xref: /PHP-7.0/Zend/zend_execute_API.c (revision eb03f164)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1998-2017 Zend Technologies Ltd. (http://www.zend.com) |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@zend.com>                                |
16    |          Zeev Suraski <zeev@zend.com>                                |
17    |          Dmitry Stogov <dmitry@zend.com>                             |
18    +----------------------------------------------------------------------+
19 */
20 
21 /* $Id$ */
22 
23 #include <stdio.h>
24 #include <signal.h>
25 
26 #include "zend.h"
27 #include "zend_compile.h"
28 #include "zend_execute.h"
29 #include "zend_API.h"
30 #include "zend_stack.h"
31 #include "zend_constants.h"
32 #include "zend_extensions.h"
33 #include "zend_exceptions.h"
34 #include "zend_closures.h"
35 #include "zend_generators.h"
36 #include "zend_vm.h"
37 #include "zend_float.h"
38 #ifdef HAVE_SYS_TIME_H
39 #include <sys/time.h>
40 #endif
41 
42 ZEND_API void (*zend_execute_ex)(zend_execute_data *execute_data);
43 ZEND_API void (*zend_execute_internal)(zend_execute_data *execute_data, zval *return_value);
44 
45 /* true globals */
46 ZEND_API const zend_fcall_info empty_fcall_info = { 0, NULL, {{0}, {{0}}, {0}}, NULL, NULL, NULL, NULL, 0, 0 };
47 ZEND_API const zend_fcall_info_cache empty_fcall_info_cache = { 0, NULL, NULL, NULL, NULL };
48 
49 #ifdef ZEND_WIN32
50 ZEND_TLS HANDLE tq_timer = NULL;
51 #endif
52 
53 #if 0&&ZEND_DEBUG
54 static void (*original_sigsegv_handler)(int);
55 static void zend_handle_sigsegv(int dummy) /* {{{ */
56 {
57 	fflush(stdout);
58 	fflush(stderr);
59 	if (original_sigsegv_handler == zend_handle_sigsegv) {
60 		signal(SIGSEGV, original_sigsegv_handler);
61 	} else {
62 		signal(SIGSEGV, SIG_DFL);
63 	}
64 	{
65 
66 		fprintf(stderr, "SIGSEGV caught on opcode %d on opline %d of %s() at %s:%d\n\n",
67 				active_opline->opcode,
68 				active_opline-EG(active_op_array)->opcodes,
69 				get_active_function_name(),
70 				zend_get_executed_filename(),
71 				zend_get_executed_lineno());
72 /* See http://support.microsoft.com/kb/190351 */
73 #ifdef ZEND_WIN32
74 		fflush(stderr);
75 #endif
76 	}
77 	if (original_sigsegv_handler!=zend_handle_sigsegv) {
78 		original_sigsegv_handler(dummy);
79 	}
80 }
81 /* }}} */
82 #endif
83 
zend_extension_activator(zend_extension * extension)84 static void zend_extension_activator(zend_extension *extension) /* {{{ */
85 {
86 	if (extension->activate) {
87 		extension->activate();
88 	}
89 }
90 /* }}} */
91 
zend_extension_deactivator(zend_extension * extension)92 static void zend_extension_deactivator(zend_extension *extension) /* {{{ */
93 {
94 	if (extension->deactivate) {
95 		extension->deactivate();
96 	}
97 }
98 /* }}} */
99 
clean_non_persistent_function(zval * zv)100 static int clean_non_persistent_function(zval *zv) /* {{{ */
101 {
102 	zend_function *function = Z_PTR_P(zv);
103 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_STOP : ZEND_HASH_APPLY_REMOVE;
104 }
105 /* }}} */
106 
clean_non_persistent_function_full(zval * zv)107 ZEND_API int clean_non_persistent_function_full(zval *zv) /* {{{ */
108 {
109 	zend_function *function = Z_PTR_P(zv);
110 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
111 }
112 /* }}} */
113 
clean_non_persistent_class(zval * zv)114 static int clean_non_persistent_class(zval *zv) /* {{{ */
115 {
116 	zend_class_entry *ce = Z_PTR_P(zv);
117 	return (ce->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_STOP : ZEND_HASH_APPLY_REMOVE;
118 }
119 /* }}} */
120 
clean_non_persistent_class_full(zval * zv)121 ZEND_API int clean_non_persistent_class_full(zval *zv) /* {{{ */
122 {
123 	zend_class_entry *ce = Z_PTR_P(zv);
124 	return (ce->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
125 }
126 /* }}} */
127 
init_executor(void)128 void init_executor(void) /* {{{ */
129 {
130 	zend_init_fpu();
131 
132 	ZVAL_NULL(&EG(uninitialized_zval));
133 	ZVAL_NULL(&EG(error_zval));
134 /* destroys stack frame, therefore makes core dumps worthless */
135 #if 0&&ZEND_DEBUG
136 	original_sigsegv_handler = signal(SIGSEGV, zend_handle_sigsegv);
137 #endif
138 
139 	EG(symtable_cache_ptr) = EG(symtable_cache) - 1;
140 	EG(symtable_cache_limit) = EG(symtable_cache) + SYMTABLE_CACHE_SIZE - 1;
141 	EG(no_extensions) = 0;
142 
143 	EG(function_table) = CG(function_table);
144 	EG(class_table) = CG(class_table);
145 
146 	EG(in_autoload) = NULL;
147 	EG(autoload_func) = NULL;
148 	EG(error_handling) = EH_NORMAL;
149 
150 	zend_vm_stack_init();
151 
152 	zend_hash_init(&EG(symbol_table), 64, NULL, ZVAL_PTR_DTOR, 0);
153 	EG(valid_symbol_table) = 1;
154 
155 	zend_llist_apply(&zend_extensions, (llist_apply_func_t) zend_extension_activator);
156 
157 	zend_hash_init(&EG(included_files), 8, NULL, NULL, 0);
158 
159 	EG(ticks_count) = 0;
160 
161 	ZVAL_UNDEF(&EG(user_error_handler));
162 
163 	EG(current_execute_data) = NULL;
164 
165 	zend_stack_init(&EG(user_error_handlers_error_reporting), sizeof(int));
166 	zend_stack_init(&EG(user_error_handlers), sizeof(zval));
167 	zend_stack_init(&EG(user_exception_handlers), sizeof(zval));
168 
169 	zend_objects_store_init(&EG(objects_store), 1024);
170 
171 	EG(full_tables_cleanup) = 0;
172 #ifdef ZEND_WIN32
173 	EG(timed_out) = 0;
174 #endif
175 
176 	EG(exception) = NULL;
177 	EG(prev_exception) = NULL;
178 
179 	EG(scope) = NULL;
180 
181 	EG(ht_iterators_count) = sizeof(EG(ht_iterators_slots)) / sizeof(HashTableIterator);
182 	EG(ht_iterators_used) = 0;
183 	EG(ht_iterators) = EG(ht_iterators_slots);
184 	memset(EG(ht_iterators), 0, sizeof(EG(ht_iterators_slots)));
185 
186 	EG(active) = 1;
187 }
188 /* }}} */
189 
zval_call_destructor(zval * zv)190 static int zval_call_destructor(zval *zv) /* {{{ */
191 {
192 	if (Z_TYPE_P(zv) == IS_INDIRECT) {
193 		zv = Z_INDIRECT_P(zv);
194 	}
195 	if (Z_TYPE_P(zv) == IS_OBJECT && Z_REFCOUNT_P(zv) == 1) {
196 		return ZEND_HASH_APPLY_REMOVE;
197 	} else {
198 		return ZEND_HASH_APPLY_KEEP;
199 	}
200 }
201 /* }}} */
202 
zend_unclean_zval_ptr_dtor(zval * zv)203 static void zend_unclean_zval_ptr_dtor(zval *zv) /* {{{ */
204 {
205 	if (Z_TYPE_P(zv) == IS_INDIRECT) {
206 		zv = Z_INDIRECT_P(zv);
207 	}
208 	i_zval_ptr_dtor(zv ZEND_FILE_LINE_CC);
209 }
210 /* }}} */
211 
zend_throw_or_error(int fetch_type,zend_class_entry * exception_ce,const char * format,...)212 static void zend_throw_or_error(int fetch_type, zend_class_entry *exception_ce, const char *format, ...) /* {{{ */
213 {
214 	va_list va;
215 	char *message = NULL;
216 
217 	va_start(va, format);
218 	zend_vspprintf(&message, 0, format, va);
219 
220 	if (fetch_type & ZEND_FETCH_CLASS_EXCEPTION) {
221 		zend_throw_error(exception_ce, "%s", message);
222 	} else {
223 		zend_error(E_ERROR, "%s", message);
224 	}
225 
226 	efree(message);
227 	va_end(va);
228 }
229 /* }}} */
230 
shutdown_destructors(void)231 void shutdown_destructors(void) /* {{{ */
232 {
233 	if (CG(unclean_shutdown)) {
234 		EG(symbol_table).pDestructor = zend_unclean_zval_ptr_dtor;
235 	}
236 	zend_try {
237 		uint32_t symbols;
238 		do {
239 			symbols = zend_hash_num_elements(&EG(symbol_table));
240 			zend_hash_reverse_apply(&EG(symbol_table), (apply_func_t) zval_call_destructor);
241 		} while (symbols != zend_hash_num_elements(&EG(symbol_table)));
242 		zend_objects_store_call_destructors(&EG(objects_store));
243 	} zend_catch {
244 		/* if we couldn't destruct cleanly, mark all objects as destructed anyway */
245 		zend_objects_store_mark_destructed(&EG(objects_store));
246 	} zend_end_try();
247 }
248 /* }}} */
249 
shutdown_executor(void)250 void shutdown_executor(void) /* {{{ */
251 {
252 	zend_function *func;
253 	zend_class_entry *ce;
254 
255 	zend_try {
256 
257 /* Removed because this can not be safely done, e.g. in this situation:
