Zend: Add opt-in request-scoped allocation no-reuse mode

Enable with ZEND_MM_NO_REUSE=1 before engine startup.

Clear and retain freed small allocations, page runs, and huge mappings
until heap shutdown. Move reallocations to fresh storage and prevent
allocator GC from reclaiming retired ranges.

Keep retained mappings charged against memory_limit and reject
incompatible allocator overrides rather than silently allowing reuse.

This mitigates UAF exploitation through allocation reclamation like
CVE-2026-109618 and CVE-2026-109619, at the cost of memory usage approaching
cumulative allocation volume per request.

Add tests for address non-overlap, clearing, reallocations, shutdown,
accounting, and configuration errors. Document usage and limitations.

This provides a nice alternative to #14304.

Author: jvoisin

Zend/README.md

@@ -21,6 +21,54 @@ Zend MM disabled:
 USE_ZEND_ALLOC=0 valgrind --leak-check=full sapi/cli/php -r 'leak();'
 ```
 
+### Request-scoped no-reuse mode
+
+Set `ZEND_MM_NO_REUSE=1` in the process environment before starting PHP to
+prevent native Zend MM from reusing freed allocation ranges within a request:
+
+```bash
+ZEND_MM_NO_REUSE=1 sapi/cli/php script.php
+```
+
+The default is disabled: leave the variable unset or set it to `0`. Only the
+literal values `0` and `1` are accepted; other values cause an allocator panic.
+This is not a `php.ini` option. It is read at engine startup, so changing it with
+`putenv()` has no effect on the running engine. For web SAPIs, set it in the
+launcher or service environment before PHP starts, and restart PHP processes
+after changing it.
+
+With the mode enabled:
+
+- Freed small allocations, page runs, and huge mappings are cleared and retained
+  until their heap shuts down, after request shutdown callbacks have finished.
+  Retired payloads are not used to store allocator free-list links.
+- Reallocations of existing blocks always move to fresh storage, including
+  shrinking and unchanged-size reallocations. The original storage is retired.
+- Allocator garbage collection does not reclaim retired storage. Addresses may
+  be reused after heap shutdown, normally in the next request.
+- Retained mappings remain charged against `memory_limit`. Reaching the limit
+  fails through the normal allocation-error path; it never enables reuse.
+  `memory_get_usage(false)` can decrease after freeing an allocation even though
+  the underlying storage remains retained.
+
+Memory consumption approaches cumulative allocation volume rather than peak
+live memory. Clearing freed storage and moving reallocations also add memory
+bandwidth and copying costs. The mode is intended for selected short-lived
+requests, not long-running scripts or application workers that do not perform
+normal PHP request shutdown.
+
+The mode requires native Zend MM. Combining it with `USE_ZEND_ALLOC=0`, custom
+heap or storage handlers, or `ZEND_MM_DEBUG` allocator wrappers causes an
+allocator panic rather than silently bypassing the protection.
+
+This is exploit mitigation, not memory safety or a sandbox. Invalid accesses
+to retired storage may still occur without trapping. Persistent allocations and
+extension-owned allocations outside native Zend MM are not covered, nor are
+dangling references that survive heap shutdown.
+
+See [Testing ZendMM No-Reuse Mode](../docs/source/miscellaneous/running-tests.rst#testing-zendmm-no-reuse-mode)
+for regression-test instructions.
+
 ### Shared extensions
 
 Since PHP 5.3.11 it is possible to prevent shared extensions from unloading so

Zend/tests/zend_mm_no_reuse_accounting.phpt

@@ -0,0 +1,38 @@
+--TEST--
+ZendMM no-reuse mode keeps retired huge mappings accounted for
+--ENV--
+USE_ZEND_ALLOC=1
+ZEND_MM_NO_REUSE=1
+--FILE--
+<?php
+putenv("ZEND_MM_NO_REUSE=0");
+$initial = memory_get_usage(true);
