Skip to content

Sanity check huge block sizes before using them as munmap() lengths #23378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jvoisin wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Sanity check huge block sizes before using them as munmap() lengths #23378

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 17 additions & 0 deletions Zend/zend_alloc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1831,6 +1831,20 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
/* Huge Runs (again) */
/*********************/

/* Huge block metadata is allocated from the very heap it describes, so a heap
* overflow can reach it. size ends up as a munmap() length, where a corrupted
* value would unmap unrelated mappings, so bound it before use: a live block is
* page aligned and is still accounted for in real_size. */
static zend_always_inline void zend_mm_check_huge_block_size(const zend_mm_heap *heap, size_t size)
{
ZEND_MM_CHECK(size != 0 && ZEND_MM_ALIGNED_OFFSET(size, REAL_PAGE_SIZE) == 0, "zend_mm_heap corrupted");
#if ZEND_MM_STAT || ZEND_MM_LIMIT
ZEND_MM_CHECK(size <= heap->real_size, "zend_mm_heap corrupted");
#else
(void)heap;
#endif
}

#if ZEND_DEBUG
static void zend_mm_add_huge_block(zend_mm_heap *heap, void *ptr, size_t size, size_t dbg_size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
#else
Expand Down Expand Up @@ -1880,6 +1894,7 @@ static size_t zend_mm_get_huge_block_size(zend_mm_heap *heap, void *ptr ZEND_FIL
zend_mm_huge_list *list = heap->huge_list;
while (list != NULL) {
if (list->ptr == ptr) {
zend_mm_check_huge_block_size(heap, list->size);
return list->size;
}
list = list->next;
Expand Down Expand Up @@ -1990,6 +2005,7 @@ static void zend_mm_free_huge(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZE

ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(ptr, ZEND_MM_CHUNK_SIZE) == 0, "zend_mm_heap corrupted");
size = zend_mm_del_huge_block(heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
zend_mm_check_huge_block_size(heap, size);
zend_mm_chunk_free(heap, ptr, size);
#if ZEND_MM_STAT || ZEND_MM_LIMIT
heap->real_size -= size;
Expand Down Expand Up @@ -2482,6 +2498,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
while (list) {
zend_mm_huge_list *q = list;
list = list->next;
zend_mm_check_huge_block_size(heap, q->size);
zend_mm_chunk_free(heap, q->ptr, q->size);
}

Expand Down
Loading