xref: /PHP-7.3/Zend/zend_object_handlers.c (revision 358379be)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1998-2018 Zend Technologies Ltd. (http://www.zend.com) |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Dmitry Stogov <dmitry@php.net>                              |
18    +----------------------------------------------------------------------+
19 */
20 
21 #include "zend.h"
22 #include "zend_globals.h"
23 #include "zend_variables.h"
24 #include "zend_API.h"
25 #include "zend_objects.h"
26 #include "zend_objects_API.h"
27 #include "zend_object_handlers.h"
28 #include "zend_interfaces.h"
29 #include "zend_exceptions.h"
30 #include "zend_closures.h"
31 #include "zend_compile.h"
32 #include "zend_hash.h"
33 
34 #define DEBUG_OBJECT_HANDLERS 0
35 
36 #define ZEND_WRONG_PROPERTY_OFFSET   0
37 
38 /* guard flags */
39 #define IN_GET		(1<<0)
40 #define IN_SET		(1<<1)
41 #define IN_UNSET	(1<<2)
42 #define IN_ISSET	(1<<3)
43 
44 /*
45   __X accessors explanation:
46 
47   if we have __get and property that is not part of the properties array is
48   requested, we call __get handler. If it fails, we return uninitialized.
49 
50   if we have __set and property that is not part of the properties array is
51   set, we call __set handler. If it fails, we do not change the array.
52 
53   for both handlers above, when we are inside __get/__set, no further calls for
54   __get/__set for this property of this object will be made, to prevent endless
55   recursion and enable accessors to change properties array.
56 
57   if we have __call and method which is not part of the class function table is
58   called, we cal __call handler.
59 */
60 
rebuild_object_properties(zend_object * zobj)61 ZEND_API void rebuild_object_properties(zend_object *zobj) /* {{{ */
62 {
63 	if (!zobj->properties) {
64 		zend_property_info *prop_info;
65 		zend_class_entry *ce = zobj->ce;
66 
67 		zobj->properties = zend_new_array(ce->default_properties_count);
68 		if (ce->default_properties_count) {
69 			zend_hash_real_init_mixed(zobj->properties);
70 			ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
71 				if (/*prop_info->ce == ce &&*/
72 				    (prop_info->flags & ZEND_ACC_STATIC) == 0) {
73 
74 					if (UNEXPECTED(Z_TYPE_P(OBJ_PROP(zobj, prop_info->offset)) == IS_UNDEF)) {
75 						HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
76 					}
77 
78 					_zend_hash_append_ind(zobj->properties, prop_info->name,
79 						OBJ_PROP(zobj, prop_info->offset));
80 				}
81 			} ZEND_HASH_FOREACH_END();
82 			while (ce->parent && ce->parent->default_properties_count) {
83 				ce = ce->parent;
84 				ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
85 					if (prop_info->ce == ce &&
86 					    (prop_info->flags & ZEND_ACC_STATIC) == 0 &&
87 					    (prop_info->flags & ZEND_ACC_PRIVATE) != 0) {
88 						zval zv;
89 
90 						if (UNEXPECTED(Z_TYPE_P(OBJ_PROP(zobj, prop_info->offset)) == IS_UNDEF)) {
91 							HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
92 						}
93 
94 						ZVAL_INDIRECT(&zv, OBJ_PROP(zobj, prop_info->offset));
95 						zend_hash_add(zobj->properties, prop_info->name, &zv);
96 					}
97 				} ZEND_HASH_FOREACH_END();
98 			}
99 		}
100 	}
101 }
102 /* }}} */
103 
zend_std_get_properties(zval * object)104 ZEND_API HashTable *zend_std_get_properties(zval *object) /* {{{ */
105 {
106 	zend_object *zobj;
107 	zobj = Z_OBJ_P(object);
108 	if (!zobj->properties) {
109 		rebuild_object_properties(zobj);
110 	}
111 	return zobj->properties;
112 }
113 /* }}} */
114 
zend_std_get_gc(zval * object,zval ** table,int * n)115 ZEND_API HashTable *zend_std_get_gc(zval *object, zval **table, int *n) /* {{{ */
116 {
117 	if (Z_OBJ_HANDLER_P(object, get_properties) != zend_std_get_properties) {
118 		*table = NULL;
119 		*n = 0;
120 		return Z_OBJ_HANDLER_P(object, get_properties)(object);
121 	} else {
122 		zend_object *zobj = Z_OBJ_P(object);
123 
124 		if (zobj->properties) {
125 			*table = NULL;
126 			*n = 0;
127 			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)
128 			 && EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
129 				GC_DELREF(zobj->properties);
130 				zobj->properties = zend_array_dup(zobj->properties);
131 			}
132 			return zobj->properties;
133 		} else {
134 			*table = zobj->properties_table;
135 			*n = zobj->ce->default_properties_count;
136 			return NULL;
137 		}
138 	}
139 }
140 /* }}} */
141 
zend_std_get_debug_info(zval * object,int * is_temp)142 ZEND_API HashTable *zend_std_get_debug_info(zval *object, int *is_temp) /* {{{ */
143 {
144 	zend_class_entry *ce = Z_OBJCE_P(object);
145 	zval retval;
146 	HashTable *ht;
147 
148 	if (!ce->__debugInfo) {
149 		*is_temp = 0;
150 		return Z_OBJ_HANDLER_P(object, get_properties)
151 			? Z_OBJ_HANDLER_P(object, get_properties)(object)
152 			: NULL;
153 	}
154 
155 	zend_call_method_with_0_params(object, ce, &ce->__debugInfo, ZEND_DEBUGINFO_FUNC_NAME, &retval);
156 	if (Z_TYPE(retval) == IS_ARRAY) {
157 		if (!Z_REFCOUNTED(retval)) {
158 			*is_temp = 1;
159 			return zend_array_dup(Z_ARRVAL(retval));
160 		} else if (Z_REFCOUNT(retval) <= 1) {
161 			*is_temp = 1;
162 			ht = Z_ARR(retval);
163 			return ht;
164 		} else {
165 			*is_temp = 0;
166 			zval_ptr_dtor(&retval);
167 			return Z_ARRVAL(retval);
168 		}
169 	} else if (Z_TYPE(retval) == IS_NULL) {
170 		*is_temp = 1;
171 		ht = zend_new_array(0);
172 		return ht;
173 	}
174 
175 	zend_error_noreturn(E_ERROR, ZEND_DEBUGINFO_FUNC_NAME "() must return an array");
176 
177 	return NULL; /* Compilers are dumb and don't understand that noreturn means that the function does NOT need a return value... */
178 }
179 /* }}} */
180 
zend_std_call_getter(zend_object * zobj,zend_string * prop_name,zval * retval)181 static void zend_std_call_getter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
182 {
183 	zend_class_entry *ce = zobj->ce;
184 	zend_class_entry *orig_fake_scope = EG(fake_scope);
185 	zend_fcall_info fci;
186 	zend_fcall_info_cache fcic;
187 	zval member;
188 
189 	EG(fake_scope) = NULL;
190 
191 	/* __get handler is called with one argument:
192 	      property name
193 
194 	   it should return whether the call was successful or not
195 	*/
196 
197 	ZVAL_STR(&member, prop_name);
198 
199 	fci.size = sizeof(fci);
200 	fci.object = zobj;
201 	fci.retval = retval;
202 	fci.param_count = 1;
203 	fci.params = &member;
204 	fci.no_separation = 1;
205 	ZVAL_UNDEF(&fci.function_name); /* Unused */
206 
207 	fcic.function_handler = ce->__get;
208 	fcic.called_scope = ce;
209 	fcic.object = zobj;
210 
211 	zend_call_function(&fci, &fcic);
212 
213 	EG(fake_scope) = orig_fake_scope;
214 }
215 /* }}} */
216 
zend_std_call_setter(zend_object * zobj,zend_string * prop_name,zval * value)217 static void zend_std_call_setter(zend_object *zobj, zend_string *prop_name, zval *value) /* {{{ */
218 {
219 	zend_class_entry *ce = zobj->ce;
220 	zend_class_entry *orig_fake_scope = EG(fake_scope);
221 	zend_fcall_info fci;
222 	zend_fcall_info_cache fcic;
223 	zval args[2], ret;
224 
225 	EG(fake_scope) = NULL;
226 
227 	/* __set handler is called with two arguments:
228 	     property name
229 	     value to be set
230 	*/
231 
232 	ZVAL_STR(&args[0], prop_name);
233 	ZVAL_COPY_VALUE(&args[1], value);
234 	ZVAL_UNDEF(&ret);
235 
236 	fci.size = sizeof(fci);
237 	fci.object = zobj;
238 	fci.retval = &ret;
239 	fci.param_count = 2;
240 	fci.params = args;
241 	fci.no_separation = 1;
242 	ZVAL_UNDEF(&fci.function_name); /* Unused */
243 
244 	fcic.function_handler = ce->__set;
245 	fcic.called_scope = ce;
246 	fcic.object = zobj;
247 
248 	zend_call_function(&fci, &fcic);
249 	zval_ptr_dtor(&ret);
250 
251 	EG(fake_scope) = orig_fake_scope;
