From 9b3bbf4a89fe756d11da62aedef07b07154b1d1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Fri, 7 Aug 2026 15:52:24 +0200 Subject: [PATCH 1/2] zend_objects: Use `zend_object_alloc()` in `zend_objects_new()` --- Zend/zend_objects.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Zend/zend_objects.c b/Zend/zend_objects.c index 474157e73d39..b2c4b7b57b83 100644 --- a/Zend/zend_objects.c +++ b/Zend/zend_objects.c @@ -187,7 +187,7 @@ ZEND_API void zend_objects_destroy_object(zend_object *object) ZEND_API zend_object* ZEND_FASTCALL zend_objects_new(zend_class_entry *ce) { - zend_object *object = emalloc(sizeof(zend_object) + zend_object_properties_size(ce)); + zend_object *object = zend_object_alloc(sizeof(zend_object), ce); _zend_object_std_init(object, ce); return object; From 7d7b69e73f7fc8ae616effa878294e5b854ce880 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Fri, 7 Aug 2026 16:02:01 +0200 Subject: [PATCH 2/2] zend_objects_API: Assert that the `.offset` is correct in `zend_object_alloc()` This makes mistakes like setting an incorrect `.offset` for the object handlers or forgetting to implement `create_object` and `clone_obj` when specifying an offset easier to debug. --- Zend/zend_objects_API.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Zend/zend_objects_API.h b/Zend/zend_objects_API.h index 434ac4499e7f..97256aaf0ee3 100644 --- a/Zend/zend_objects_API.h +++ b/Zend/zend_objects_API.h @@ -90,8 +90,11 @@ static zend_always_inline size_t zend_object_properties_size(const zend_class_en * Standard object MUST be initialized using zend_object_std_init(). * Properties MUST be initialized using object_properties_init(). */ static zend_always_inline void *zend_object_alloc(size_t obj_size, const zend_class_entry *ce) { + const size_t extra_data = obj_size - sizeof(zend_object); + ZEND_ASSERT(ce->default_object_handlers->offset == extra_data); + void *obj = emalloc(obj_size + zend_object_properties_size(ce)); - memset(obj, 0, obj_size - sizeof(zend_object)); + memset(obj, 0, extra_data); return obj; }