258    Object 1 creates object 2
259    Object 3 holds reference to object 2.
260    Now when 1 and 2 are destroyed, 3 can still access 2 in its destructor, with
261    very problematic results */
262 /* 		zend_objects_store_call_destructors(&EG(objects_store)); */
263 
264 /* Moved after symbol table cleaners, because  some of the cleaners can call
265    destructors, which would use EG(symtable_cache_ptr) and thus leave leaks */
266 /*		while (EG(symtable_cache_ptr)>=EG(symtable_cache)) {
267 			zend_hash_destroy(*EG(symtable_cache_ptr));
268 			efree(*EG(symtable_cache_ptr));
269 			EG(symtable_cache_ptr)--;
270 		}
271 */
272 		zend_llist_apply(&zend_extensions, (llist_apply_func_t) zend_extension_deactivator);
273 
274 		if (CG(unclean_shutdown)) {
275 			EG(symbol_table).pDestructor = zend_unclean_zval_ptr_dtor;
276 		}
277 		zend_hash_graceful_reverse_destroy(&EG(symbol_table));
278 	} zend_end_try();
279 	EG(valid_symbol_table) = 0;
280 
281 	zend_try {
282 		zval *zeh;
283 		/* remove error handlers before destroying classes and functions,
284 		 * so that if handler used some class, crash would not happen */
285 		if (Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
286 			zeh = &EG(user_error_handler);
287 			zval_ptr_dtor(zeh);
288 			ZVAL_UNDEF(&EG(user_error_handler));
289 		}
290 
291 		if (Z_TYPE(EG(user_exception_handler)) != IS_UNDEF) {
292 			zeh = &EG(user_exception_handler);
293 			zval_ptr_dtor(zeh);
294 			ZVAL_UNDEF(&EG(user_exception_handler));
295 		}
296 
297 		zend_stack_clean(&EG(user_error_handlers_error_reporting), NULL, 1);
298 		zend_stack_clean(&EG(user_error_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
299 		zend_stack_clean(&EG(user_exception_handlers), (void (*)(void *))ZVAL_PTR_DTOR, 1);
300 	} zend_end_try();
301 
302 	zend_try {
303 		/* Cleanup static data for functions and arrays.
304 		 * We need a separate cleanup stage because of the following problem:
305 		 * Suppose we destroy class X, which destroys the class's function table,
306 		 * and in the function table we have function foo() that has static $bar.
307 		 * Now if an object of class X is assigned to $bar, its destructor will be
308 		 * called and will fail since X's function table is in mid-destruction.
309 		 * So we want first of all to clean up all data and then move to tables destruction.
310 		 * Note that only run-time accessed data need to be cleaned up, pre-defined data can
311 		 * not contain objects and thus are not probelmatic */
312 		if (EG(full_tables_cleanup)) {
313 			ZEND_HASH_FOREACH_PTR(EG(function_table), func) {
314 				if (func->type == ZEND_USER_FUNCTION) {
315 					zend_cleanup_op_array_data((zend_op_array *) func);
316 				}
317 			} ZEND_HASH_FOREACH_END();
318 			ZEND_HASH_REVERSE_FOREACH_PTR(EG(class_table), ce) {
319 				if (ce->type == ZEND_USER_CLASS) {
320 					zend_cleanup_user_class_data(ce);
321 				} else {
322 					zend_cleanup_internal_class_data(ce);
323 				}
324 			} ZEND_HASH_FOREACH_END();
325 		} else {
326 			ZEND_HASH_REVERSE_FOREACH_PTR(EG(function_table), func) {
327 				if (func->type != ZEND_USER_FUNCTION) {
328 					break;
329 				}
330 				zend_cleanup_op_array_data((zend_op_array *) func);
331 			} ZEND_HASH_FOREACH_END();
332 			ZEND_HASH_REVERSE_FOREACH_PTR(EG(class_table), ce) {
333 				if (ce->type != ZEND_USER_CLASS) {
334 					break;
335 				}
336 				zend_cleanup_user_class_data(ce);
337 			} ZEND_HASH_FOREACH_END();
338 			zend_cleanup_internal_classes();
339 		}
340 	} zend_end_try();
341 
342 	zend_try {
343 		zend_llist_destroy(&CG(open_files));
344 	} zend_end_try();
345 
346 	zend_try {
347 		clean_non_persistent_constants();
348     } zend_end_try();
349 
350 	zend_try {
351 		zend_close_rsrc_list(&EG(regular_list));
352 	} zend_end_try();
353 
354 #if ZEND_DEBUG
355 	if (GC_G(gc_enabled) && !CG(unclean_shutdown)) {
356 		gc_collect_cycles();
357 	}
358 #endif
359 
360 	zend_try {
361 		zend_objects_store_free_object_storage(&EG(objects_store));
362 
363 		zend_vm_stack_destroy();
364 
365 		/* Destroy all op arrays */
366 		if (EG(full_tables_cleanup)) {
367 			zend_hash_reverse_apply(EG(function_table), clean_non_persistent_function_full);
368 			zend_hash_reverse_apply(EG(class_table), clean_non_persistent_class_full);
369 		} else {
370 			zend_hash_reverse_apply(EG(function_table), clean_non_persistent_function);
371 			zend_hash_reverse_apply(EG(class_table), clean_non_persistent_class);
372 		}
373 
374 		while (EG(symtable_cache_ptr)>=EG(symtable_cache)) {
375 			zend_hash_destroy(*EG(symtable_cache_ptr));
376 			FREE_HASHTABLE(*EG(symtable_cache_ptr));
377 			EG(symtable_cache_ptr)--;
378 		}
379 	} zend_end_try();
380 
381 	zend_try {
382 #if 0&&ZEND_DEBUG
383 	signal(SIGSEGV, original_sigsegv_handler);
384 #endif
385 
386 		zend_hash_destroy(&EG(included_files));
387 
388 		zend_stack_destroy(&EG(user_error_handlers_error_reporting));
389 		zend_stack_destroy(&EG(user_error_handlers));
390 		zend_stack_destroy(&EG(user_exception_handlers));
391 		zend_objects_store_destroy(&EG(objects_store));
392 		if (EG(in_autoload)) {
393 			zend_hash_destroy(EG(in_autoload));
394 			FREE_HASHTABLE(EG(in_autoload));
395 		}
396 	} zend_end_try();
397 
398 	zend_shutdown_fpu();
399 
400 #if ZEND_DEBUG
401 	if (EG(ht_iterators_used) && !CG(unclean_shutdown)) {
402 		zend_error(E_WARNING, "Leaked %" PRIu32 " hashtable iterators", EG(ht_iterators_used));
403 	}
404 #endif
405 
406 	EG(ht_iterators_used) = 0;
407 	if (EG(ht_iterators) != EG(ht_iterators_slots)) {
408 		efree(EG(ht_iterators));
409 	}
410 
411 	EG(active) = 0;
412 }
413 /* }}} */
414 
415 /* return class name and "::" or "". */
get_active_class_name(const char ** space)416 ZEND_API const char *get_active_class_name(const char **space) /* {{{ */
417 {
418 	zend_function *func;
419 
420 	if (!zend_is_executing()) {
421 		if (space) {
422 			*space = "";
