_dump(json_decode($json));

?>
--EXPECTF--
Fatal error: Allowed memory size of 10485760 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
Fatal error: Allowed memory size of 12582912 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
4 changes: 2 additions & 2 deletions Zend/tests/oom_json_decode_002.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
OOM json_decode() nested arrays
--INI--
memory_limit=10M
memory_limit=12M
--FILE--
<?php

Expand All @@ -12,4 +12,4 @@ var_dump(json_decode($json, depth: $depth+2));

?>
--EXPECTF--
Fatal error: Allowed memory size of 10485760 bytes exhausted %S(tried to allocate %d bytes) in %s on line 6
Fatal error: Allowed memory size of 12582912 bytes exhausted %S(tried to allocate %d bytes) in %s on line 6
4 changes: 2 additions & 2 deletions Zend/tests/oom_json_decode_007.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
--TEST--
OOM json_decode() empty objects
--INI--
memory_limit=10M
memory_limit=12M
--FILE--
<?php

Expand All @@ -11,4 +11,4 @@ var_dump(json_decode($json));

?>
--EXPECTF--
Fatal error: Allowed memory size of 10485760 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
Fatal error: Allowed memory size of 12582912 bytes exhausted %S(tried to allocate %d bytes) in %s on line 5
4 changes: 2 additions & 2 deletions Zend/tests/shutdown_functions/object_gc_in_shutdown.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,9 @@
Bug object gc not working in shutdown
--FILE--
<?php
ini_set('memory_limit', '2M');
ini_set('memory_limit', '4M');
register_shutdown_function(function () {
for ($n = 1000 * 1000; $n--;) {
for ($n = 2 * 1000 * 1000; $n--;) {
new stdClass;
}
echo "OK\n";
Expand Down
Loading
Loading