252 }
253 /* }}} */
254 
zend_std_call_unsetter(zend_object * zobj,zend_string * prop_name)255 static void zend_std_call_unsetter(zend_object *zobj, zend_string *prop_name) /* {{{ */
256 {
257 	zend_class_entry *ce = zobj->ce;
258 	zend_class_entry *orig_fake_scope = EG(fake_scope);
259 	zend_fcall_info fci;
260 	zend_fcall_info_cache fcic;
261 	zval ret, member;
262 
263 	EG(fake_scope) = NULL;
264 
265 	/* __unset handler is called with one argument:
266 	      property name
267 	*/
268 
269 	ZVAL_STR(&member, prop_name);
270 	ZVAL_UNDEF(&ret);
271 
272 	fci.size = sizeof(fci);
273 	fci.object = zobj;
274 	fci.retval = &ret;
275 	fci.param_count = 1;
276 	fci.params = &member;
277 	fci.no_separation = 1;
278 	ZVAL_UNDEF(&fci.function_name); /* Unused */
279 
280 	fcic.function_handler = ce->__unset;
281 	fcic.called_scope = ce;
282 	fcic.object = zobj;
283 
284 	zend_call_function(&fci, &fcic);
285 	zval_ptr_dtor(&ret);
286 
287 	EG(fake_scope) = orig_fake_scope;
288 }
289 /* }}} */
290 
zend_std_call_issetter(zend_object * zobj,zend_string * prop_name,zval * retval)291 static void zend_std_call_issetter(zend_object *zobj, zend_string *prop_name, zval *retval) /* {{{ */
292 {
293 	zend_class_entry *ce = zobj->ce;
294 	zend_class_entry *orig_fake_scope = EG(fake_scope);
295 	zend_fcall_info fci;
296 	zend_fcall_info_cache fcic;
297 	zval member;
298 
299 	EG(fake_scope) = NULL;
300 
301 	/* __isset handler is called with one argument:
302 	      property name
303 
304 	   it should return whether the property is set or not
305 	*/
306 
307 	ZVAL_STR(&member, prop_name);
308 
309 	fci.size = sizeof(fci);
310 	fci.object = zobj;
311 	fci.retval = retval;
312 	fci.param_count = 1;
313 	fci.params = &member;
314 	fci.no_separation = 1;
315 	ZVAL_UNDEF(&fci.function_name); /* Unused */
316 
317 	fcic.function_handler = ce->__isset;
318 	fcic.called_scope = ce;
319 	fcic.object = zobj;
320 
321 	zend_call_function(&fci, &fcic);
322 
323 	EG(fake_scope) = orig_fake_scope;
324 }
325 /* }}} */
326 
zend_verify_property_access(zend_property_info * property_info,zend_class_entry * ce)327 static zend_always_inline int zend_verify_property_access(zend_property_info *property_info, zend_class_entry *ce) /* {{{ */
328 {
329 	zend_class_entry *scope;
330 
331 	if (property_info->flags & ZEND_ACC_PUBLIC) {
332 		return 1;
333 	} else if (property_info->flags & ZEND_ACC_PRIVATE) {
334 		if (EG(fake_scope)) {
335 			scope = EG(fake_scope);
336 		} else {
337 			scope = zend_get_executed_scope();
338 		}
339 		return (ce == scope || property_info->ce == scope);
340 	} else if (property_info->flags & ZEND_ACC_PROTECTED) {
341 		if (EG(fake_scope)) {
342 			scope = EG(fake_scope);
343 		} else {
344 			scope = zend_get_executed_scope();
345 		}
346 		return zend_check_protected(property_info->ce, scope);
347 	}
348 	return 0;
349 }
350 /* }}} */
351 
is_derived_class(zend_class_entry * child_class,zend_class_entry * parent_class)352 static zend_always_inline zend_bool is_derived_class(zend_class_entry *child_class, zend_class_entry *parent_class) /* {{{ */
353 {
354 	child_class = child_class->parent;
355 	while (child_class) {
356 		if (child_class == parent_class) {
357 			return 1;
358 		}
359 		child_class = child_class->parent;
360 	}
361 
362 	return 0;
363 }
364 /* }}} */
365 
zend_get_property_offset(zend_class_entry * ce,zend_string * member,int silent,void ** cache_slot)366 static zend_always_inline uintptr_t zend_get_property_offset(zend_class_entry *ce, zend_string *member, int silent, void **cache_slot) /* {{{ */
367 {
368 	zval *zv;
369 	zend_property_info *property_info = NULL;
370 	uint32_t flags;
371 	zend_class_entry *scope;
372 
373 	if (cache_slot && EXPECTED(ce == CACHED_PTR_EX(cache_slot))) {
374 		return (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
375 	}
376 
377 	if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)) {
378 		goto exit_dynamic;
379 	}
380 
381 	zv = zend_hash_find(&ce->properties_info, member);
382 	if (EXPECTED(zv != NULL)) {
383 		property_info = (zend_property_info*)Z_PTR_P(zv);
384 		flags = property_info->flags;
385 		if (UNEXPECTED((flags & ZEND_ACC_SHADOW) != 0)) {
386 			/* if it's a shadow - go to access it's private */
387 			property_info = NULL;
388 		} else {
389 			if (EXPECTED(zend_verify_property_access(property_info, ce) != 0)) {
390 				if (UNEXPECTED(!(flags & ZEND_ACC_CHANGED))
391 					|| UNEXPECTED((flags & ZEND_ACC_PRIVATE))) {
392 					if (UNEXPECTED((flags & ZEND_ACC_STATIC) != 0)) {
393 						if (!silent) {
394 							zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
395 						}
396 						return ZEND_DYNAMIC_PROPERTY_OFFSET;
397 					}
398 					goto exit;
399 				}
400 			} else {
401 				/* Try to look in the scope instead */
402 				property_info = ZEND_WRONG_PROPERTY_INFO;
403 			}
404 		}
405 	}
406 
407 	if (EG(fake_scope)) {
408 		scope = EG(fake_scope);
409 	} else {
410 		scope = zend_get_executed_scope();
411 	}
412 
413 	if (scope != ce
414 		&& scope
415 		&& is_derived_class(ce, scope)
416 		&& (zv = zend_hash_find(&scope->properties_info, member)) != NULL
417 		&& ((zend_property_info*)Z_PTR_P(zv))->flags & ZEND_ACC_PRIVATE) {
418 		property_info = (zend_property_info*)Z_PTR_P(zv);
419 		if (UNEXPECTED((property_info->flags & ZEND_ACC_STATIC) != 0)) {
420 			return ZEND_DYNAMIC_PROPERTY_OFFSET;
421 		}
422 	} else if (UNEXPECTED(property_info == NULL)) {
423 exit_dynamic:
424 		if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0' && ZSTR_LEN(member) != 0)) {
425 			if (!silent) {
426 				zend_throw_error(NULL, "Cannot access property started with '\\0'");
427 			}
428 			return ZEND_WRONG_PROPERTY_OFFSET;
429 		}
430 		if (cache_slot) {
431 			CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
432 		}
433 		return ZEND_DYNAMIC_PROPERTY_OFFSET;
434 	} else if (UNEXPECTED(property_info == ZEND_WRONG_PROPERTY_INFO)) {
435 		/* Information was available, but we were denied access.  Error out. */
436 		if (!silent) {
437 			zend_throw_error(NULL, "Cannot access %s property %s::$%s", zend_visibility_string(flags), ZSTR_VAL(ce->name), ZSTR_VAL(member));
438 		}
439 		return ZEND_WRONG_PROPERTY_OFFSET;
440 	}
441 
442 exit:
443 	if (cache_slot) {
444 		CACHE_POLYMORPHIC_PTR_EX(cache_slot, ce, (void*)(uintptr_t)property_info->offset);
445 	}
446 	return property_info->offset;
447 }
448 /* }}} */
449 
zend_get_property_info(zend_class_entry * ce,zend_string * member,int silent)450 ZEND_API zend_property_info *zend_get_property_info(zend_class_entry *ce, zend_string *member, int silent) /* {{{ */
451 {
452 	zval *zv;
453 	zend_property_info *property_info = NULL;
454 	uint32_t flags;
455 	zend_class_entry *scope;
456 
457 	if (UNEXPECTED(zend_hash_num_elements(&ce->properties_info) == 0)) {
458 		goto exit_dynamic;
459 	}
460 
461 	zv = zend_hash_find(&ce->properties_info, member);
462 	if (EXPECTED(zv != NULL)) {
463 		property_info = (zend_property_info*)Z_PTR_P(zv);
464 		flags = property_info->flags;
465 		if (UNEXPECTED((flags & ZEND_ACC_SHADOW) != 0)) {
466 			/* if it's a shadow - go to access it's private */
467 			property_info = NULL;
468 		} else {
469 			if (EXPECTED(zend_verify_property_access(property_info, ce) != 0)) {
470 				if (UNEXPECTED(!(flags & ZEND_ACC_CHANGED))
471 					|| UNEXPECTED((flags & ZEND_ACC_PRIVATE))) {
472 					if (UNEXPECTED((flags & ZEND_ACC_STATIC) != 0)) {
473 						if (!silent) {
474 							zend_error(E_NOTICE, "Accessing static property %s::$%s as non static", ZSTR_VAL(ce->name), ZSTR_VAL(member));
475 						}
476 					}
477 					goto exit;
478 				}
479 			} else {
480 				/* Try to look in the scope instead */