423 		}
424 		return "";
425 	}
426 
427 	func = EG(current_execute_data)->func;
428 	switch (func->type) {
429 		case ZEND_USER_FUNCTION:
430 		case ZEND_INTERNAL_FUNCTION:
431 		{
432 			zend_class_entry *ce = func->common.scope;
433 
434 			if (space) {
435 				*space = ce ? "::" : "";
436 			}
437 			return ce ? ZSTR_VAL(ce->name) : "";
438 		}
439 		default:
440 			if (space) {
441 				*space = "";
442 			}
443 			return "";
444 	}
445 }
446 /* }}} */
447 
get_active_function_name(void)448 ZEND_API const char *get_active_function_name(void) /* {{{ */
449 {
450 	zend_function *func;
451 
452 	if (!zend_is_executing()) {
453 		return NULL;
454 	}
455 	func = EG(current_execute_data)->func;
456 	switch (func->type) {
457 		case ZEND_USER_FUNCTION: {
458 				zend_string *function_name = func->common.function_name;
459 
460 				if (function_name) {
461 					return ZSTR_VAL(function_name);
462 				} else {
463 					return "main";
464 				}
465 			}
466 			break;
467 		case ZEND_INTERNAL_FUNCTION:
468 			return ZSTR_VAL(func->common.function_name);
469 			break;
470 		default:
471 			return NULL;
472 	}
473 }
474 /* }}} */
475 
zend_get_executed_filename(void)476 ZEND_API const char *zend_get_executed_filename(void) /* {{{ */
477 {
478 	zend_execute_data *ex = EG(current_execute_data);
479 
480 	while (ex && (!ex->func || !ZEND_USER_CODE(ex->func->type))) {
481 		ex = ex->prev_execute_data;
482 	}
483 	if (ex) {
484 		return ZSTR_VAL(ex->func->op_array.filename);
485 	} else {
486 		return "[no active file]";
487 	}
488 }
489 /* }}} */
490 
zend_get_executed_filename_ex(void)491 ZEND_API zend_string *zend_get_executed_filename_ex(void) /* {{{ */
492 {
493 	zend_execute_data *ex = EG(current_execute_data);
494 
495 	while (ex && (!ex->func || !ZEND_USER_CODE(ex->func->type))) {
496 		ex = ex->prev_execute_data;
497 	}
498 	if (ex) {
499 		return ex->func->op_array.filename;
500 	} else {
501 		return NULL;
502 	}
503 }
504 /* }}} */
505 
zend_get_executed_lineno(void)506 ZEND_API uint zend_get_executed_lineno(void) /* {{{ */
507 {
508 	zend_execute_data *ex = EG(current_execute_data);
509 
510 	while (ex && (!ex->func || !ZEND_USER_CODE(ex->func->type))) {
511 		ex = ex->prev_execute_data;
512 	}
513 	if (ex) {
514 		if (EG(exception) && ex->opline->opcode == ZEND_HANDLE_EXCEPTION &&
515 		    ex->opline->lineno == 0 && EG(opline_before_exception)) {
516 			return EG(opline_before_exception)->lineno;
517 		}
518 		return ex->opline->lineno;
519 	} else {
520 		return 0;
521 	}
522 }
523 /* }}} */
524 
zend_is_executing(void)525 ZEND_API zend_bool zend_is_executing(void) /* {{{ */
526 {
527 	return EG(current_execute_data) != 0;
528 }
529 /* }}} */
530 
_zval_ptr_dtor(zval * zval_ptr ZEND_FILE_LINE_DC)531 ZEND_API void _zval_ptr_dtor(zval *zval_ptr ZEND_FILE_LINE_DC) /* {{{ */
532 {
533 	i_zval_ptr_dtor(zval_ptr ZEND_FILE_LINE_RELAY_CC);
534 }
535 /* }}} */
536 
_zval_internal_ptr_dtor(zval * zval_ptr ZEND_FILE_LINE_DC)537 ZEND_API void _zval_internal_ptr_dtor(zval *zval_ptr ZEND_FILE_LINE_DC) /* {{{ */
538 {
539 	if (Z_REFCOUNTED_P(zval_ptr)) {
540 		Z_DELREF_P(zval_ptr);
541 		if (Z_REFCOUNT_P(zval_ptr) == 0) {
542 			_zval_internal_dtor_for_ptr(zval_ptr ZEND_FILE_LINE_CC);
543 		}
544 	}
545 }
546 /* }}} */
547 
548 #define IS_VISITED_CONSTANT			0x80
549 #define IS_CONSTANT_VISITED(p)		(Z_TYPE_P(p) & IS_VISITED_CONSTANT)
550 #define MARK_CONSTANT_VISITED(p)	Z_TYPE_INFO_P(p) |= IS_VISITED_CONSTANT
551 #define RESET_CONSTANT_VISITED(p)	Z_TYPE_INFO_P(p) &= ~IS_VISITED_CONSTANT
552 
zval_update_constant_ex(zval * p,zend_bool inline_change,zend_class_entry * scope)553 ZEND_API int zval_update_constant_ex(zval *p, zend_bool inline_change, zend_class_entry *scope) /* {{{ */
554 {
555 	zval *const_value;
556 	char *colon;
557 
558 	if (IS_CONSTANT_VISITED(p)) {
559 		zend_throw_error(NULL, "Cannot declare self-referencing constant '%s'", Z_STRVAL_P(p));
560 		return FAILURE;
561 	} else if (Z_TYPE_P(p) == IS_CONSTANT) {
562 
563 		SEPARATE_ZVAL_NOREF(p);
564 		MARK_CONSTANT_VISITED(p);
565 		if (Z_CONST_FLAGS_P(p) & IS_CONSTANT_CLASS) {
566 			ZEND_ASSERT(EG(current_execute_data));
567 			if (inline_change) {
568 				zend_string_release(Z_STR_P(p));
569 			}
570 			if (EG(scope) && EG(scope)->name) {
571 				ZVAL_STR_COPY(p, EG(scope)->name);
572 			} else {
573 				ZVAL_EMPTY_STRING(p);
574 			}
575 		} else if (UNEXPECTED((const_value = zend_get_constant_ex(Z_STR_P(p), scope, Z_CONST_FLAGS_P(p))) == NULL)) {
576 			if (UNEXPECTED(EG(exception))) {
577 				RESET_CONSTANT_VISITED(p);
578 				return FAILURE;
579 			} else if ((colon = (char*)zend_memrchr(Z_STRVAL_P(p), ':', Z_STRLEN_P(p)))) {
580 				zend_throw_error(NULL, "Undefined class constant '%s'", Z_STRVAL_P(p));
581 				RESET_CONSTANT_VISITED(p);
582 				return FAILURE;
583 			} else {
584 				zend_string *save = Z_STR_P(p);
585 				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) == 0) {
586 					if (ZSTR_VAL(save)[0] == '\\') {
587 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save) + 1);
588 					} else {
589 						zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save));
590 					}
591 					RESET_CONSTANT_VISITED(p);
592 					return FAILURE;
593 				} else {
594 					char *actual = Z_STRVAL_P(p);
595 					size_t actual_len = Z_STRLEN_P(p);
596 					char *slash = (char *) zend_memrchr(actual, '\\', actual_len);
597 					if (slash) {
598 						actual = slash + 1;
599 						actual_len -= (actual - Z_STRVAL_P(p));
600 					}
601 
602 					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'", actual, actual);
603 					if (EG(exception)) {
604 						RESET_CONSTANT_VISITED(p);
605 						return FAILURE;
606 					}
607 
608 					if (!inline_change) {
609 						ZVAL_STRINGL(p, actual, actual_len);
610 					} else {
611 						if (slash) {
612 							ZVAL_STRINGL(p, actual, actual_len);
613 							zend_string_release(save);
