- Fix the fix by making sure the new block is in the right free list.

diff --git a/Zend/zend_mm.c b/Zend/zend_mm.c
index 7e3511542b4f94d38453979f9509f31ff4e79d14..c74753e3bb4fa27099af62199c0f6898d18254a3 100644 (file)
--- a/Zend/zend_mm.c
+++ b/Zend/zend_mm.c
@@ -387,10 +387,12 @@ void *zend_mm_realloc(zend_mm_heap *heap, void *p, size_t size)
 
                        new_next_block = ZEND_MM_BLOCK_AT(mm_block, mm_block->size);
                        if (new_next_block != next_block) { /* A new free block was created */
+                               zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) new_next_block);
                                zend_mm_remove_from_free_list(heap, (zend_mm_free_block *) next_block);
                                new_next_block->size += next_block->size;
                                /* update the next block's prev_size */
                                ZEND_MM_BLOCK_AT(mm_block, new_next_block->size)->prev_size = new_next_block->size;
+                               zend_mm_add_to_free_list(heap, (zend_mm_free_block *) new_next_block);
                        }
                }
                return p;