diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
index 4fc8926c0fcc..a2500de3e8b7 100644
--- a/Zend/zend_alloc.c
+++ b/Zend/zend_alloc.c
@@ -1239,6 +1239,11 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 
 static zend_always_inline void zend_mm_free_pages_ex(zend_mm_heap *heap, zend_mm_chunk *chunk, uint32_t page_num, uint32_t pages_count, int free_chunk)
 {
+	/* pages_count is decoded from a page map entry or a caller-supplied size, both of which
+	 * may be corrupted. An out-of-range run would make the updates below reach past free_map
+	 * into the rest of the chunk header. */
+	ZEND_MM_CHECK(page_num >= ZEND_MM_FIRST_PAGE && pages_count != 0
+		&& page_num + pages_count <= ZEND_MM_PAGES, "zend_mm_heap corrupted");
 	chunk->free_pages += pages_count;
 	zend_mm_bitset_reset_range(chunk->free_map, page_num, pages_count);
 	chunk->map[page_num] = 0;