614 						} else {
615 							Z_TYPE_INFO_P(p) = Z_REFCOUNTED_P(p) ?
616 								IS_STRING_EX : IS_INTERNED_STRING_EX;
617 						}
618 					}
619 				}
620 			}
621 		} else {
622 			if (inline_change) {
623 				zend_string_release(Z_STR_P(p));
624 			}
625 			ZVAL_COPY_VALUE(p, const_value);
626 			if (Z_OPT_CONSTANT_P(p)) {
627 				if (UNEXPECTED(zval_update_constant_ex(p, 1, NULL) != SUCCESS)) {
628 					RESET_CONSTANT_VISITED(p);
629 					return FAILURE;
630 				}
631 			}
632 			zval_opt_copy_ctor(p);
633 		}
634 	} else if (Z_TYPE_P(p) == IS_CONSTANT_AST) {
635 		zval tmp;
636 
637 		if (UNEXPECTED(zend_ast_evaluate(&tmp, Z_ASTVAL_P(p), scope) != SUCCESS)) {
638 			return FAILURE;
639 		}
640 		if (inline_change) {
641 			zval_ptr_dtor(p);
642 		}
643 		ZVAL_COPY_VALUE(p, &tmp);
644 	}
645 	return SUCCESS;
646 }
647 /* }}} */
648 
zval_update_constant(zval * pp,zend_bool inline_change)649 ZEND_API int zval_update_constant(zval *pp, zend_bool inline_change) /* {{{ */
650 {
651 	return zval_update_constant_ex(pp, inline_change, NULL);
652 }
653 /* }}} */
654 
call_user_function(HashTable * function_table,zval * object,zval * function_name,zval * retval_ptr,uint32_t param_count,zval params[])655 int call_user_function(HashTable *function_table, zval *object, zval *function_name, zval *retval_ptr, uint32_t param_count, zval params[]) /* {{{ */
656 {
657 	return call_user_function_ex(function_table, object, function_name, retval_ptr, param_count, params, 1, NULL);
658 }
659 /* }}} */
660 
call_user_function_ex(HashTable * function_table,zval * object,zval * function_name,zval * retval_ptr,uint32_t param_count,zval params[],int no_separation,zend_array * symbol_table)661 int call_user_function_ex(HashTable *function_table, zval *object, zval *function_name, zval *retval_ptr, uint32_t param_count, zval params[], int no_separation, zend_array *symbol_table) /* {{{ */
662 {
663 	zend_fcall_info fci;
664 
665 	fci.size = sizeof(fci);
666 	fci.function_table = function_table;
667 	fci.object = object ? Z_OBJ_P(object) : NULL;
668 	ZVAL_COPY_VALUE(&fci.function_name, function_name);
669 	fci.retval = retval_ptr;
670 	fci.param_count = param_count;
671 	fci.params = params;
672 	fci.no_separation = (zend_bool) no_separation;
673 	fci.symbol_table = symbol_table;
674 
675 	return zend_call_function(&fci, NULL);
676 }
677 /* }}} */
678 
zend_call_function(zend_fcall_info * fci,zend_fcall_info_cache * fci_cache)679 int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /* {{{ */
680 {
681 	uint32_t i;
682 	zend_class_entry *calling_scope = NULL;
683 	zend_execute_data *call, dummy_execute_data;
684 	zend_fcall_info_cache fci_cache_local;
685 	zend_function *func;
686 	zend_class_entry *orig_scope;
687 
688 	ZVAL_UNDEF(fci->retval);
689 
690 	if (!EG(active)) {
691 		return FAILURE; /* executor is already inactive */
692 	}
693 
694 	if (EG(exception)) {
695 		return FAILURE; /* we would result in an instable executor otherwise */
696 	}
697 
698 	switch (fci->size) {
699 		case sizeof(zend_fcall_info):
700 			break; /* nothing to do currently */
701 		default:
702 			zend_error_noreturn(E_CORE_ERROR, "Corrupted fcall_info provided to zend_call_function()");
703 			break;
704 	}
705 
706 	orig_scope = EG(scope);
707 
708 	/* Initialize execute_data */
709 	if (!EG(current_execute_data)) {
710 		/* This only happens when we're called outside any execute()'s
711 		 * It shouldn't be strictly necessary to NULL execute_data out,
712 		 * but it may make bugs easier to spot
713 		 */
714 		memset(&dummy_execute_data, 0, sizeof(zend_execute_data));
715 		EG(current_execute_data) = &dummy_execute_data;
716 	} else if (EG(current_execute_data)->func &&
717 	           ZEND_USER_CODE(EG(current_execute_data)->func->common.type) &&
718 	           EG(current_execute_data)->opline->opcode != ZEND_DO_FCALL &&
719 	           EG(current_execute_data)->opline->opcode != ZEND_DO_ICALL &&
720 	           EG(current_execute_data)->opline->opcode != ZEND_DO_UCALL &&
721 	           EG(current_execute_data)->opline->opcode != ZEND_DO_FCALL_BY_NAME) {
722 		/* Insert fake frame in case of include or magic calls */
723 		dummy_execute_data = *EG(current_execute_data);
724 		dummy_execute_data.prev_execute_data = EG(current_execute_data);
725 		dummy_execute_data.call = NULL;
726 		dummy_execute_data.opline = NULL;
727 		dummy_execute_data.func = NULL;
728 		EG(current_execute_data) = &dummy_execute_data;
729 	}
730 
731 	if (!fci_cache || !fci_cache->initialized) {
732 		zend_string *callable_name;
733 		char *error = NULL;
734 
735 		if (!fci_cache) {
736 			fci_cache = &fci_cache_local;
737 		}
738 
739 		if (!zend_is_callable_ex(&fci->function_name, fci->object, IS_CALLABLE_CHECK_SILENT, &callable_name, fci_cache, &error)) {
740 			if (error) {
741 				zend_error(E_WARNING, "Invalid callback %s, %s", ZSTR_VAL(callable_name), error);
742 				efree(error);
743 			}
744 			if (callable_name) {
745 				zend_string_release(callable_name);
746 			}
747 			if (EG(current_execute_data) == &dummy_execute_data) {
748 				EG(current_execute_data) = dummy_execute_data.prev_execute_data;
749 			}
750 			return FAILURE;
751 		} else if (error) {
752 			/* Capitalize the first latter of the error message */
753 			if (error[0] >= 'a' && error[0] <= 'z') {
754 				error[0] += ('A' - 'a');
755 			}
756 			zend_error(E_DEPRECATED, "%s", error);
757 			efree(error);
758 			if (UNEXPECTED(EG(exception))) {
759 				if (callable_name) {
760 					zend_string_release(callable_name);
761 				}
762 				if (EG(current_execute_data) == &dummy_execute_data) {
763 					EG(current_execute_data) = dummy_execute_data.prev_execute_data;
764 				}
765 				return FAILURE;
766 			}
767 		}
768 		zend_string_release(callable_name);
769 	}
770 
771 	func = fci_cache->function_handler;
772 	call = zend_vm_stack_push_call_frame(ZEND_CALL_TOP_FUNCTION,
773 		func, fci->param_count, fci_cache->called_scope, fci_cache->object);
774 	calling_scope = fci_cache->calling_scope;
775 	fci->object = fci_cache->object;
776 	if (fci->object &&
777 	    (!EG(objects_store).object_buckets ||
778 	     !IS_OBJ_VALID(EG(objects_store).object_buckets[fci->object->handle]))) {
779 		if (EG(current_execute_data) == &dummy_execute_data) {
780 			EG(current_execute_data) = dummy_execute_data.prev_execute_data;
781 		}
782 		return FAILURE;
783 	}
784 
785 	if (func->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) {
786 		if (func->common.fn_flags & ZEND_ACC_ABSTRACT) {
787 			zend_throw_error(NULL, "Cannot call abstract method %s::%s()", ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
788 			if (EG(current_execute_data) == &dummy_execute_data) {
789 				EG(current_execute_data) = dummy_execute_data.prev_execute_data;
790 			}
791 			return FAILURE;
792 		}
793 		if (func->common.fn_flags & ZEND_ACC_DEPRECATED) {
794  			zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
795 				func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
796 				func->common.scope ? "::" : "",
797 				ZSTR_VAL(func->common.function_name));
798 		}
799 	}
800 
801 	for (i=0; i<fci->param_count; i++) {
802 		zval *param;
803 		zval *arg = &fci->params[i];
804 
805 		if (ARG_SHOULD_BE_SENT_BY_REF(func, i + 1)) {
806 			if (UNEXPECTED(!Z_ISREF_P(arg))) {