481 				property_info = ZEND_WRONG_PROPERTY_INFO;
482 			}
483 		}
484 	}
485 
486 	if (EG(fake_scope)) {
487 		scope = EG(fake_scope);
488 	} else {
489 		scope = zend_get_executed_scope();
490 	}
491 
492 	if (scope != ce
493 		&& scope
494 		&& is_derived_class(ce, scope)
495 		&& (zv = zend_hash_find(&scope->properties_info, member)) != NULL
496 		&& ((zend_property_info*)Z_PTR_P(zv))->flags & ZEND_ACC_PRIVATE) {
497 		property_info = (zend_property_info*)Z_PTR_P(zv);
498 	} else if (UNEXPECTED(property_info == NULL)) {
499 exit_dynamic:
500 		if (UNEXPECTED(ZSTR_VAL(member)[0] == '\0' && ZSTR_LEN(member) != 0)) {
501 			if (!silent) {
502 				zend_throw_error(NULL, "Cannot access property started with '\\0'");
503 			}
504 			return ZEND_WRONG_PROPERTY_INFO;
505 		}
506 		return NULL;
507 	} else if (UNEXPECTED(property_info == ZEND_WRONG_PROPERTY_INFO)) {
508 		/* Information was available, but we were denied access.  Error out. */
509 		if (!silent) {
510 			zend_throw_error(NULL, "Cannot access %s property %s::$%s", zend_visibility_string(flags), ZSTR_VAL(ce->name), ZSTR_VAL(member));
511 		}
512 		return ZEND_WRONG_PROPERTY_INFO;
513 	}
514 
515 exit:
516 	return property_info;
517 }
518 /* }}} */
519 
zend_check_property_access(zend_object * zobj,zend_string * prop_info_name)520 ZEND_API int zend_check_property_access(zend_object *zobj, zend_string *prop_info_name) /* {{{ */
521 {
522 	zend_property_info *property_info;
523 	const char *class_name = NULL;
524 	const char *prop_name;
525 	zend_string *member;
526 	size_t prop_name_len;
527 
528 	if (ZSTR_VAL(prop_info_name)[0] == 0) {
529 		zend_unmangle_property_name_ex(prop_info_name, &class_name, &prop_name, &prop_name_len);
530 		member = zend_string_init(prop_name, prop_name_len, 0);
531 	} else {
532 		member = zend_string_copy(prop_info_name);
533 	}
534 	property_info = zend_get_property_info(zobj->ce, member, 1);
535 	zend_string_release_ex(member, 0);
536 	if (property_info == NULL) {
537 		/* undefined public property */
538 		if (class_name && class_name[0] != '*') {
539 			/* we we're looking for a private prop */
540 			return FAILURE;
541 		}
542 		return SUCCESS;
543 	} else if (property_info == ZEND_WRONG_PROPERTY_INFO) {
544 		return FAILURE;
545 	}
546 	if (class_name && class_name[0] != '*') {
547 		if (!(property_info->flags & ZEND_ACC_PRIVATE)) {
548 			/* we we're looking for a private prop but found a non private one of the same name */
549 			return FAILURE;
550 		} else if (strcmp(ZSTR_VAL(prop_info_name)+1, ZSTR_VAL(property_info->name)+1)) {
551 			/* we we're looking for a private prop but found a private one of the same name but another class */
552 			return FAILURE;
553 		}
554 	}
555 	return zend_verify_property_access(property_info, zobj->ce) ? SUCCESS : FAILURE;
556 }
557 /* }}} */
558 
zend_property_guard_dtor(zval * el)559 static void zend_property_guard_dtor(zval *el) /* {{{ */ {
560 	uint32_t *ptr = (uint32_t*)Z_PTR_P(el);
561 	if (EXPECTED(!(((zend_uintptr_t)ptr) & 1))) {
562 		efree_size(ptr, sizeof(uint32_t));
563 	}
564 }
565 /* }}} */
566 
zend_get_property_guard(zend_object * zobj,zend_string * member)567 ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *member) /* {{{ */
568 {
569 	HashTable *guards;
570 	zval *zv;
571 	uint32_t *ptr;
572 
573 	ZEND_ASSERT(zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS);
574 	zv = zobj->properties_table + zobj->ce->default_properties_count;
575 	if (EXPECTED(Z_TYPE_P(zv) == IS_STRING)) {
576 		zend_string *str = Z_STR_P(zv);
577 		if (EXPECTED(str == member) ||
578 		     /* hash values are always pred-calculated here */
579 		    (EXPECTED(ZSTR_H(str) == ZSTR_H(member)) &&
580 		     EXPECTED(zend_string_equal_content(str, member)))) {
581 			return &Z_PROPERTY_GUARD_P(zv);
582 		} else if (EXPECTED(Z_PROPERTY_GUARD_P(zv) == 0)) {
583 			zval_ptr_dtor_str(zv);
584 			ZVAL_STR_COPY(zv, member);
585 			return &Z_PROPERTY_GUARD_P(zv);
586 		} else {
587 			ALLOC_HASHTABLE(guards);
588 			zend_hash_init(guards, 8, NULL, zend_property_guard_dtor, 0);
589 			/* mark pointer as "special" using low bit */
590 			zend_hash_add_new_ptr(guards, str,
591 				(void*)(((zend_uintptr_t)&Z_PROPERTY_GUARD_P(zv)) | 1));
592 			zval_ptr_dtor_str(zv);
593 			ZVAL_ARR(zv, guards);
594 		}
595 	} else if (EXPECTED(Z_TYPE_P(zv) == IS_ARRAY)) {
596 		guards = Z_ARRVAL_P(zv);
597 		ZEND_ASSERT(guards != NULL);
598 		zv = zend_hash_find(guards, member);
599 		if (zv != NULL) {
600 			return (uint32_t*)(((zend_uintptr_t)Z_PTR_P(zv)) & ~1);
601 		}
602 	} else {
603 		ZEND_ASSERT(Z_TYPE_P(zv) == IS_UNDEF);
604 		ZVAL_STR_COPY(zv, member);
605 		Z_PROPERTY_GUARD_P(zv) = 0;
606 		return &Z_PROPERTY_GUARD_P(zv);
607 	}
608 	/* we have to allocate uint32_t separately because ht->arData may be reallocated */
609 	ptr = (uint32_t*)emalloc(sizeof(uint32_t));
610 	*ptr = 0;
611 	return (uint32_t*)zend_hash_add_new_ptr(guards, member, ptr);
612 }
613 /* }}} */
614 
zend_std_read_property(zval * object,zval * member,int type,void ** cache_slot,zval * rv)615 ZEND_API zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
616 {
617 	zend_object *zobj;
618 	zend_string *name, *tmp_name;
619 	zval *retval;
620 	uintptr_t property_offset;
621 	uint32_t *guard = NULL;
622 
623 	zobj = Z_OBJ_P(object);
624 	name = zval_get_tmp_string(member, &tmp_name);
625 
626 #if DEBUG_OBJECT_HANDLERS
627 	fprintf(stderr, "Read object #%d property: %s\n", Z_OBJ_HANDLE_P(object), ZSTR_VAL(name));
628 #endif
629 
630 	/* make zend_get_property_info silent if we have getter - we may want to use it */
631 	property_offset = zend_get_property_offset(zobj->ce, name, (type == BP_VAR_IS) || (zobj->ce->__get != NULL), cache_slot);
632 
633 	if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
634 		retval = OBJ_PROP(zobj, property_offset);
635 		if (EXPECTED(Z_TYPE_P(retval) != IS_UNDEF)) {
636 			goto exit;
637 		}
638 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
639 		if (EXPECTED(zobj->properties != NULL)) {
640 			if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
641 				uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
642 
643 				if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
644 					Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
645 
646 					if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF) &&
647 				        (EXPECTED(p->key == name) ||
648 				         (EXPECTED(p->h == ZSTR_H(name)) &&
649 				          EXPECTED(p->key != NULL) &&
650 				          EXPECTED(zend_string_equal_content(p->key, name))))) {
651 						retval = &p->val;
652 						goto exit;
653 					}
654 				}
655 				CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
656 			}
657 			retval = zend_hash_find(zobj->properties, name);
658 			if (EXPECTED(retval)) {
659 				if (cache_slot) {
660 					uintptr_t idx = (char*)retval - (char*)zobj->properties->arData;
661 					CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
662 				}
663 				goto exit;
664 			}
665 		}
666 	} else if (UNEXPECTED(EG(exception))) {
667 		retval = &EG(uninitialized_zval);
668 		goto exit;
669 	}
670 
671 	/* magic isset */
672 	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
673 		zval tmp_result;
674 		guard = zend_get_property_guard(zobj, name);
675 
676 		if (!((*guard) & IN_ISSET)) {
677 			if (!tmp_name && !ZSTR_IS_INTERNED(name)) {
678 				tmp_name = zend_string_copy(name);
679 			}
680 			GC_ADDREF(zobj);
681 			ZVAL_UNDEF(&tmp_result);
682 
683 			*guard |= IN_ISSET;
684 			zend_std_call_issetter(zobj, name, &tmp_result);
685 			*guard &= ~IN_ISSET;
686 
687 			if (!zend_is_true(&tmp_result)) {
688 				retval = &EG(uninitialized_zval);
689 				OBJ_RELEASE(zobj);