+$buffer = str_repeat("x", 3 * 1024 * 1024);
+$allocated = memory_get_usage();
+$committed = memory_get_usage(true);
+unset($buffer);
+$released = memory_get_usage();
+$retained = memory_get_usage(true);
+$collected = gc_mem_caches();
+
+var_dump($committed - $initial >= 3 * 1024 * 1024);
+var_dump($allocated - $released >= 3 * 1024 * 1024);
+var_dump($retained === $committed);
+var_dump($collected === 0);
+var_dump(memory_get_usage(true) === $retained);
+
+register_shutdown_function(function () use ($retained) {
+    var_dump(memory_get_usage(true) >= $retained);
+    $buffer = str_repeat("y", 3 * 1024 * 1024);
+    unset($buffer);
+    var_dump(memory_get_usage(true) > $retained);
+});
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)

Zend/tests/zend_mm_no_reuse_configuration.phpt

@@ -0,0 +1,44 @@
+--TEST--
+ZendMM no-reuse mode rejects invalid settings and incompatible allocators
+--SKIPIF--
+<?php
+if (!function_exists("proc_open")) {
+    die("skip proc_open is required");
+}
+?>
+--FILE--
+<?php
+$env = getenv();
+$cases = [
+    ["ZEND_MM_NO_REUSE" => "invalid", "USE_ZEND_ALLOC" => "1"],
+    ["ZEND_MM_NO_REUSE" => "1", "USE_ZEND_ALLOC" => "0"],
+    ["ZEND_MM_NO_REUSE" => "1", "USE_ZEND_ALLOC" => "1", "ZEND_MM_DEBUG" => "poison_free=0"],
+];
+foreach ($cases as $case) {
+    $process = proc_open(
+        [PHP_BINARY, "-n", "-r", "echo 'Unexpected startup';"],
+        [0 => ["pipe", "r"], 1 => ["pipe", "w"], 2 => ["pipe", "w"]],
+        $pipes,
+        null,
+        array_replace($env, $case)
+    );
+    fclose($pipes[0]);
+    $output = stream_get_contents($pipes[1]);
+    $error = stream_get_contents($pipes[2]);
+    fclose($pipes[1]);
+    fclose($pipes[2]);
+    var_dump(proc_close($process) !== 0);
+    var_dump($output === "");
+    echo strtok($error, "\r\n"), "\n";
+}
+?>
+--EXPECT--
+bool(true)
+bool(true)
+ZEND_MM_NO_REUSE must be 0 or 1
+bool(true)
+bool(true)
+ZEND_MM_NO_REUSE requires native ZendMM (USE_ZEND_ALLOC=1)
+bool(true)
+bool(true)
+ZEND_MM_NO_REUSE does not support custom heap handlers

Zend/tests/zend_mm_no_reuse_memory_limit.phpt

@@ -0,0 +1,18 @@
+--TEST--
+ZendMM no-reuse mode charges retired allocations against the memory limit
+--ENV--
+USE_ZEND_ALLOC=1
+ZEND_MM_NO_REUSE=1
+--INI--
+memory_limit=16M
+--FILE--
+<?php
+for ($i = 0; $i < 100; $i++) {
+    $buffer = str_repeat("x", 1024 * 1024);
+    unset($buffer);
+    gc_mem_caches();
+}
+echo "Unexpected reuse\n";
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of 16777216 bytes exhausted %s

Zend/zend_alloc.c

@@ -188,6 +188,7 @@ typedef zend_ulong zend_mm_bitset;    /* 4-byte or 8-byte integer */
 typedef zend_mm_bitset zend_mm_page_map[ZEND_MM_PAGE_MAP_LEN];     /* 64B */
 
 #define ZEND_MM_IS_FRUN                  0x00000000
+#define ZEND_MM_IS_RETIRED               0x20000000
 #define ZEND_MM_IS_LRUN                  0x40000000
 #define ZEND_MM_IS_SRUN                  0x80000000
 
@@ -229,6 +230,7 @@ typedef struct  _zend_mm_chunk     zend_mm_chunk;
 typedef struct  _zend_mm_huge_list zend_mm_huge_list;
 
 static bool zend_mm_use_huge_pages = false;
+static bool zend_mm_no_reuse = false;
 
 /*
  * Memory is retrieved from OS by chunks of fixed size 2MB.
@@ -287,6 +289,7 @@ struct _zend_mm_heap {
 #endif
 
 	zend_mm_huge_list *huge_list;               /* list of huge allocated blocks */
+	zend_mm_huge_list *retired_huge_list;
 
 	zend_mm_chunk     *main_chunk;
 	zend_mm_chunk     *cached_chunks;			/* list of unused chunks */
@@ -1261,6 +1264,12 @@ static zend_always_inline void zend_mm_free_large(zend_mm_heap *heap, zend_mm_ch
 #if ZEND_MM_STAT
 	heap->size -= pages_count * ZEND_MM_PAGE_SIZE;
 #endif
+	if (UNEXPECTED(zend_mm_no_reuse)) {
+		ZEND_MM_CHECK(!(chunk->map[page_num] & ZEND_MM_IS_RETIRED), "zend_mm_heap corrupted (double free)");
+		chunk->map[page_num] |= ZEND_MM_IS_RETIRED;
