[GIT-PULLS] [php-src] PR #23361: Randomize the layout of zend_mm small freelists

Pull Request: https://github.com/php/php-src/pull/23361
Author: jvoisin

zend_mm_alloc_small_slow() carved a fresh bin into a freelist ordered by ascending address and returned the first element, so the address of every small allocation was entirely determined by the allocation sequence: the n-th allocation of a given size class always landed at bin + n*slot_size, and two consecutive allocations were always adjacent.

That determinism is what makes heap feng-shui reliable. An attacker who can drive a few allocations of the right size class knows exactly where the next one lands, and can therefore place a victim object immediately after a buffer he can overflow, or reclaim a specific freed slot with an object of a chosen type.

Shuffle the slot order when a bin is created: hand out the first slot of the shuffled sequence and link the remaining ones in that order. This is the ~equivalent of Linux' SLAB_FREELIST_RANDOM.

Performance-wise, it:

- Adds two scratch arrays of ZEND_MM_MAX_BIN_ELEMENTS entries (4KiB total) live on the stack of a non-recursive slow path.
- Adds a per-bin-creation shuffleing, on the slow path.
- Reduces spatial locality of allocations, but Zend/bench.php shows no measurable difference.

Can be compiled out with -DZEND_MM_FREELIST_RANDOM=0.