690 				zval_ptr_dtor(&tmp_result);
691 				goto exit;
692 			}
693 
694 			zval_ptr_dtor(&tmp_result);
695 			if (zobj->ce->__get && !((*guard) & IN_GET)) {
696 				goto call_getter;
697 			}
698 			OBJ_RELEASE(zobj);
699 		} else if (zobj->ce->__get && !((*guard) & IN_GET)) {
700 			goto call_getter_addref;
701 		}
702 	} else if (zobj->ce->__get) {
703 		/* magic get */
704 		guard = zend_get_property_guard(zobj, name);
705 		if (!((*guard) & IN_GET)) {
706 			/* have getter - try with it! */
707 call_getter_addref:
708 			GC_ADDREF(zobj);
709 call_getter:
710 			*guard |= IN_GET; /* prevent circular getting */
711 			zend_std_call_getter(zobj, name, rv);
712 			*guard &= ~IN_GET;
713 
714 			if (Z_TYPE_P(rv) != IS_UNDEF) {
715 				retval = rv;
716 				if (!Z_ISREF_P(rv) &&
717 				    (type == BP_VAR_W || type == BP_VAR_RW  || type == BP_VAR_UNSET)) {
718 					if (UNEXPECTED(Z_TYPE_P(rv) != IS_OBJECT)) {
719 						zend_error(E_NOTICE, "Indirect modification of overloaded property %s::$%s has no effect", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
720 					}
721 				}
722 			} else {
723 				retval = &EG(uninitialized_zval);
724 			}
725 			OBJ_RELEASE(zobj);
726 			goto exit;
727 		} else if (ZSTR_VAL(name)[0] == '\0' && ZSTR_LEN(name) != 0) {
728 			zend_throw_error(NULL, "Cannot access property started with '\\0'");
729 			retval = &EG(uninitialized_zval);
730 			goto exit;
731 		}
732 	}
733 
734 	if ((type != BP_VAR_IS)) {
735 		zend_error(E_NOTICE,"Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
736 	}
737 	retval = &EG(uninitialized_zval);
738 
739 exit:
740 	zend_tmp_string_release(tmp_name);
741 
742 	return retval;
743 }
744 /* }}} */
745 
zend_std_write_property(zval * object,zval * member,zval * value,void ** cache_slot)746 ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, void **cache_slot) /* {{{ */
747 {
748 	zend_object *zobj;
749 	zend_string *name, *tmp_name;
750 	zval *variable_ptr;
751 	uintptr_t property_offset;
752 
753 	zobj = Z_OBJ_P(object);
754 	name = zval_get_tmp_string(member, &tmp_name);
755 
756 	property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__set != NULL), cache_slot);
757 
758 	if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
759 		variable_ptr = OBJ_PROP(zobj, property_offset);
760 		if (Z_TYPE_P(variable_ptr) != IS_UNDEF) {
761 			goto found;
762 		}
763 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
764 		if (EXPECTED(zobj->properties != NULL)) {
765 			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
766 				if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
767 					GC_DELREF(zobj->properties);
768 				}
769 				zobj->properties = zend_array_dup(zobj->properties);
770 			}
771 			if ((variable_ptr = zend_hash_find(zobj->properties, name)) != NULL) {
772 found:
773 				zend_assign_to_variable(variable_ptr, value, IS_CV);
774 				goto exit;
775 			}
776 		}
777 	} else if (UNEXPECTED(EG(exception))) {
778 		goto exit;
779 	}
780 
781 	/* magic set */
782 	if (zobj->ce->__set) {
783 		uint32_t *guard = zend_get_property_guard(zobj, name);
784 
785 	    if (!((*guard) & IN_SET)) {
786 			GC_ADDREF(zobj);
787 			(*guard) |= IN_SET; /* prevent circular setting */
788 			zend_std_call_setter(zobj, name, value);
789 			(*guard) &= ~IN_SET;
790 			OBJ_RELEASE(zobj);
791 		} else if (EXPECTED(!IS_WRONG_PROPERTY_OFFSET(property_offset))) {
792 			goto write_std_property;
793 		} else {
794 			if (ZSTR_VAL(name)[0] == '\0' && ZSTR_LEN(name) != 0) {
795 				zend_throw_error(NULL, "Cannot access property started with '\\0'");
796 				goto exit;
797 			}
798 		}
799 	} else if (EXPECTED(!IS_WRONG_PROPERTY_OFFSET(property_offset))) {
800 write_std_property:
801 		if (Z_REFCOUNTED_P(value)) {
802 			if (Z_ISREF_P(value)) {
803 				/* if we assign referenced variable, we should separate it */
804 				value = Z_REFVAL_P(value);
805 				if (Z_REFCOUNTED_P(value)) {
806 					Z_ADDREF_P(value);
807 				}
808 			} else {
809 				Z_ADDREF_P(value);
810 			}
811 		}
812 		if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
813 			ZVAL_COPY_VALUE(OBJ_PROP(zobj, property_offset), value);
814 		} else {
815 			if (!zobj->properties) {
816 				rebuild_object_properties(zobj);
817 			}
818 			zend_hash_add_new(zobj->properties, name, value);
819 		}
820 	}
821 
822 exit:
823 	zend_tmp_string_release(tmp_name);
824 }
825 /* }}} */
826 
zend_std_read_dimension(zval * object,zval * offset,int type,zval * rv)827 ZEND_API zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
828 {
829 	zend_class_entry *ce = Z_OBJCE_P(object);
830 	zval tmp_offset, tmp_object;
831 
832 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
833 		if (offset == NULL) {
834 			/* [] construct */
835 			ZVAL_NULL(&tmp_offset);
836 		} else {
837 			ZVAL_COPY_DEREF(&tmp_offset, offset);
838 		}
839 
840 		ZVAL_COPY(&tmp_object, object);
841 		if (type == BP_VAR_IS) {
842 			zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", rv, &tmp_offset);
843 			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
844 				zval_ptr_dtor(&tmp_object);
845 				zval_ptr_dtor(&tmp_offset);
846 				return NULL;
847 			}
848 			if (!i_zend_is_true(rv)) {
849 				zval_ptr_dtor(&tmp_object);
850 				zval_ptr_dtor(&tmp_offset);
851 				zval_ptr_dtor(rv);
852 				return &EG(uninitialized_zval);
853 			}
854 			zval_ptr_dtor(rv);
855 		}
856 
857 		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", rv, &tmp_offset);
858 
859 		zval_ptr_dtor(&tmp_object);
860 		zval_ptr_dtor(&tmp_offset);
861 
862 		if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
863 			if (UNEXPECTED(!EG(exception))) {
864 				zend_throw_error(NULL, "Undefined offset for object of type %s used as array", ZSTR_VAL(ce->name));
865 			}
866 			return NULL;
867 		}
868 		return rv;
869 	} else {
870 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
871 		return NULL;
872 	}
873 }
874 /* }}} */
875 
zend_std_write_dimension(zval * object,zval * offset,zval * value)876 ZEND_API void zend_std_write_dimension(zval *object, zval *offset, zval *value) /* {{{ */
877 {
878 	zend_class_entry *ce = Z_OBJCE_P(object);
879 	zval tmp_offset, tmp_object;
880 
881 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
882 		if (!offset) {
883 			ZVAL_NULL(&tmp_offset);
884 		} else {
885 			ZVAL_COPY_DEREF(&tmp_offset, offset);
886 		}
887 		ZVAL_COPY(&tmp_object, object);
888 		zend_call_method_with_2_params(&tmp_object, ce, NULL, "offsetset", NULL, &tmp_offset, value);
889 		zval_ptr_dtor(&tmp_object);
890 		zval_ptr_dtor(&tmp_offset);
891 	} else {
892 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
893 	}
894 }
895 /* }}} */
896 
zend_std_has_dimension(zval * object,zval * offset,int check_empty)897 ZEND_API int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /* {{{ */
898 {
899 	zend_class_entry *ce = Z_OBJCE_P(object);
900 	zval retval, tmp_offset, tmp_object;
901 	int result;
902 
903 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
904 		ZVAL_COPY_DEREF(&tmp_offset, offset);
905 		ZVAL_COPY(&tmp_object, object);
906 		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", &retval, &tmp_offset);
907 		result = i_zend_is_true(&retval);
908 		zval_ptr_dtor(&retval);
909 		if (check_empty && result && EXPECTED(!EG(exception))) {
910 			zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", &retval, &tmp_offset);
911 			result = i_zend_is_true(&retval);
912 			zval_ptr_dtor(&retval);
913 		}
914 		zval_ptr_dtor(&tmp_object);
915 		zval_ptr_dtor(&tmp_offset);
916 	} else {
917 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
918 		return 0;
919 	}
920 	return result;
921 }
922 /* }}} */
923 
