[php-src] Issue #22516: zend_alloc bin 0 may leak
[email protected] (ndossche) Mon, 29 Jun 2026 22:01:19 +0000
| Newsgroups | php.bugs |
|---|---|
| Message-ID | <[email protected]> |
Issue: https://github.com/php/php-src/issues/22516 Author: ndossche ### Description Value set analysis shows that `ZEND_MM_SRUN_FREE_COUNTER` macro can return a value in the interval [0, 511]. However, bin 0 from `ZEND_MM_BINS_INFO` has 512 free elements. So the following check cannot fire: https://github.com/php/php-src/blob/c1a6258015eca9e3edb768114d13db954ce77a65/Zend/zend_alloc.c#L2196 Found using SAST. ### PHP Version ```plain master ``` ### Operating System _No response_