807 				if (fci->no_separation &&
808 					!ARG_MAY_BE_SENT_BY_REF(func, i + 1)) {
809 					if (i) {
810 						/* hack to clean up the stack */
811 						ZEND_CALL_NUM_ARGS(call) = i;
812 						zend_vm_stack_free_args(call);
813 					}
814 					zend_vm_stack_free_call_frame(call);
815 
816 					zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
817 						i+1,
818 						func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
819 						func->common.scope ? "::" : "",
820 						ZSTR_VAL(func->common.function_name));
821 					if (EG(current_execute_data) == &dummy_execute_data) {
822 						EG(current_execute_data) = dummy_execute_data.prev_execute_data;
823 					}
824 					return FAILURE;
825 				}
826 
827 				ZVAL_NEW_REF(arg, arg);
828 			}
829 			Z_ADDREF_P(arg);
830 		} else {
831 			if (Z_ISREF_P(arg) &&
832 			    !(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
833 				/* don't separate references for __call */
834 				arg = Z_REFVAL_P(arg);
835 			}
836 			if (Z_OPT_REFCOUNTED_P(arg)) {
837 				Z_ADDREF_P(arg);
838 			}
839 		}
840 		param = ZEND_CALL_ARG(call, i+1);
841 		ZVAL_COPY_VALUE(param, arg);
842 	}
843 
844 	EG(scope) = calling_scope;
845 	if (func->common.fn_flags & ZEND_ACC_STATIC) {
846 		fci->object = NULL;
847 	}
848 	Z_OBJ(call->This) = fci->object;
849 
850 	if (UNEXPECTED(func->op_array.fn_flags & ZEND_ACC_CLOSURE)) {
851 		ZEND_ASSERT(GC_TYPE((zend_object*)func->op_array.prototype) == IS_OBJECT);
852 		GC_REFCOUNT((zend_object*)func->op_array.prototype)++;
853 		ZEND_ADD_CALL_FLAG(call, ZEND_CALL_CLOSURE);
854 	}
855 
856 	/* PHP-7 doesn't support symbol_table substitution for functions */
857 	ZEND_ASSERT(fci->symbol_table == NULL);
858 
859 	if (func->type == ZEND_USER_FUNCTION) {
860 		int call_via_handler = (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) != 0;
861 		EG(scope) = func->common.scope;
862 		call->symbol_table = fci->symbol_table;
863 		if (EXPECTED((func->op_array.fn_flags & ZEND_ACC_GENERATOR) == 0)) {
864 			const zend_op *current_opline_before_exception = EG(opline_before_exception);
865 
866 			zend_init_execute_data(call, &func->op_array, fci->retval);
867 			zend_execute_ex(call);
868 			EG(opline_before_exception) = current_opline_before_exception;
869 		} else {
870 			zend_generator_create_zval(call, &func->op_array, fci->retval);
871 		}
872 		if (call_via_handler) {
873 			/* We must re-initialize function again */
874 			fci_cache->initialized = 0;
875 		}
876 	} else if (func->type == ZEND_INTERNAL_FUNCTION) {
877 		int call_via_handler = (func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) != 0;
878 		ZVAL_NULL(fci->retval);
879 		if (func->common.scope) {
880 			EG(scope) = func->common.scope;
881 		}
882 		call->prev_execute_data = EG(current_execute_data);
883 		call->return_value = NULL; /* this is not a constructor call */
884 		EG(current_execute_data) = call;
885 		if (EXPECTED(zend_execute_internal == NULL)) {
886 			/* saves one function call if zend_execute_internal is not used */
887 			func->internal_function.handler(call, fci->retval);
888 		} else {
889 			zend_execute_internal(call, fci->retval);
890 		}
891 		EG(current_execute_data) = call->prev_execute_data;
892 		zend_vm_stack_free_args(call);
893 
894 		/*  We shouldn't fix bad extensions here,
895 			because it can break proper ones (Bug #34045)
896 		if (!EX(function_state).function->common.return_reference)
897 		{
898 			INIT_PZVAL(f->retval);
899 		}*/
900 		if (EG(exception)) {
901 			zval_ptr_dtor(fci->retval);
902 			ZVAL_UNDEF(fci->retval);
903 		}
904 
905 		if (call_via_handler) {
906 			/* We must re-initialize function again */
907 			fci_cache->initialized = 0;
908 		}
909 	} else { /* ZEND_OVERLOADED_FUNCTION */
910 		ZVAL_NULL(fci->retval);
911 
912 		/* Not sure what should be done here if it's a static method */
913 		if (fci->object) {
914 			call->prev_execute_data = EG(current_execute_data);
915 			EG(current_execute_data) = call;
916 			fci->object->handlers->call_method(func->common.function_name, fci->object, call, fci->retval);
917 			EG(current_execute_data) = call->prev_execute_data;
918 		} else {
919 			zend_throw_error(NULL, "Cannot call overloaded function for non-object");
920 		}
921 
922 		zend_vm_stack_free_args(call);
923 
924 		if (func->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) {
925 			zend_string_release(func->common.function_name);
926 		}
927 		efree(func);
928 
929 		if (EG(exception)) {
930 			zval_ptr_dtor(fci->retval);
931 			ZVAL_UNDEF(fci->retval);
932 		}
933 	}
934 
935 	EG(scope) = orig_scope;
936 	zend_vm_stack_free_call_frame(call);
937 
938 	if (EG(current_execute_data) == &dummy_execute_data) {
939 		EG(current_execute_data) = dummy_execute_data.prev_execute_data;
940 	}
941 
942 	if (EG(exception)) {
943 		zend_throw_exception_internal(NULL);
944 	}
945 	return SUCCESS;
946 }
947 /* }}} */
948 
zend_lookup_class_ex(zend_string * name,const zval * key,int use_autoload)949 ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, const zval *key, int use_autoload) /* {{{ */
950 {
951 	zend_class_entry *ce = NULL;
952 	zval args[1];
953 	zval local_retval;
954 	zend_string *lc_name;
955 	zend_fcall_info fcall_info;
956 	zend_fcall_info_cache fcall_cache;
957 
958 	if (key) {
959 		lc_name = Z_STR_P(key);
960 	} else {
961 		if (name == NULL || !ZSTR_LEN(name)) {
962 			return NULL;
963 		}
964 
965 		if (ZSTR_VAL(name)[0] == '\\') {
966 			lc_name = zend_string_alloc(ZSTR_LEN(name) - 1, 0);
967 			zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1);
968 		} else {
969 			lc_name = zend_string_tolower(name);
970 		}
971 	}
972 
973 	ce = zend_hash_find_ptr(EG(class_table), lc_name);
974 	if (ce) {
975 		if (!key) {
976 			zend_string_release(lc_name);
977 		}
978 		return ce;
979 	}
980 
981 	/* The compiler is not-reentrant. Make sure we __autoload() only during run-time
982 	 * (doesn't impact functionality of __autoload()
983 	*/
984 	if (!use_autoload || zend_is_compiling()) {
985 		if (!key) {
986 			zend_string_release(lc_name);
987 		}
988 		return NULL;
989 	}
990 
991 	if (!EG(autoload_func)) {
992 		zend_function *func = zend_hash_str_find_ptr(EG(function_table), ZEND_AUTOLOAD_FUNC_NAME, sizeof(ZEND_AUTOLOAD_FUNC_NAME) - 1);
993 		if (func) {
994 			EG(autoload_func) = func;
995 		} else {
996 			if (!key) {
997 				zend_string_release(lc_name);
998 			}
999 			return NULL;
1000 		}
1001 
1002 	}
1003 
1004 	/* Verify class name before passing it to __autoload() */
1005 	if (strspn(ZSTR_VAL(name), "0123456789_abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\\") != ZSTR_LEN(name)) {
1006 		if (!key) {
1007 			zend_string_release(lc_name);
1008 		}
1009 		return NULL;
1010 	}
1011 
1012 	if (EG(in_autoload) == NULL) {
1013 		ALLOC_HASHTABLE(EG(in_autoload));
1014 		zend_hash_init(EG(in_autoload), 8, NULL, NULL, 0);
1015 	}
1016 
1017 	if (zend_hash_add_empty_element(EG(in_autoload), lc_name) == NULL) {
1018 		if (!key) {
1019 			zend_string_release(lc_name);
1020 		}
1021 		return NULL;
1022 	}
1023 
1024 	ZVAL_UNDEF(&local_retval);
1025 
1026 	if (ZSTR_VAL(name)[0] == '\\') {
1027 		ZVAL_STRINGL(&args[0], ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1);
1028 	} else {
1029 		ZVAL_STR_COPY(&args[0], name);