zend_std_get_property_ptr_ptr(zval * object,zval * member,int type,void ** cache_slot)924 ZEND_API zval *zend_std_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot) /* {{{ */
925 {
926 	zend_object *zobj;
927 	zend_string *name, *tmp_name;
928 	zval *retval = NULL;
929 	uintptr_t property_offset;
930 
931 	zobj = Z_OBJ_P(object);
932 	name = zval_get_tmp_string(member, &tmp_name);
933 
934 #if DEBUG_OBJECT_HANDLERS
935 	fprintf(stderr, "Ptr object #%d property: %s\n", Z_OBJ_HANDLE_P(object), ZSTR_VAL(name));
936 #endif
937 
938 	property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__get != NULL), cache_slot);
939 
940 	if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
941 		retval = OBJ_PROP(zobj, property_offset);
942 		if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
943 			if (EXPECTED(!zobj->ce->__get) ||
944 			    UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
945 				ZVAL_NULL(retval);
946 				/* Notice is thrown after creation of the property, to avoid EG(std_property_info)
947 				 * being overwritten in an error handler. */
948 				if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
949 					zend_error(E_NOTICE, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
950 				}
951 			} else {
952 				/* we do have getter - fail and let it try again with usual get/set */
953 				retval = NULL;
954 			}
955 		}
956 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
957 		if (EXPECTED(zobj->properties)) {
958 			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
959 				if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
960 					GC_DELREF(zobj->properties);
961 				}
962 				zobj->properties = zend_array_dup(zobj->properties);
963 			}
964 		    if (EXPECTED((retval = zend_hash_find(zobj->properties, name)) != NULL)) {
965 				zend_tmp_string_release(tmp_name);
966 				return retval;
967 		    }
968 		}
969 		if (EXPECTED(!zobj->ce->__get) ||
970 		    UNEXPECTED((*zend_get_property_guard(zobj, name)) & IN_GET)) {
971 			if (UNEXPECTED(!zobj->properties)) {
972 				rebuild_object_properties(zobj);
973 			}
974 			retval = zend_hash_update(zobj->properties, name, &EG(uninitialized_zval));
975 			/* Notice is thrown after creation of the property, to avoid EG(std_property_info)
976 			 * being overwritten in an error handler. */
977 			if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
978 				zend_error(E_NOTICE, "Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), ZSTR_VAL(name));
979 			}
980 		}
981 	}
982 
983 	zend_tmp_string_release(tmp_name);
984 	return retval;
985 }
986 /* }}} */
987 
zend_std_unset_property(zval * object,zval * member,void ** cache_slot)988 ZEND_API void zend_std_unset_property(zval *object, zval *member, void **cache_slot) /* {{{ */
989 {
990 	zend_object *zobj;
991 	zend_string *name, *tmp_name;
992 	uintptr_t property_offset;
993 
994 	zobj = Z_OBJ_P(object);
995 	name = zval_get_tmp_string(member, &tmp_name);
996 
997 	property_offset = zend_get_property_offset(zobj->ce, name, (zobj->ce->__unset != NULL), cache_slot);
998 
999 	if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1000 		zval *slot = OBJ_PROP(zobj, property_offset);
1001 
1002 		if (Z_TYPE_P(slot) != IS_UNDEF) {
1003 			zval_ptr_dtor(slot);
1004 			ZVAL_UNDEF(slot);
1005 			if (zobj->properties) {
1006 				HT_FLAGS(zobj->properties) |= HASH_FLAG_HAS_EMPTY_IND;
1007 			}
1008 			goto exit;
1009 		}
1010 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))
1011 	 && EXPECTED(zobj->properties != NULL)) {
1012 		if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
1013 			if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
1014 				GC_DELREF(zobj->properties);
1015 			}
1016 			zobj->properties = zend_array_dup(zobj->properties);
1017 		}
1018 		if (EXPECTED(zend_hash_del(zobj->properties, name) != FAILURE)) {
1019 			goto exit;
1020 		}
1021 	} else if (UNEXPECTED(EG(exception))) {
1022 		goto exit;
1023 	}
1024 
1025 	/* magic unset */
1026 	if (zobj->ce->__unset) {
1027 		uint32_t *guard = zend_get_property_guard(zobj, name);
1028 		if (!((*guard) & IN_UNSET)) {
1029 			/* have unseter - try with it! */
1030 			(*guard) |= IN_UNSET; /* prevent circular unsetting */
1031 			zend_std_call_unsetter(zobj, name);
1032 			(*guard) &= ~IN_UNSET;
1033 		} else {
1034 			if (ZSTR_VAL(name)[0] == '\0' && ZSTR_LEN(name) != 0) {
1035 				zend_throw_error(NULL, "Cannot access property started with '\\0'");
1036 				goto exit;
1037 			}
1038 		}
1039 	}
1040 
1041 exit:
1042 	zend_tmp_string_release(tmp_name);
1043 }
1044 /* }}} */
1045 
zend_std_unset_dimension(zval * object,zval * offset)1046 ZEND_API void zend_std_unset_dimension(zval *object, zval *offset) /* {{{ */
1047 {
1048 	zend_class_entry *ce = Z_OBJCE_P(object);
1049 	zval tmp_offset, tmp_object;
1050 
1051 	if (instanceof_function_ex(ce, zend_ce_arrayaccess, 1)) {
1052 		ZVAL_COPY_DEREF(&tmp_offset, offset);
1053 		ZVAL_COPY(&tmp_object, object);
1054 		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetunset", NULL, &tmp_offset);
1055 		zval_ptr_dtor(&tmp_object);
1056 		zval_ptr_dtor(&tmp_offset);
1057 	} else {
1058 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
1059 	}
1060 }
1061 /* }}} */
1062 
zend_get_parent_private(zend_class_entry * scope,zend_class_entry * ce,zend_string * function_name)1063 static zend_always_inline zend_function *zend_get_parent_private(zend_class_entry *scope, zend_class_entry *ce, zend_string *function_name) /* {{{ */
1064 {
1065 	zval *func;
1066 	zend_function *fbc;
1067 
1068 	ce = ce->parent;
1069 	while (ce) {
1070 		if (ce == scope) {
1071 			if ((func = zend_hash_find(&ce->function_table, function_name))) {
1072 				fbc = Z_FUNC_P(func);
1073 				if (fbc->common.fn_flags & ZEND_ACC_PRIVATE
1074 				 && fbc->common.scope == scope) {
1075 					return fbc;
1076 				}
1077 			}
1078 			break;
1079 		}
1080 		ce = ce->parent;
1081 	}
1082 	return NULL;
1083 }
1084 /* }}} */
1085 
1086 /* Ensures that we're allowed to call a private method.
1087  * Returns the function address that should be called, or NULL
1088  * if no such function exists.
1089  */
zend_check_private(zend_function * fbc,zend_class_entry * ce,zend_string * function_name)1090 ZEND_API int zend_check_private(zend_function *fbc, zend_class_entry *ce, zend_string *function_name) /* {{{ */
1091 {
1092     zend_class_entry *scope;
1093 
1094 	if (!ce) {
1095 		return 0;
1096 	}
1097 
1098 	/* We may call a private function if:
1099 	 * 1.  The class of our object is the same as the scope, and the private
1100 	 *     function (EX(fbc)) has the same scope.
1101 	 * 2.  One of our parent classes are the same as the scope, and it contains
1102 	 *     a private function with the same name that has the same scope.
1103 	 */
1104 	scope = zend_get_executed_scope();
1105 	if (fbc->common.scope == ce && scope == ce) {
1106 		/* rule #1 checks out ok, allow the function call */
1107 		return 1;
1108 	}
1109 
1110 
1111 	/* Check rule #2 */
1112 	return zend_get_parent_private(scope, ce, function_name) != NULL;
1113 }
1114 /* }}} */
1115 
1116 /* Ensures that we're allowed to call a protected method.
1117  */
zend_check_protected(zend_class_entry * ce,zend_class_entry * scope)1118 ZEND_API int zend_check_protected(zend_class_entry *ce, zend_class_entry *scope) /* {{{ */
1119 {
1120 	zend_class_entry *fbc_scope = ce;
1121 
1122 	/* Is the context that's calling the function, the same as one of
1123 	 * the function's parents?
1124 	 */
1125 	while (fbc_scope) {
1126 		if (fbc_scope==scope) {
1127 			return 1;
1128 		}
1129 		fbc_scope = fbc_scope->parent;
1130 	}
1131 
1132 	/* Is the function's scope the same as our current object context,
1133 	 * or any of the parents of our context?