+		memset(ZEND_MM_PAGE_ADDR(chunk, page_num), 0, pages_count * ZEND_MM_PAGE_SIZE);
+		return;
+	}
 	zend_mm_free_pages(heap, chunk, page_num, pages_count);
 }
 
@@ -1496,6 +1505,11 @@ static zend_always_inline void zend_mm_free_small(zend_mm_heap *heap, void *ptr,
 	} while (0);
 #endif
 
+	if (UNEXPECTED(zend_mm_no_reuse)) {
+		memset(ptr, 0, bin_data_size[bin_num]);
+		return;
+	}
+
 	p = (zend_mm_free_slot*)ptr;
 #if ZEND_MM_HEAP_PROTECTION
 	/* Catch the most common double-free pattern for free. */
@@ -1755,6 +1769,11 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
 	zend_mm_debug_info *dbg;
 #endif
 
+	if (UNEXPECTED(zend_mm_no_reuse) && ptr != NULL) {
+		old_size = zend_mm_size(heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+		return zend_mm_realloc_slow(heap, ptr, size, MIN(old_size, MIN(size, copy_size)) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	}
+
 	page_offset = ZEND_MM_ALIGNED_OFFSET(ptr, ZEND_MM_CHUNK_SIZE);
 	if (UNEXPECTED(page_offset == 0)) {
 		if (EXPECTED(ptr == NULL)) {
@@ -1968,6 +1987,12 @@ static size_t zend_mm_del_huge_block(zend_mm_heap *heap, void *ptr ZEND_FILE_LIN
 				list->next->prev = list->prev;
 			}
 			size = list->size;
+			if (UNEXPECTED(zend_mm_no_reuse)) {
+				list->next = heap->retired_huge_list;
+				list->prev = NULL;
+				heap->retired_huge_list = list;
+				return size;
+			}
 			zend_mm_free_heap(heap, list ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 			return size;
 		}
@@ -2094,10 +2119,14 @@ static void zend_mm_free_huge(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZE
 	ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(ptr, ZEND_MM_CHUNK_SIZE) == 0, "zend_mm_heap corrupted");
 	size = zend_mm_del_huge_block(heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	zend_mm_check_huge_block_size(heap, size);
-	zend_mm_chunk_free(heap, ptr, size);
+	if (UNEXPECTED(zend_mm_no_reuse)) {
+		memset(ptr, 0, size);
+	} else {
+		zend_mm_chunk_free(heap, ptr, size);
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
-	heap->real_size -= size;
+		heap->real_size -= size;
 #endif
+	}
 #if ZEND_MM_STAT
 	heap->size -= size;
 #endif
@@ -2196,6 +2225,7 @@ static zend_mm_heap *zend_mm_init(void)
 	heap->storage = NULL;
 #endif
 	heap->huge_list = NULL;
+	heap->retired_huge_list = NULL;
 #if ZEND_DEBUG
 	heap->pid = getpid();
 #endif
@@ -2213,6 +2243,10 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 	bool has_free_pages;
 	size_t collected = 0;
 
+	if (UNEXPECTED(zend_mm_no_reuse)) {
+		return 0;
+	}
+
 #if ZEND_MM_CUSTOM
 	if (heap->use_custom_heap) {
 		size_t (*gc)(void) = heap->custom_heap._gc;
@@ -2377,6 +2411,10 @@ static zend_long zend_mm_find_leaks(zend_mm_heap *heap, zend_mm_chunk *p, uint32
 					i += bin_pages[bin_num];
 				} else /* if (p->map[i] & ZEND_MM_IS_LRUN) */ {
 					int pages_count = ZEND_MM_LRUN_PAGES(p->map[i]);
+					if (p->map[i] & ZEND_MM_IS_RETIRED) {
+						i += pages_count;
+						continue;
+					}
 					zend_mm_debug_info *dbg = (zend_mm_debug_info*)((char*)p + ZEND_MM_PAGE_SIZE * (i + pages_count) - ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
 
 					if (dbg->filename == leak->filename && dbg->lineno == leak->lineno) {
@@ -2496,6 +2534,10 @@ static void zend_mm_check_leaks(zend_mm_heap *heap)
 					i += bin_pages[bin_num];
 				} else /* if (p->map[i] & ZEND_MM_IS_LRUN) */ {
 					int pages_count = ZEND_MM_LRUN_PAGES(p->map[i]);
+					if (p->map[i] & ZEND_MM_IS_RETIRED) {
+						i += pages_count;
+						continue;
+					}
 					zend_mm_debug_info *dbg = (zend_mm_debug_info*)((char*)p + ZEND_MM_PAGE_SIZE * (i + pages_count) - ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
 
 					leak.addr = (void*)((char*)p + ZEND_MM_PAGE_SIZE * i);
@@ -2583,6 +2625,21 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
 	}
 #endif
 
+	/* Retired mappings stay reserved until all request callbacks have finished. */
+	list = heap->retired_huge_list;
+	heap->retired_huge_list = NULL;
+	while (list != NULL) {
+		zend_mm_huge_list *next = list->next;
+		size_t size = list->size;
+		zend_mm_check_huge_block_size(heap, size);
+		zend_mm_chunk_free(heap, list->ptr, size);
+#if ZEND_MM_STAT || ZEND_MM_LIMIT
+		heap->real_size -= size;
+#endif
+		zend_mm_free_heap(heap, list ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
+		list = next;
+	}
+
 #if ZEND_DEBUG
 	if (!silent) {
 		char *tmp = getenv("ZEND_ALLOC_PRINT_LEAKS");
@@ -3401,6 +3458,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 #if ZEND_MM_CUSTOM
 	tmp = getenv("USE_ZEND_ALLOC");
 	if (tmp && !ZEND_ATOL(tmp)) {
+		if (zend_mm_no_reuse) {
+			zend_mm_panic("ZEND_MM_NO_REUSE requires native ZendMM (USE_ZEND_ALLOC=1)");
+		}
 		bool tracked = (tmp = getenv("USE_TRACKED_ALLOC")) && ZEND_ATOL(tmp);
 		zend_mm_heap *mm_heap = alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
 		memset(mm_heap, 0, sizeof(zend_mm_heap));
@@ -3449,6 +3509,12 @@ static void alloc_globals_dtor(zend_alloc_globals *alloc_globals)
 
 ZEND_API void start_memory_manager(void)
 {
+	const char *no_reuse = getenv("ZEND_MM_NO_REUSE");
+	if (no_reuse && strcmp(no_reuse, "0") != 0 && strcmp(no_reuse, "1") != 0) {
+		zend_mm_panic("ZEND_MM_NO_REUSE must be 0 or 1");
+	}
+	zend_mm_no_reuse = no_reuse && strcmp(no_reuse, "1") == 0;
+
 #ifndef _WIN32
 #  if defined(_SC_PAGESIZE)
 	REAL_PAGE_SIZE = sysconf(_SC_PAGESIZE);
@@ -3506,6 +3572,10 @@ ZEND_API void zend_mm_set_custom_handlers_ex(zend_mm_heap *heap,
 #if ZEND_MM_CUSTOM
 	zend_mm_heap *_heap = (zend_mm_heap*)heap;
 
+	if (UNEXPECTED(zend_mm_no_reuse) && (_malloc || _free || _realloc || _gc || _shutdown)) {
+		zend_mm_panic("ZEND_MM_NO_REUSE does not support custom heap handlers");
+	}
+
 	if (!_malloc && !_free && !_realloc) {
 		_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_NONE;
 	} else {
@@ -3585,6 +3655,9 @@ ZEND_API zend_mm_heap *zend_mm_startup(void)
 
 ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void *data, size_t data_size)
 {
+	if (UNEXPECTED(zend_mm_no_reuse)) {
+		zend_mm_panic("ZEND_MM_NO_REUSE does not support custom storage handlers");
+	}
 #if ZEND_MM_STORAGE
 	zend_mm_storage *storage;
 	zend_mm_storage tmp_storage = {
@@ -3636,6 +3709,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
 #endif
 	heap->storage = &tmp_storage;
 	heap->huge_list = NULL;
+	heap->retired_huge_list = NULL;
 	memset(heap->free_slot, 0, sizeof(heap->free_slot));
 	storage = _zend_mm_alloc(heap, sizeof(zend_mm_storage) + data_size ZEND_FILE_LINE_CC ZEND_FILE_LINE_CC);
 	if (!storage) {
@@ -3702,4 +3776,3 @@ ZEND_API char * __zend_strdup(const char *s)
 	}
 	zend_out_of_memory();
 }
-

docs/source/miscellaneous/running-tests.rst

@@ -83,6 +83,25 @@ The test runner can run tests in parallel, by using the ``-j`` option:
 
    php run-tests.php -j24 ext/date/*.phpt
 
+Testing ZendMM No-Reuse Mode
+============================
+
+The ``ZEND_MM_NO_REUSE`` environment option is documented in the `Zend memory-manager README
+<https://github.com/php/php-src/blob/master/Zend/README.md#request-scoped-no-reuse-mode>`__. Build
+with ``--enable-zend-test`` and run its dedicated regression tests:
+
+.. code:: shell
+
+   sapi/cli/php run-tests.php Zend/tests/zend_mm_no_reuse_*.phpt \
+       ext/zend_test/tests/zend_mm_no_reuse.phpt
+
+These tests enable the mode in their own test processes. They check address-range non-overlap,
+clearing, reallocations, GC, repeated heap shutdown, memory accounting, and incompatible
+configurations.
+
+Most ordinary tests should still be run in the default allocator mode; tests relying on allocation
+recycling or bounded memory usage can behave differently with no-reuse enabled.
+
 **************
  Test results
 **************