“I find it fascinating that people are putting so much efforts optimizing exploitation techniques, yet ~nobody bothers fixing them, even if it only takes a couple of lines of code and 20 minutes.”
Safe-unlink entered PHP’s codebase in 2003 and quietly vanished in the PHP5 to PHP7 transition. Voisin and Arnaud Le Blanc are putting it back, plus a shadow pointer on the heap freelist that fed CVE-2016-3132, CVE-2016-3141 and CVE-2024-2961. Making zend_mm_heap’s function pointers read-only was rejected over a 0.6% performance cost. PHP will keep a code execution primitive to save 0.6%.