1134 	 */
1135 	while (scope) {
1136 		if (scope==ce) {
1137 			return 1;
1138 		}
1139 		scope = scope->parent;
1140 	}
1141 	return 0;
1142 }
1143 /* }}} */
1144 
zend_get_call_trampoline_func(zend_class_entry * ce,zend_string * method_name,int is_static)1145 ZEND_API zend_function *zend_get_call_trampoline_func(zend_class_entry *ce, zend_string *method_name, int is_static) /* {{{ */
1146 {
1147 	size_t mname_len;
1148 	zend_op_array *func;
1149 	zend_function *fbc = is_static ? ce->__callstatic : ce->__call;
1150 
1151 	ZEND_ASSERT(fbc);
1152 
1153 	if (EXPECTED(EG(trampoline).common.function_name == NULL)) {
1154 		func = &EG(trampoline).op_array;
1155 	} else {
1156 		func = ecalloc(1, sizeof(zend_op_array));
1157 	}
1158 
1159 	func->type = ZEND_USER_FUNCTION;
1160 	func->arg_flags[0] = 0;
1161 	func->arg_flags[1] = 0;
1162 	func->arg_flags[2] = 0;
1163 	func->fn_flags = ZEND_ACC_CALL_VIA_TRAMPOLINE | ZEND_ACC_PUBLIC;
1164 	if (is_static) {
1165 		func->fn_flags |= ZEND_ACC_STATIC;
1166 	}
1167 	func->opcodes = &EG(call_trampoline_op);
1168 	func->run_time_cache = (void*)(intptr_t)-1;
1169 	func->scope = fbc->common.scope;
1170 	/* reserve space for arguments, local and temorary variables */
1171 	func->T = (fbc->type == ZEND_USER_FUNCTION)? MAX(fbc->op_array.last_var + fbc->op_array.T, 2) : 2;
1172 	func->filename = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.filename : ZSTR_EMPTY_ALLOC();
1173 	func->line_start = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_start : 0;
1174 	func->line_end = (fbc->type == ZEND_USER_FUNCTION)? fbc->op_array.line_end : 0;
1175 
1176 	//??? keep compatibility for "\0" characters
1177 	//??? see: Zend/tests/bug46238.phpt
1178 	if (UNEXPECTED((mname_len = strlen(ZSTR_VAL(method_name))) != ZSTR_LEN(method_name))) {
1179 		func->function_name = zend_string_init(ZSTR_VAL(method_name), mname_len, 0);
1180 	} else {
1181 		func->function_name = zend_string_copy(method_name);
1182 	}
1183 
1184 	return (zend_function*)func;
1185 }
1186 /* }}} */
1187 
zend_get_user_call_function(zend_class_entry * ce,zend_string * method_name)1188 static zend_always_inline zend_function *zend_get_user_call_function(zend_class_entry *ce, zend_string *method_name) /* {{{ */
1189 {
1190 	return zend_get_call_trampoline_func(ce, method_name, 0);
1191 }
1192 /* }}} */
1193 
zend_std_get_method(zend_object ** obj_ptr,zend_string * method_name,const zval * key)1194 ZEND_API zend_function *zend_std_get_method(zend_object **obj_ptr, zend_string *method_name, const zval *key) /* {{{ */
1195 {
1196 	zend_object *zobj = *obj_ptr;
1197 	zval *func;
1198 	zend_function *fbc;
1199 	zend_string *lc_method_name;
1200 	zend_class_entry *scope = NULL;
1201 	ALLOCA_FLAG(use_heap);
1202 
1203 	if (EXPECTED(key != NULL)) {
1204 		lc_method_name = Z_STR_P(key);
1205 #ifdef ZEND_ALLOCA_MAX_SIZE
1206 		use_heap = 0;
1207 #endif
1208 	} else {
1209 		ZSTR_ALLOCA_ALLOC(lc_method_name, ZSTR_LEN(method_name), use_heap);
1210 		zend_str_tolower_copy(ZSTR_VAL(lc_method_name), ZSTR_VAL(method_name), ZSTR_LEN(method_name));
1211 	}
1212 
1213 	if (UNEXPECTED((func = zend_hash_find(&zobj->ce->function_table, lc_method_name)) == NULL)) {
1214 		if (UNEXPECTED(!key)) {
1215 			ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
1216 		}
1217 		if (zobj->ce->__call) {
1218 			return zend_get_user_call_function(zobj->ce, method_name);
1219 		} else {
1220 			return NULL;
1221 		}
1222 	}
1223 
1224 	fbc = Z_FUNC_P(func);
1225 	/* Check access level */
1226 	if (fbc->op_array.fn_flags & ZEND_ACC_PRIVATE) {
1227 		/* Ensure that if we're calling a private function, we're allowed to do so.
1228 		 * If we're not and __call() handler exists, invoke it, otherwise error out.
1229 		 */
1230 		scope = zend_get_executed_scope();
1231 		if (fbc->common.scope != scope || zobj->ce != scope) {
1232 			zend_function *updated_fbc = zend_get_parent_private(scope, zobj->ce, lc_method_name);
1233 			if (EXPECTED(updated_fbc != NULL)) {
1234 				fbc = updated_fbc;
1235 			} else {
1236 				if (zobj->ce->__call) {
1237 					fbc = zend_get_user_call_function(zobj->ce, method_name);
1238 				} else {
1239 					scope = zend_get_executed_scope();
1240 					zend_throw_error(NULL, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(method_name), scope ? ZSTR_VAL(scope->name) : "");
1241 					fbc = NULL;
1242 				}
1243 			}
1244 		}
1245 	} else if (fbc->op_array.fn_flags & (ZEND_ACC_CHANGED|ZEND_ACC_PROTECTED)) {
1246 		/* Ensure that we haven't overridden a private function and end up calling
1247 		 * the overriding public function...
1248 		 */
1249 
1250 		scope = zend_get_executed_scope();
1251 		do {
1252 			if (fbc->op_array.fn_flags & ZEND_ACC_CHANGED) {
1253 				zend_function *priv_fbc = zend_get_parent_private(scope, fbc->common.scope, lc_method_name);
1254 				if (priv_fbc) {
1255 					fbc = priv_fbc;
1256 					break;
1257 				} else if (!(fbc->op_array.fn_flags & ZEND_ACC_PROTECTED)) {
1258 					break;
1259 				}
1260 			}
1261 
1262 			/* Ensure that if we're calling a protected function, we're allowed to do so.
1263 			 * If we're not and __call() handler exists, invoke it, otherwise error out.
1264 			 */
1265 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
1266 				if (zobj->ce->__call) {
1267 					fbc = zend_get_user_call_function(zobj->ce, method_name);
1268 				} else {
1269 					zend_throw_error(NULL, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(method_name), scope ? ZSTR_VAL(scope->name) : "");
1270 					fbc = NULL;
1271 				}
1272 			}
1273 		} while (0);
1274 	}
1275 
1276 	if (UNEXPECTED(!key)) {
1277 		ZSTR_ALLOCA_FREE(lc_method_name, use_heap);
1278 	}
1279 	return fbc;
1280 }
1281 /* }}} */
1282 
zend_get_user_callstatic_function(zend_class_entry * ce,zend_string * method_name)1283 static zend_always_inline zend_function *zend_get_user_callstatic_function(zend_class_entry *ce, zend_string *method_name) /* {{{ */
1284 {
1285 	return zend_get_call_trampoline_func(ce, method_name, 1);
1286 }
1287 /* }}} */
1288 
zend_std_get_static_method(zend_class_entry * ce,zend_string * function_name,const zval * key)1289 ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_string *function_name, const zval *key) /* {{{ */
1290 {
1291 	zend_function *fbc = NULL;
1292 	zend_string *lc_function_name;
1293 	zend_object *object;
1294 	zend_class_entry *scope;
1295 
1296 	if (EXPECTED(key != NULL)) {
1297 		lc_function_name = Z_STR_P(key);
1298 	} else {
1299 		lc_function_name = zend_string_tolower(function_name);
1300 	}
1301 
1302 	do {
1303 		zval *func = zend_hash_find(&ce->function_table, lc_function_name);
1304 		if (EXPECTED(func != NULL)) {
1305 			fbc = Z_FUNC_P(func);
1306 		} else if (ce->constructor
1307 			&& ZSTR_LEN(lc_function_name) == ZSTR_LEN(ce->name)
1308 			&& zend_binary_strncasecmp(ZSTR_VAL(lc_function_name), ZSTR_LEN(lc_function_name), ZSTR_VAL(ce->name), ZSTR_LEN(lc_function_name), ZSTR_LEN(lc_function_name)) == 0
1309 			/* Only change the method to the constructor if the constructor isn't called __construct
1310 			 * we check for __ so we can be binary safe for lowering, we should use ZEND_CONSTRUCTOR_FUNC_NAME
1311 			 */
1312 			&& (ZSTR_VAL(ce->constructor->common.function_name)[0] != '_'
1313 				|| ZSTR_VAL(ce->constructor->common.function_name)[1] != '_')) {
1314 			fbc = ce->constructor;
1315 		} else {
1316 			if (UNEXPECTED(!key)) {
1317 				zend_string_release_ex(lc_function_name, 0);
1318 			}
1319 			if (ce->__call &&
1320 				(object = zend_get_this_object(EG(current_execute_data))) != NULL &&
1321 			    instanceof_function(object->ce, ce)) {
1322 				/* Call the top-level defined __call().
