Make some parts of _zend_mm_heap read-only at runtime.

As [presented at
OffensiveCon 2024](https://youtu.be/dqKFHjcK9hM?t=1622), having trivially
callable writeable function pointers at the top of the heap makes it
straightforward to turn a limited write into an arbitrary code execution.

Disabling ZEND_MM_HEAP by default isn't doable, as it's used by a couple of
profilers, so we're making some parts of `_zend_mm_heap` read-only at runtime
instead: this will prevent the custom heap functions pointers from being
hijacked, and we're also throwing the `shadow_key` there as it doesn't hurt to
make it read-only as well.

Author: jvoisin

Zend/zend_alloc.c

@@ -296,6 +296,20 @@ static bool zend_mm_use_huge_pages = false;
  */
 
 struct _zend_mm_heap {
+    union {                                             /* This union contains security-relevant properties, and is thus made read-only at run-time. */
+        struct {
+            uintptr_t          shadow_key;              /* free slot shadow ptr xor key */
+#if ZEND_MM_CUSTOM
+            struct {
+                void      *(*_malloc)(size_t ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
+                void       (*_free)(void*  ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
+                void      *(*_realloc)(void*, size_t  ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
+            } custom_heap;
+#endif
+        };
+        char padding [ZEND_MM_PAGE_SIZE];
+    };
+
 #if ZEND_MM_CUSTOM
 	int                use_custom_heap;
 #endif
@@ -306,7 +320,6 @@ struct _zend_mm_heap {
 	size_t             size;                    /* current memory usage */
 	size_t             peak;                    /* peak memory usage */
 #endif
-	uintptr_t          shadow_key;              /* free slot shadow ptr xor key */
 	zend_mm_free_slot *free_slot[ZEND_MM_BINS]; /* free lists for small sizes */
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	size_t             real_size;               /* current size of allocated pages */
@@ -330,11 +343,6 @@ struct _zend_mm_heap {
 	int                last_chunks_delete_boundary; /* number of chunks after last deletion */
 	int                last_chunks_delete_count;    /* number of deletion over the last boundary */
 #if ZEND_MM_CUSTOM
-	struct {
-		void      *(*_malloc)(size_t ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
-		void       (*_free)(void*  ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
-		void      *(*_realloc)(void*, size_t  ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
-	} custom_heap;
 	HashTable *tracked_allocs;
 #endif
 	pid_t pid;
@@ -2103,6 +2111,9 @@ static zend_mm_heap *zend_mm_init(void)
 #endif
 	heap->huge_list = NULL;
 	heap->pid = getpid();
+
+	mprotect(heap, ZEND_MM_PAGE_SIZE, PROT_READ);
+
 	return heap;
 }
 
@@ -2440,7 +2451,9 @@ void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
 				zend_hash_destroy(heap->tracked_allocs);
 				free(heap->tracked_allocs);
 				/* Make sure the heap free below does not use tracked_free(). */
+				mprotect(heap, ZEND_MM_PAGE_SIZE, PROT_WRITE);
 				heap->custom_heap._free = __zend_free;
+				mprotect(heap, ZEND_MM_PAGE_SIZE, PROT_READ);
 			}
 			heap->size = 0;
 		}
@@ -3063,6 +3076,7 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		mm_heap->limit = (size_t)Z_L(-1) >> 1;
 		mm_heap->overflow = 0;
 
+		mprotect(mm_heap, ZEND_MM_PAGE_SIZE, PROT_WRITE);
 		if (!tracked) {
 			/* Use system allocator. */
 			mm_heap->custom_heap._malloc = __zend_malloc;
@@ -3076,6 +3090,7 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 			mm_heap->tracked_allocs = malloc(sizeof(HashTable));
 			zend_hash_init(mm_heap->tracked_allocs, 1024, NULL, NULL, 1);
 		}
+		mprotect(mm_heap, ZEND_MM_PAGE_SIZE, PROT_READ);
 		return;
 	}
 #endif
@@ -3141,14 +3156,18 @@ ZEND_API void zend_mm_set_custom_handlers(zend_mm_heap *heap,
 #if ZEND_MM_CUSTOM
 	zend_mm_heap *_heap = (zend_mm_heap*)heap;
 
+	mprotect(_heap, ZEND_MM_PAGE_SIZE, PROT_WRITE);
 	if (!_malloc && !_free && !_realloc) {
 		_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_NONE;
 	} else {
 		_heap->use_custom_heap = ZEND_MM_CUSTOM_HEAP_STD;
+		mprotect(heap, ZEND_MM_PAGE_SIZE, PROT_WRITE);
 		_heap->custom_heap._malloc = _malloc;
 		_heap->custom_heap._free = _free;
 		_heap->custom_heap._realloc = _realloc;
+		mprotect(heap, ZEND_MM_PAGE_SIZE, PROT_READ);
 	}
+	mprotect(_heap, ZEND_MM_PAGE_SIZE, PROT_READ);
 #endif
 }