1030 	}
1031 
1032 	fcall_info.size = sizeof(fcall_info);
1033 	fcall_info.function_table = EG(function_table);
1034 	ZVAL_STR_COPY(&fcall_info.function_name, EG(autoload_func)->common.function_name);
1035 	fcall_info.symbol_table = NULL;
1036 	fcall_info.retval = &local_retval;
1037 	fcall_info.param_count = 1;
1038 	fcall_info.params = args;
1039 	fcall_info.object = NULL;
1040 	fcall_info.no_separation = 1;
1041 
1042 	fcall_cache.initialized = 1;
1043 	fcall_cache.function_handler = EG(autoload_func);
1044 	fcall_cache.calling_scope = NULL;
1045 	fcall_cache.called_scope = NULL;
1046 	fcall_cache.object = NULL;
1047 
1048 	zend_exception_save();
1049 	if ((zend_call_function(&fcall_info, &fcall_cache) == SUCCESS) && !EG(exception)) {
1050 		ce = zend_hash_find_ptr(EG(class_table), lc_name);
1051 	}
1052 	zend_exception_restore();
1053 
1054 	zval_ptr_dtor(&args[0]);
1055 	zval_dtor(&fcall_info.function_name);
1056 
1057 	zend_hash_del(EG(in_autoload), lc_name);
1058 
1059 	zval_ptr_dtor(&local_retval);
1060 
1061 	if (!key) {
1062 		zend_string_release(lc_name);
1063 	}
1064 	return ce;
1065 }
1066 /* }}} */
1067 
zend_lookup_class(zend_string * name)1068 ZEND_API zend_class_entry *zend_lookup_class(zend_string *name) /* {{{ */
1069 {
1070 	return zend_lookup_class_ex(name, NULL, 1);
1071 }
1072 /* }}} */
1073 
zend_get_called_scope(zend_execute_data * ex)1074 ZEND_API zend_class_entry *zend_get_called_scope(zend_execute_data *ex) /* {{{ */
1075 {
1076 	while (ex) {
1077 		if (ex->called_scope) {
1078 			return ex->called_scope;
1079 		} else if (ex->func) {
1080 			if (ex->func->type != ZEND_INTERNAL_FUNCTION || ex->func->common.scope) {
1081 				return ex->called_scope;
1082 			}
1083 		}
1084 		ex = ex->prev_execute_data;
1085 	}
1086 	return NULL;
1087 }
1088 /* }}} */
1089 
zend_get_this_object(zend_execute_data * ex)1090 ZEND_API zend_object *zend_get_this_object(zend_execute_data *ex) /* {{{ */
1091 {
1092 	while (ex) {
1093 		if (Z_OBJ(ex->This)) {
1094 			return Z_OBJ(ex->This);
1095 		} else if (ex->func) {
1096 			if (ex->func->type != ZEND_INTERNAL_FUNCTION || ex->func->common.scope) {
1097 				return Z_OBJ(ex->This);
1098 			}
1099 		}
1100 		ex = ex->prev_execute_data;
1101 	}
1102 	return NULL;
1103 }
1104 /* }}} */
1105 
zend_eval_stringl(char * str,size_t str_len,zval * retval_ptr,char * string_name)1106 ZEND_API int zend_eval_stringl(char *str, size_t str_len, zval *retval_ptr, char *string_name) /* {{{ */
1107 {
1108 	zval pv;
1109 	zend_op_array *new_op_array;
1110 	uint32_t original_compiler_options;
1111 	int retval;
1112 
1113 	if (retval_ptr) {
1114 		ZVAL_NEW_STR(&pv, zend_string_alloc(str_len + sizeof("return ;")-1, 1));
1115 		memcpy(Z_STRVAL(pv), "return ", sizeof("return ") - 1);
1116 		memcpy(Z_STRVAL(pv) + sizeof("return ") - 1, str, str_len);
1117 		Z_STRVAL(pv)[Z_STRLEN(pv) - 1] = ';';
1118 		Z_STRVAL(pv)[Z_STRLEN(pv)] = '\0';
1119 	} else {
1120 		ZVAL_STRINGL(&pv, str, str_len);
1121 	}
1122 
1123 	/*printf("Evaluating '%s'\n", pv.value.str.val);*/
1124 
1125 	original_compiler_options = CG(compiler_options);
1126 	CG(compiler_options) = ZEND_COMPILE_DEFAULT_FOR_EVAL;
1127 	new_op_array = zend_compile_string(&pv, string_name);
1128 	CG(compiler_options) = original_compiler_options;
1129 
1130 	if (new_op_array) {
1131 		zval local_retval;
1132 
1133 		EG(no_extensions)=1;
1134 
1135 		zend_try {
1136 			ZVAL_UNDEF(&local_retval);
1137 			zend_execute(new_op_array, &local_retval);
1138 		} zend_catch {
1139 			destroy_op_array(new_op_array);
1140 			efree_size(new_op_array, sizeof(zend_op_array));
1141 			zend_bailout();
1142 		} zend_end_try();
1143 
1144 		if (Z_TYPE(local_retval) != IS_UNDEF) {
1145 			if (retval_ptr) {
1146 				ZVAL_COPY_VALUE(retval_ptr, &local_retval);
1147 			} else {
1148 				zval_ptr_dtor(&local_retval);
1149 			}
1150 		} else {
1151 			if (retval_ptr) {
1152 				ZVAL_NULL(retval_ptr);
1153 			}
1154 		}
1155 
1156 		EG(no_extensions)=0;
1157 		destroy_op_array(new_op_array);
1158 		efree_size(new_op_array, sizeof(zend_op_array));
1159 		retval = SUCCESS;
1160 	} else {
1161 		retval = FAILURE;
1162 	}
1163 	zval_dtor(&pv);
1164 	return retval;
1165 }
1166 /* }}} */
1167 
zend_eval_string(char * str,zval * retval_ptr,char * string_name)1168 ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name) /* {{{ */
1169 {
1170 	return zend_eval_stringl(str, strlen(str), retval_ptr, string_name);
1171 }
1172 /* }}} */
1173 
zend_eval_stringl_ex(char * str,size_t str_len,zval * retval_ptr,char * string_name,int handle_exceptions)1174 ZEND_API int zend_eval_stringl_ex(char *str, size_t str_len, zval *retval_ptr, char *string_name, int handle_exceptions) /* {{{ */
1175 {
1176 	int result;
1177 
1178 	result = zend_eval_stringl(str, str_len, retval_ptr, string_name);
1179 	if (handle_exceptions && EG(exception)) {
1180 		zend_exception_error(EG(exception), E_ERROR);
1181 		result = FAILURE;
1182 	}
1183 	return result;
1184 }
1185 /* }}} */
1186 
zend_eval_string_ex(char * str,zval * retval_ptr,char * string_name,int handle_exceptions)1187 ZEND_API int zend_eval_string_ex(char *str, zval *retval_ptr, char *string_name, int handle_exceptions) /* {{{ */
1188 {
1189 	return zend_eval_stringl_ex(str, strlen(str), retval_ptr, string_name, handle_exceptions);
1190 }
1191 /* }}} */
1192 
zend_timeout(int dummy)1193 ZEND_API void zend_timeout(int dummy) /* {{{ */
1194 {
1195 
1196 	if (zend_on_timeout) {
1197 #ifdef ZEND_SIGNALS
1198 		/*
1199 		   We got here because we got a timeout signal, so we are in a signal handler
1200 		   at this point. However, we want to be able to timeout any user-supplied
1201 		   shutdown functions, so pretend we are not in a signal handler while we are
1202 		   calling these
1203 		*/
1204 		SIGG(running) = 0;
1205 #endif
1206 		zend_on_timeout(EG(timeout_seconds));
1207 	}
1208 
1209 	zend_error_noreturn(E_ERROR, "Maximum execution time of %pd second%s exceeded", EG(timeout_seconds), EG(timeout_seconds) == 1 ? "" : "s");
1210 }
1211 /* }}} */
1212 
1213 #ifdef ZEND_WIN32
tq_timer_cb(PVOID arg,BOOLEAN timed_out)1214 VOID CALLBACK tq_timer_cb(PVOID arg, BOOLEAN timed_out)
1215 {
1216 	zend_bool *php_timed_out;
1217 
1218 	/* The doc states it'll be always true, however it theoretically
1219 		could be FALSE when the thread was signaled. */
1220 	if (!timed_out) {
1221 		return;
1222 	}
1223 
1224 	php_timed_out = (zend_bool *)arg;
1225 	*php_timed_out = 1;
1226 }
1227 #endif
1228 
1229 /* This one doesn't exists on QNX */
1230 #ifndef SIGPROF
1231 #define SIGPROF 27
1232 #endif
1233 
zend_set_timeout(zend_long seconds,int reset_signals)1234 void zend_set_timeout(zend_long seconds, int reset_signals) /* {{{ */
1235 {
1236 
1237 	EG(timeout_seconds) = seconds;
1238 
1239 #ifdef ZEND_WIN32
1240 	if(!seconds) {
1241 		return;
1242 	}
1243 
1244         /* Don't use ChangeTimerQueueTimer() as it will not restart an expired
1245 		timer, so we could end up with just an ignored timeout. Instead
1246 		delete and recreate. */
1247 	if (NULL != tq_timer) {
1248 		if (!DeleteTimerQueueTimer(NULL, tq_timer, NULL)) {
1249 			EG(timed_out) = 0;
1250 			tq_timer = NULL;
1251 			zend_error_noreturn(E_ERROR, "Could not delete queued timer");
1252 			return;
1253 		}
1254 		tq_timer = NULL;