1323 				 * see: tests/classes/__call_004.phpt  */
1324 
1325 				zend_class_entry *call_ce = object->ce;
1326 
1327 				while (!call_ce->__call) {
1328 					call_ce = call_ce->parent;
1329 				}
1330 				return zend_get_user_call_function(call_ce, function_name);
1331 			} else if (ce->__callstatic) {
1332 				return zend_get_user_callstatic_function(ce, function_name);
1333 			} else {
1334 	   			return NULL;
1335 			}
1336 		}
1337 	} while (0);
1338 
1339 #if MBO_0
1340 	/* right now this function is used for non static method lookup too */
1341 	/* Is the function static */
1342 	if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
1343 		zend_error_noreturn(E_ERROR, "Cannot call non static method %s::%s() without object", ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(fbc->common.function_name));
1344 	}
1345 #endif
1346 	if (fbc->op_array.fn_flags & ZEND_ACC_PUBLIC) {
1347 		/* No further checks necessary, most common case */
1348 	} else if (fbc->op_array.fn_flags & ZEND_ACC_PRIVATE) {
1349 		/* Ensure that if we're calling a private function, we're allowed to do so.
1350 		 */
1351 		scope = zend_get_executed_scope();
1352 		if (UNEXPECTED(fbc->common.scope != scope)) {
1353 			if (ce->__callstatic) {
1354 				fbc = zend_get_user_callstatic_function(ce, function_name);
1355 			} else {
1356 				zend_throw_error(NULL, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(function_name), scope ? ZSTR_VAL(scope->name) : "");
1357 				fbc = NULL;
1358 			}
1359 		}
1360 	} else if ((fbc->common.fn_flags & ZEND_ACC_PROTECTED)) {
1361 		/* Ensure that if we're calling a protected function, we're allowed to do so.
1362 		 */
1363 		scope = zend_get_executed_scope();
1364 		if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(fbc), scope))) {
1365 			if (ce->__callstatic) {
1366 				fbc = zend_get_user_callstatic_function(ce, function_name);
1367 			} else {
1368 				zend_throw_error(NULL, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), ZSTR_VAL(function_name), scope ? ZSTR_VAL(scope->name) : "");
1369 				fbc = NULL;
1370 			}
1371 		}
1372 	}
1373 
1374 	if (UNEXPECTED(!key)) {
1375 		zend_string_release_ex(lc_function_name, 0);
1376 	}
1377 
1378 	return fbc;
1379 }
1380 /* }}} */
1381 
zend_class_init_statics(zend_class_entry * class_type)1382 ZEND_API void zend_class_init_statics(zend_class_entry *class_type) /* {{{ */
1383 {
1384 	int i;
1385 	zval *p;
1386 
1387 	if (!CE_STATIC_MEMBERS(class_type) && class_type->default_static_members_count) {
1388 		if (class_type->parent) {
1389 			zend_class_init_statics(class_type->parent);
1390 		}
1391 
1392 #if ZTS
1393 		CG(static_members_table)[(zend_intptr_t)(class_type->static_members_table)] = emalloc(sizeof(zval) * class_type->default_static_members_count);
1394 #else
1395 		class_type->static_members_table = emalloc(sizeof(zval) * class_type->default_static_members_count);
1396 #endif
1397 		for (i = 0; i < class_type->default_static_members_count; i++) {
1398 			p = &class_type->default_static_members_table[i];
1399 			if (Z_TYPE_P(p) == IS_INDIRECT) {
1400 				zval *q = &CE_STATIC_MEMBERS(class_type->parent)[i];
1401 				ZVAL_DEINDIRECT(q);
1402 				ZVAL_INDIRECT(&CE_STATIC_MEMBERS(class_type)[i], q);
1403 			} else {
1404 				ZVAL_COPY_OR_DUP(&CE_STATIC_MEMBERS(class_type)[i], p);
1405 			}
1406 		}
1407 	}
1408 } /* }}} */
1409 
zend_std_get_static_property(zend_class_entry * ce,zend_string * property_name,zend_bool silent)1410 ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, zend_bool silent) /* {{{ */
1411 {
1412 	zend_property_info *property_info = zend_hash_find_ptr(&ce->properties_info, property_name);
1413 	zval *ret;
1414 
1415 	if (UNEXPECTED(property_info == NULL)) {
1416 		goto undeclared_property;
1417 	}
1418 
1419 	if (UNEXPECTED(!zend_verify_property_access(property_info, ce))) {
1420 		if (!silent) {
1421 			zend_throw_error(NULL, "Cannot access %s property %s::$%s", zend_visibility_string(property_info->flags), ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
1422 		}
1423 		return NULL;
1424 	}
1425 
1426 	if (UNEXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0)) {
1427 		goto undeclared_property;
1428 	}
1429 
1430 	if (UNEXPECTED(!(ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED))) {
1431 		if (UNEXPECTED(zend_update_class_constants(ce)) != SUCCESS) {
1432 			return NULL;
1433 		}
1434 	}
1435 
1436 	/* check if static properties were destoyed */
1437 	if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
1438 		if (ce->type == ZEND_INTERNAL_CLASS) {
1439 			zend_class_init_statics(ce);
1440 		} else {
1441 undeclared_property:
1442 			if (!silent) {
1443 				zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
1444 			}
1445 			return NULL;
1446 		}
1447 	}
1448 
1449 	ret = CE_STATIC_MEMBERS(ce) + property_info->offset;
1450 	ZVAL_DEINDIRECT(ret);
1451 	return ret;
1452 }
1453 /* }}} */
1454 
zend_std_unset_static_property(zend_class_entry * ce,zend_string * property_name)1455 ZEND_API ZEND_COLD zend_bool zend_std_unset_static_property(zend_class_entry *ce, zend_string *property_name) /* {{{ */
1456 {
1457 	zend_throw_error(NULL, "Attempt to unset static property %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(property_name));
1458 	return 0;
1459 }
1460 /* }}} */
1461 
zend_std_get_constructor(zend_object * zobj)1462 ZEND_API zend_function *zend_std_get_constructor(zend_object *zobj) /* {{{ */
1463 {
1464 	zend_function *constructor = zobj->ce->constructor;
1465 	zend_class_entry *scope;
1466 
1467 	if (constructor) {
1468 		if (constructor->op_array.fn_flags & ZEND_ACC_PUBLIC) {
1469 			/* No further checks necessary */
1470 		} else if (constructor->op_array.fn_flags & ZEND_ACC_PRIVATE) {
1471 			/* Ensure that if we're calling a private function, we're allowed to do so.
1472 			 */
1473 			if (EG(fake_scope)) {
1474 				scope = EG(fake_scope);
1475 			} else {
1476 				scope = zend_get_executed_scope();
1477 			}
1478 			if (UNEXPECTED(constructor->common.scope != scope)) {
1479 				if (scope) {
1480 					zend_throw_error(NULL, "Call to private %s::%s() from context '%s'", ZSTR_VAL(constructor->common.scope->name), ZSTR_VAL(constructor->common.function_name), ZSTR_VAL(scope->name));
1481 					constructor = NULL;
1482 				} else {
1483 					zend_throw_error(NULL, "Call to private %s::%s() from invalid context", ZSTR_VAL(constructor->common.scope->name), ZSTR_VAL(constructor->common.function_name));
1484 					constructor = NULL;
1485 				}
1486 			}
1487 		} else if ((constructor->common.fn_flags & ZEND_ACC_PROTECTED)) {
1488 			/* Ensure that if we're calling a protected function, we're allowed to do so.
1489 			 * Constructors only have prototype if they are defined by an interface but
1490 			 * it is the compilers responsibility to take care of the prototype.
1491 			 */
1492 			if (EG(fake_scope)) {
1493 				scope = EG(fake_scope);
1494 			} else {
1495 				scope = zend_get_executed_scope();
1496 			}
1497 			if (UNEXPECTED(!zend_check_protected(zend_get_function_root_class(constructor), scope))) {
1498 				if (scope) {
1499 					zend_throw_error(NULL, "Call to protected %s::%s() from context '%s'", ZSTR_VAL(constructor->common.scope->name), ZSTR_VAL(constructor->common.function_name), ZSTR_VAL(scope->name));
1500 					constructor = NULL;
1501 				} else {
1502 					zend_throw_error(NULL, "Call to protected %s::%s() from invalid context", ZSTR_VAL(constructor->common.scope->name), ZSTR_VAL(constructor->common.function_name));
1503 					constructor = NULL;
1504 				}
1505 			}
1506 		}
1507 	}
1508 
1509 	return constructor;
1510 }
1511 /* }}} */
1512 
zend_std_compare_objects(zval * o1,zval * o2)1513 ZEND_API int zend_std_compare_objects(zval *o1, zval *o2) /* {{{ */
1514 {
1515 	zend_object *zobj1, *zobj2;
1516 
1517 	zobj1 = Z_OBJ_P(o1);
1518 	zobj2 = Z_OBJ_P(o2);
1519 
1520 	if (zobj1 == zobj2) {
1521 		return 0; /* the same object */
1522 	}
1523 	if (zobj1->ce != zobj2->ce) {
1524 		return 1; /* different classes */
1525 	}
1526 	if (!zobj1->properties && !zobj2->properties) {
1527 		zend_property_info *info;
1528 
1529 		if (!zobj1->ce->default_properties_count) {
1530 			return 0;
1531 		}
1532 
1533 		/* It's enough to protect only one of the objects.
