Fix #78620: Out of memory error

If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the
macro evaluates to `0`, what we should catch early.

diff --git a/NEWS b/NEWS
index 1c4ce6fe5d88cf61eaa19be5ba24e8f5152d7770..b8a1a23997cf053e62c574625abd51711745e0ce 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
     (bugreportuser)
+  . Fixed bug #78620 (Out of memory error). (cmb)
 
 - Exif:
   . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 3a43027346dba32aa846537622b23192daeb09ff..222f08f49e4a456ce6dfdd2c5cd317b49d7a511a 100644 (file)
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -1730,10 +1730,15 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
        void *ptr;
 
 #if ZEND_MM_LIMIT
+       if (UNEXPECTED(new_size == 0)) {
+               /* overflow in ZEND_MM_ALIGNED_SIZE_EX */
+               goto memory_limit_exhausted;
+       }
        if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
                if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
                        /* pass */
                } else if (heap->overflow == 0) {
+memory_limit_exhausted:
 #if ZEND_DEBUG
                        zend_mm_safe_error(heap, "Allowed memory size of %zu bytes exhausted at %s:%d (tried to allocate %zu bytes)", heap->limit, __zend_filename, __zend_lineno, size);
 #else