1255 	}
1256 
1257 	/* XXX passing NULL means the default timer queue provided by the system is used */
1258 	if (!CreateTimerQueueTimer(&tq_timer, NULL, (WAITORTIMERCALLBACK)tq_timer_cb, (VOID*)&EG(timed_out), seconds*1000, 0, WT_EXECUTEONLYONCE)) {
1259 		EG(timed_out) = 0;
1260 		tq_timer = NULL;
1261 		zend_error_noreturn(E_ERROR, "Could not queue new timer");
1262 		return;
1263 	}
1264 	EG(timed_out) = 0;
1265 #else
1266 #	ifdef HAVE_SETITIMER
1267 	{
1268 		struct itimerval t_r;		/* timeout requested */
1269 		int signo;
1270 
1271 		if(seconds) {
1272 			t_r.it_value.tv_sec = seconds;
1273 			t_r.it_value.tv_usec = t_r.it_interval.tv_sec = t_r.it_interval.tv_usec = 0;
1274 
1275 #	ifdef __CYGWIN__
1276 			setitimer(ITIMER_REAL, &t_r, NULL);
1277 		}
1278 		signo = SIGALRM;
1279 #	else
1280 			setitimer(ITIMER_PROF, &t_r, NULL);
1281 		}
1282 		signo = SIGPROF;
1283 #	endif
1284 
1285 		if (reset_signals) {
1286 #	ifdef ZEND_SIGNALS
1287 			zend_signal(signo, zend_timeout);
1288 #	else
1289 			sigset_t sigset;
1290 
1291 			signal(signo, zend_timeout);
1292 			sigemptyset(&sigset);
1293 			sigaddset(&sigset, signo);
1294 			sigprocmask(SIG_UNBLOCK, &sigset, NULL);
1295 #	endif
1296 		}
1297 	}
1298 #	endif /* HAVE_SETITIMER */
1299 #endif
1300 }
1301 /* }}} */
1302 
zend_unset_timeout(void)1303 void zend_unset_timeout(void) /* {{{ */
1304 {
1305 #ifdef ZEND_WIN32
1306 	if (NULL != tq_timer) {
1307 		if (!DeleteTimerQueueTimer(NULL, tq_timer, NULL)) {
1308 			EG(timed_out) = 0;
1309 			tq_timer = NULL;
1310 			zend_error_noreturn(E_ERROR, "Could not delete queued timer");
1311 			return;
1312 		}
1313 		tq_timer = NULL;
1314 	}
1315 	EG(timed_out) = 0;
1316 #else
1317 #	ifdef HAVE_SETITIMER
1318 	if (EG(timeout_seconds)) {
1319 		struct itimerval no_timeout;
1320 
1321 		no_timeout.it_value.tv_sec = no_timeout.it_value.tv_usec = no_timeout.it_interval.tv_sec = no_timeout.it_interval.tv_usec = 0;
1322 
1323 #ifdef __CYGWIN__
1324 		setitimer(ITIMER_REAL, &no_timeout, NULL);
1325 #else
1326 		setitimer(ITIMER_PROF, &no_timeout, NULL);
1327 #endif
1328 	}
1329 #	endif
1330 #endif
1331 }
1332 /* }}} */
1333 
zend_fetch_class(zend_string * class_name,int fetch_type)1334 zend_class_entry *zend_fetch_class(zend_string *class_name, int fetch_type) /* {{{ */
1335 {
1336 	zend_class_entry *ce;
1337 	int fetch_sub_type = fetch_type & ZEND_FETCH_CLASS_MASK;
1338 
1339 check_fetch_type:
1340 	switch (fetch_sub_type) {
1341 		case ZEND_FETCH_CLASS_SELF:
1342 			if (UNEXPECTED(!EG(scope))) {
1343 				zend_throw_or_error(fetch_type, NULL, "Cannot access self:: when no class scope is active");
1344 			}
1345 			return EG(scope);
1346 		case ZEND_FETCH_CLASS_PARENT:
1347 			if (UNEXPECTED(!EG(scope))) {
1348 				zend_throw_or_error(fetch_type, NULL, "Cannot access parent:: when no class scope is active");
1349 				return NULL;
1350 			}
1351 			if (UNEXPECTED(!EG(scope)->parent)) {
1352 				zend_throw_or_error(fetch_type, NULL, "Cannot access parent:: when current class scope has no parent");
1353 			}
1354 			return EG(scope)->parent;
1355 		case ZEND_FETCH_CLASS_STATIC:
1356 			ce = zend_get_called_scope(EG(current_execute_data));
1357 			if (UNEXPECTED(!ce)) {
1358 				zend_throw_or_error(fetch_type, NULL, "Cannot access static:: when no class scope is active");
1359 				return NULL;
1360 			}
1361 			return ce;
1362 		case ZEND_FETCH_CLASS_AUTO: {
1363 				fetch_sub_type = zend_get_class_fetch_type(class_name);
1364 				if (UNEXPECTED(fetch_sub_type != ZEND_FETCH_CLASS_DEFAULT)) {
1365 					goto check_fetch_type;
1366 				}
1367 			}
1368 			break;
1369 	}
1370 
1371 	if (fetch_type & ZEND_FETCH_CLASS_NO_AUTOLOAD) {
1372 		return zend_lookup_class_ex(class_name, NULL, 0);
1373 	} else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) {
1374 		if (!(fetch_type & ZEND_FETCH_CLASS_SILENT) && !EG(exception)) {
1375 			if (fetch_sub_type == ZEND_FETCH_CLASS_INTERFACE) {
1376 				zend_throw_or_error(fetch_type, NULL, "Interface '%s' not found", ZSTR_VAL(class_name));
1377 			} else if (fetch_sub_type == ZEND_FETCH_CLASS_TRAIT) {
1378 				zend_throw_or_error(fetch_type, NULL, "Trait '%s' not found", ZSTR_VAL(class_name));
1379 			} else {
1380 				zend_throw_or_error(fetch_type, NULL, "Class '%s' not found", ZSTR_VAL(class_name));
1381 			}
1382 		}
1383 		return NULL;
1384 	}
1385 	return ce;
1386 }
1387 /* }}} */
1388 
zend_fetch_class_by_name(zend_string * class_name,const zval * key,int fetch_type)1389 zend_class_entry *zend_fetch_class_by_name(zend_string *class_name, const zval *key, int fetch_type) /* {{{ */
1390 {
1391 	zend_class_entry *ce;
1392 
1393 	if (fetch_type & ZEND_FETCH_CLASS_NO_AUTOLOAD) {
1394 		return zend_lookup_class_ex(class_name, key, 0);
1395 	} else if ((ce = zend_lookup_class_ex(class_name, key, 1)) == NULL) {
1396 		if ((fetch_type & ZEND_FETCH_CLASS_SILENT) == 0 && !EG(exception)) {
1397 			if ((fetch_type & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_INTERFACE) {
1398 				zend_throw_or_error(fetch_type, NULL, "Interface '%s' not found", ZSTR_VAL(class_name));
1399 			} else if ((fetch_type & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_TRAIT) {
1400 				zend_throw_or_error(fetch_type, NULL, "Trait '%s' not found", ZSTR_VAL(class_name));
1401 			} else {
1402 				zend_throw_or_error(fetch_type, NULL, "Class '%s' not found", ZSTR_VAL(class_name));
1403 			}
1404 		}
1405 		return NULL;
1406 	}
1407 	return ce;
1408 }
1409 /* }}} */
1410 
1411 #define MAX_ABSTRACT_INFO_CNT 3
1412 #define MAX_ABSTRACT_INFO_FMT "%s%s%s%s"
1413 #define DISPLAY_ABSTRACT_FN(idx) \
1414 	ai.afn[idx] ? ZEND_FN_SCOPE_NAME(ai.afn[idx]) : "", \
1415 	ai.afn[idx] ? "::" : "", \
1416 	ai.afn[idx] ? ZSTR_VAL(ai.afn[idx]->common.function_name) : "", \
1417 	ai.afn[idx] && ai.afn[idx + 1] ? ", " : (ai.afn[idx] && ai.cnt > MAX_ABSTRACT_INFO_CNT ? ", ..." : "")
1418 
1419 typedef struct _zend_abstract_info {
1420 	zend_function *afn[MAX_ABSTRACT_INFO_CNT + 1];
1421 	int cnt;
1422 	int ctor;
1423 } zend_abstract_info;
1424 
zend_verify_abstract_class_function(zend_function * fn,zend_abstract_info * ai)1425 static void zend_verify_abstract_class_function(zend_function *fn, zend_abstract_info *ai) /* {{{ */
1426 {
1427 	if (fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
1428 		if (ai->cnt < MAX_ABSTRACT_INFO_CNT) {
1429 			ai->afn[ai->cnt] = fn;
1430 		}
1431 		if (fn->common.fn_flags & ZEND_ACC_CTOR) {
1432 			if (!ai->ctor) {
1433 				ai->cnt++;
1434 				ai->ctor = 1;
1435 			} else {
1436 				ai->afn[ai->cnt] = NULL;
1437 			}
1438 		} else {
1439 			ai->cnt++;
1440 		}
1441 	}
1442 }
1443 /* }}} */
1444 
zend_verify_abstract_class(zend_class_entry * ce)1445 void zend_verify_abstract_class(zend_class_entry *ce) /* {{{ */
1446 {
1447 	zend_function *func;
1448 	zend_abstract_info ai;
1449 
1450 	if ((ce->ce_flags & ZEND_ACC_IMPLICIT_ABSTRACT_CLASS) && !(ce->ce_flags & (ZEND_ACC_TRAIT | ZEND_ACC_EXPLICIT_ABSTRACT_CLASS))) {
1451 		memset(&ai, 0, sizeof(ai));
1452 
1453 		ZEND_HASH_FOREACH_PTR(&ce->function_table, func) {
1454 			zend_verify_abstract_class_function(func, &ai);
1455 		} ZEND_HASH_FOREACH_END();
1456 
1457 		if (ai.cnt) {
1458 			zend_error_noreturn(E_ERROR, "Class %s contains %d abstract method%s and must therefore be declared abstract or implement the remaining methods (" MAX_ABSTRACT_INFO_FMT MAX_ABSTRACT_INFO_FMT MAX_ABSTRACT_INFO_FMT ")",
1459 				ZSTR_VAL(ce->name), ai.cnt,
1460 				ai.cnt > 1 ? "s" : "",
1461 				DISPLAY_ABSTRACT_FN(0),
1462 				DISPLAY_ABSTRACT_FN(1),
1463 				DISPLAY_ABSTRACT_FN(2)
1464 				);
1465 		}
1466 	}
1467 }
1468 /* }}} */
1469 
zend_delete_global_variable(zend_string * name)1470 ZEND_API int zend_delete_global_variable(zend_string *name) /* {{{ */
1471 {
1472     return zend_hash_del_ind(&EG(symbol_table), name);
1473 }
1474 /* }}} */
1475 
zend_rebuild_symbol_table(void)1476 ZEND_API zend_array *zend_rebuild_symbol_table(void) /* {{{ */
1477 {
1478 	zend_execute_data *ex;
1479 	zend_array *symbol_table;
1480 
1481 	/* Search for last called user function */
1482 	ex = EG(current_execute_data);
1483 	while (ex && (!ex->func || !ZEND_USER_CODE(ex->func->common.type))) {
1484 		ex = ex->prev_execute_data;
1485 	}
1486 	if (!ex) {
1487 		return NULL;
1488 	}
1489 	if (ex->symbol_table) {
1490 		return ex->symbol_table;
1491 	}
1492 
1493 	if (EG(symtable_cache_ptr) >= EG(symtable_cache)) {
1494 		/*printf("Cache hit!  Reusing %x\n", symtable_cache[symtable_cache_ptr]);*/
1495 		symbol_table = ex->symbol_table = *(EG(symtable_cache_ptr)--);
1496 		if (!ex->func->op_array.last_var) {
1497 			return symbol_table;
1498 		}
1499 		zend_hash_extend(symbol_table, ex->func->op_array.last_var, 0);
1500 	} else {
1501 		symbol_table = ex->symbol_table = emalloc(sizeof(zend_array));
1502 		zend_hash_init(symbol_table, ex->func->op_array.last_var, NULL, ZVAL_PTR_DTOR, 0);
1503 		if (!ex->func->op_array.last_var) {
1504 			return symbol_table;
1505 		}
1506 		zend_hash_real_init(symbol_table, 0);
1507 		/*printf("Cache miss!  Initialized %x\n", EG(active_symbol_table));*/
1508 	}
1509 	if (EXPECTED(ex->func->op_array.last_var)) {
1510 		zend_string **str = ex->func->op_array.vars;
1511 		zend_string **end = str + ex->func->op_array.last_var;
1512 		zval *var = ZEND_CALL_VAR_NUM(ex, 0);
1513 
1514 		do {
1515 			_zend_hash_append_ind(symbol_table, *str, var);
1516 			str++;
1517 			var++;
1518 		} while (str != end);
1519 	}
1520 	return symbol_table;
1521 }
1522 /* }}} */
1523 
zend_attach_symbol_table(zend_execute_data * execute_data)1524 ZEND_API void zend_attach_symbol_table(zend_execute_data *execute_data) /* {{{ */
1525 {
1526 	zend_op_array *op_array = &execute_data->func->op_array;
1527 	HashTable *ht = execute_data->symbol_table;
1528 
1529 	/* copy real values from symbol table into CV slots and create
1530 	   INDIRECT references to CV in symbol table  */
1531 	if (EXPECTED(op_array->last_var)) {
1532 		zend_string **str = op_array->vars;
1533 		zend_string **end = str + op_array->last_var;
1534 		zval *var = EX_VAR_NUM(0);
1535 
1536 		do {
1537 			zval *zv = zend_hash_find(ht, *str);
1538 
1539 			if (zv) {
1540 				if (Z_TYPE_P(zv) == IS_INDIRECT) {
1541 					zval *val = Z_INDIRECT_P(zv);
1542 
1543 					ZVAL_COPY_VALUE(var, val);
1544 				} else {
1545 					ZVAL_COPY_VALUE(var, zv);
1546 				}
1547 			} else {
1548 				ZVAL_UNDEF(var);
1549 				zv = zend_hash_add_new(ht, *str, var);
1550 			}
1551 			ZVAL_INDIRECT(zv, var);
1552 			str++;
1553 			var++;
1554 		} while (str != end);
1555 	}
1556 }
1557 /* }}} */
1558 
zend_detach_symbol_table(zend_execute_data * execute_data)1559 ZEND_API void zend_detach_symbol_table(zend_execute_data *execute_data) /* {{{ */
1560 {
1561 	zend_op_array *op_array = &execute_data->func->op_array;
1562 	HashTable *ht = execute_data->symbol_table;
1563 
1564 	/* copy real values from CV slots into symbol table */
1565 	if (EXPECTED(op_array->last_var)) {
1566 		zend_string **str = op_array->vars;
1567 		zend_string **end = str + op_array->last_var;
1568 		zval *var = EX_VAR_NUM(0);
1569 
1570 		do {
1571 			if (Z_TYPE_P(var) == IS_UNDEF) {
1572 				zend_hash_del(ht, *str);
1573 			} else {
1574 				zend_hash_update(ht, *str, var);
1575 				ZVAL_UNDEF(var);
1576 			}
1577 			str++;
1578 			var++;
1579 		} while (str != end);
1580 	}
1581 }
1582 /* }}} */
1583 
zend_set_local_var(zend_string * name,zval * value,int force)1584 ZEND_API int zend_set_local_var(zend_string *name, zval *value, int force) /* {{{ */
1585 {
1586 	zend_execute_data *execute_data = EG(current_execute_data);
1587 
1588 	while (execute_data && (!execute_data->func || !ZEND_USER_CODE(execute_data->func->common.type))) {
1589 		execute_data = execute_data->prev_execute_data;
1590 	}
1591 
1592 	if (execute_data) {
1593 		if (!execute_data->symbol_table) {
1594 			zend_ulong h = zend_string_hash_val(name);
1595 			zend_op_array *op_array = &execute_data->func->op_array;
1596 
1597 			if (EXPECTED(op_array->last_var)) {
1598 				zend_string **str = op_array->vars;
1599 				zend_string **end = str + op_array->last_var;
1600 
1601 				do {
1602 					if (ZSTR_H(*str) == h &&
1603 					    ZSTR_LEN(*str) == ZSTR_LEN(name) &&
1604 					    memcmp(ZSTR_VAL(*str), ZSTR_VAL(name), ZSTR_LEN(name)) == 0) {
1605 						zval *var = EX_VAR_NUM(str - op_array->vars);
1606 						ZVAL_COPY_VALUE(var, value);
1607 						return SUCCESS;
1608 					}
1609 					str++;
1610 				} while (str != end);
1611 			}
1612 			if (force) {
1613 				zend_array *symbol_table = zend_rebuild_symbol_table();
1614 				if (symbol_table) {
1615 					return zend_hash_update(symbol_table, name, value) ? SUCCESS : FAILURE;;
1616 				}
1617 			}
1618 		} else {
1619 			return (zend_hash_update_ind(execute_data->symbol_table, name, value) != NULL) ? SUCCESS : FAILURE;
1620 		}
1621 	}
1622 	return FAILURE;
1623 }
1624 /* }}} */
1625 
zend_set_local_var_str(const char * name,size_t len,zval * value,int force)1626 ZEND_API int zend_set_local_var_str(const char *name, size_t len, zval *value, int force) /* {{{ */
1627 {
1628 	zend_execute_data *execute_data = EG(current_execute_data);
1629 
1630 	while (execute_data && (!execute_data->func || !ZEND_USER_CODE(execute_data->func->common.type))) {
1631 		execute_data = execute_data->prev_execute_data;
1632 	}
1633 
1634 	if (execute_data) {
1635 		if (!execute_data->symbol_table) {
1636 			zend_ulong h = zend_hash_func(name, len);
1637 			zend_op_array *op_array = &execute_data->func->op_array;
1638 			if (EXPECTED(op_array->last_var)) {
1639 				zend_string **str = op_array->vars;
1640 				zend_string **end = str + op_array->last_var;
1641 
1642 				do {
1643 					if (ZSTR_H(*str) == h &&
1644 					    ZSTR_LEN(*str) == len &&
1645 					    memcmp(ZSTR_VAL(*str), name, len) == 0) {
1646 						zval *var = EX_VAR_NUM(str - op_array->vars);
1647 						zval_ptr_dtor(var);
1648 						ZVAL_COPY_VALUE(var, value);
1649 						return SUCCESS;
1650 					}
1651 					str++;
1652 				} while (str != end);
1653 			}
1654 			if (force) {
1655 				zend_array *symbol_table = zend_rebuild_symbol_table();
1656 				if (symbol_table) {
1657 					return zend_hash_str_update(symbol_table, name, len, value) ? SUCCESS : FAILURE;;
1658 				}
1659 			}
1660 		} else {
1661 			return (zend_hash_str_update_ind(execute_data->symbol_table, name, len, value) != NULL) ? SUCCESS : FAILURE;
1662 		}
1663 	}
1664 	return FAILURE;
1665 }
1666 /* }}} */
1667 
1668 /*
1669  * Local variables:
1670  * tab-width: 4
1671  * c-basic-offset: 4
1672  * indent-tabs-mode: t
1673  * End:
1674  */
1675