Skip to content

Add ASAN support to the zend allocator #18858

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 14 commits into
base: master
Choose a base branch
from
Draft

Conversation

danog
Copy link
Contributor

@danog danog commented Jun 16, 2025

This pull request adds ASAN support to the zend allocator, by automatically poisoning all unused pages, chunks and heap management structures before exiting the alloc, free, etc (all ZEND_API) functions.

Internally, the implementation uses the following rules:

  • Always poison memory (re)allocated by private (non-ZEND_API) allocation functions before returning it
  • Unpoison memory (re)allocated by public (ZEND_API) allocation functions before returning within the ZEND_API function
  • Always poison freed memory
  • Always poison unused memory during reallocation (where new_size < old_size)
  • When accessing private heap structures and fields, always unpoison before accessing and repoison immediately after
    • An exception to the above (for simplicity) is the main heap datastructure, which is poisoned only when entering a ZEND_API function and repoisoned before exiting

This is what allowed me to find #18833, before I found the fast shutdown workaround.

@danog danog force-pushed the asan_zend_alloc branch from 197f4a3 to 2f84241 Compare June 16, 2025 12:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant