Patch for 72742

72742.diff

commit c2a13ced4272f2e65d2773e2ea6ca11c1ce4a911
Author: Stanislav Malyshev <stas@php.net>
Date:   Sun Aug 14 19:07:15 2016 -0700

    Fix bug #72742 - memory allocator fails to realloc small block to large one

diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 1876559..a79d67b 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -1548,11 +1548,10 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 
 		ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
 		if (info & ZEND_MM_IS_SRUN) {
-			int old_bin_num, bin_num;
-
-			old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
+			int old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
 			old_size = bin_data_size[old_bin_num];
-			bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
+			if (size <= ZEND_MM_MAX_SMALL_SIZE) {
+				int bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
 				if (old_bin_num == bin_num) {
 #if ZEND_DEBUG
 					dbg = zend_mm_get_debug_info(heap, ptr);
@@ -1564,6 +1563,7 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 #endif
 					return ptr;
 				}
+			}
 		} else /* if (info & ZEND_MM_IS_LARGE_RUN) */ {
 			ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(page_offset, ZEND_MM_PAGE_SIZE) == 0, "zend_mm_heap corrupted");
 			old_size = ZEND_MM_LRUN_PAGES(info) * ZEND_MM_PAGE_SIZE;