1534 		 * The second one may be referenced from the first and this may cause
1535 		 * false recursion detection.
1536 		 */
1537 		/* use bitwise OR to make only one conditional jump */
1538 		if (UNEXPECTED(Z_IS_RECURSIVE_P(o1))) {
1539 			zend_error_noreturn(E_ERROR, "Nesting level too deep - recursive dependency?");
1540 		}
1541 		Z_PROTECT_RECURSION_P(o1);
1542 
1543 		ZEND_HASH_FOREACH_PTR(&zobj1->ce->properties_info, info) {
1544 			zval *p1 = OBJ_PROP(zobj1, info->offset);
1545 			zval *p2 = OBJ_PROP(zobj2, info->offset);
1546 
1547 			if (info->flags & ZEND_ACC_STATIC) {
1548 				continue;
1549 			}
1550 
1551 			if (Z_TYPE_P(p1) != IS_UNDEF) {
1552 				if (Z_TYPE_P(p2) != IS_UNDEF) {
1553 					zval result;
1554 
1555 					if (compare_function(&result, p1, p2)==FAILURE) {
1556 						Z_UNPROTECT_RECURSION_P(o1);
1557 						return 1;
1558 					}
1559 					if (Z_LVAL(result) != 0) {
1560 						Z_UNPROTECT_RECURSION_P(o1);
1561 						return Z_LVAL(result);
1562 					}
1563 				} else {
1564 					Z_UNPROTECT_RECURSION_P(o1);
1565 					return 1;
1566 				}
1567 			} else {
1568 				if (Z_TYPE_P(p2) != IS_UNDEF) {
1569 					Z_UNPROTECT_RECURSION_P(o1);
1570 					return 1;
1571 				}
1572 			}
1573 		} ZEND_HASH_FOREACH_END();
1574 
1575 		Z_UNPROTECT_RECURSION_P(o1);
1576 		return 0;
1577 	} else {
1578 		if (!zobj1->properties) {
1579 			rebuild_object_properties(zobj1);
1580 		}
1581 		if (!zobj2->properties) {
1582 			rebuild_object_properties(zobj2);
1583 		}
1584 		return zend_compare_symbol_tables(zobj1->properties, zobj2->properties);
1585 	}
1586 }
1587 /* }}} */
1588 
zend_std_has_property(zval * object,zval * member,int has_set_exists,void ** cache_slot)1589 ZEND_API int zend_std_has_property(zval *object, zval *member, int has_set_exists, void **cache_slot) /* {{{ */
1590 {
1591 	zend_object *zobj;
1592 	int result;
1593 	zval *value = NULL;
1594 	zend_string *name, *tmp_name;
1595 	uintptr_t property_offset;
1596 
1597 	zobj = Z_OBJ_P(object);
1598 	name = zval_get_tmp_string(member, &tmp_name);
1599 
1600 	property_offset = zend_get_property_offset(zobj->ce, name, 1, cache_slot);
1601 
1602 	if (EXPECTED(IS_VALID_PROPERTY_OFFSET(property_offset))) {
1603 		value = OBJ_PROP(zobj, property_offset);
1604 		if (Z_TYPE_P(value) != IS_UNDEF) {
1605 			goto found;
1606 		}
1607 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
1608 		if (EXPECTED(zobj->properties != NULL)) {
1609 			if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(property_offset)) {
1610 				uintptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(property_offset);
1611 
1612 				if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
1613 					Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
1614 
1615 					if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF) &&
1616 				        (EXPECTED(p->key == name) ||
1617 				         (EXPECTED(p->h == ZSTR_H(name)) &&
1618 				          EXPECTED(p->key != NULL) &&
1619 				          EXPECTED(zend_string_equal_content(p->key, name))))) {
1620 						value = &p->val;
1621 						goto found;
1622 					}
1623 				}
1624 				CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
1625 			}
1626 			value = zend_hash_find(zobj->properties, name);
1627 			if (value) {
1628 				if (cache_slot) {
1629 					uintptr_t idx = (char*)value - (char*)zobj->properties->arData;
1630 					CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
1631 				}
1632 found:
1633 				if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY) {
1634 					result = zend_is_true(value);
1635 				} else if (has_set_exists < ZEND_PROPERTY_NOT_EMPTY) {
1636 					ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_ISSET);
1637 					ZVAL_DEREF(value);
1638 					result = (Z_TYPE_P(value) != IS_NULL);
1639 				} else {
1640 					ZEND_ASSERT(has_set_exists == ZEND_PROPERTY_EXISTS);
1641 					result = 1;
1642 				}
1643 				goto exit;
1644 			}
1645 		}
1646 	} else if (UNEXPECTED(EG(exception))) {
1647 		result = 0;
1648 		goto exit;
1649 	}
1650 
1651 	result = 0;
1652 	if ((has_set_exists != ZEND_PROPERTY_EXISTS) && zobj->ce->__isset) {
1653 		uint32_t *guard = zend_get_property_guard(zobj, name);
1654 
1655 		if (!((*guard) & IN_ISSET)) {
1656 			zval rv;
1657 
1658 			/* have issetter - try with it! */
1659 			if (!tmp_name && !ZSTR_IS_INTERNED(name)) {
1660 				tmp_name = zend_string_copy(name);
1661 			}
1662 			GC_ADDREF(zobj);
1663 			(*guard) |= IN_ISSET; /* prevent circular getting */
1664 			zend_std_call_issetter(zobj, name, &rv);
1665 			result = zend_is_true(&rv);
1666 			zval_ptr_dtor(&rv);
1667 			if (has_set_exists == ZEND_PROPERTY_NOT_EMPTY && result) {
1668 				if (EXPECTED(!EG(exception)) && zobj->ce->__get && !((*guard) & IN_GET)) {
1669 					(*guard) |= IN_GET;
1670 					zend_std_call_getter(zobj, name, &rv);
1671 					(*guard) &= ~IN_GET;
1672 					result = i_zend_is_true(&rv);
1673 					zval_ptr_dtor(&rv);
1674 				} else {
1675 					result = 0;
1676 				}
1677 			}
1678 			(*guard) &= ~IN_ISSET;
1679 			OBJ_RELEASE(zobj);
1680 		}
1681 	}
1682 
1683 exit:
1684 	zend_tmp_string_release(tmp_name);
1685 	return result;
1686 }
1687 /* }}} */
1688 
zend_std_get_class_name(const zend_object * zobj)1689 ZEND_API zend_string *zend_std_get_class_name(const zend_object *zobj) /* {{{ */
1690 {
1691 	return zend_string_copy(zobj->ce->name);
1692 }
1693 /* }}} */
1694 
zend_std_cast_object_tostring(zval * readobj,zval * writeobj,int type)1695 ZEND_API int zend_std_cast_object_tostring(zval *readobj, zval *writeobj, int type) /* {{{ */
1696 {
1697 	zval retval;
1698 	zend_class_entry *ce;
1699 
1700 	switch (type) {
1701 		case IS_STRING:
1702 			ce = Z_OBJCE_P(readobj);
1703 			if (ce->__tostring &&
1704 				(zend_call_method_with_0_params(readobj, ce, &ce->__tostring, "__tostring", &retval) || EG(exception))) {
1705 				if (UNEXPECTED(EG(exception) != NULL)) {
1706 					zval *msg, ex, rv;
1707 					zval_ptr_dtor(&retval);
1708 					ZVAL_OBJ(&ex, EG(exception));
1709 					EG(exception) = NULL;
1710 					msg = zend_read_property(Z_OBJCE(ex), &ex, "message", sizeof("message") - 1, 1, &rv);
1711 					if (UNEXPECTED(Z_TYPE_P(msg) != IS_STRING)) {
1712 						ZVAL_EMPTY_STRING(&rv);
1713 						msg = &rv;
1714 					}
1715 					zend_error_noreturn(E_ERROR,
1716 							"Method %s::__toString() must not throw an exception, caught %s: %s",
1717 							ZSTR_VAL(ce->name), ZSTR_VAL(Z_OBJCE(ex)->name), Z_STRVAL_P(msg));
1718 					return FAILURE;
1719 				}
1720 				if (EXPECTED(Z_TYPE(retval) == IS_STRING)) {
1721 					ZVAL_COPY_VALUE(writeobj, &retval);
1722 					return SUCCESS;
1723 				} else {
1724 					zval_ptr_dtor(&retval);
1725 					ZVAL_EMPTY_STRING(writeobj);
1726 					zend_error(E_RECOVERABLE_ERROR, "Method %s::__toString() must return a string value", ZSTR_VAL(ce->name));
1727 					return SUCCESS;
1728 				}
1729 			}
1730 			return FAILURE;
1731 		case _IS_BOOL:
1732 			ZVAL_TRUE(writeobj);
1733 			return SUCCESS;
1734 		case IS_LONG:
1735 			ce = Z_OBJCE_P(readobj);
1736 			zend_error(E_NOTICE, "Object of class %s could not be converted to int", ZSTR_VAL(ce->name));
1737 			ZVAL_LONG(writeobj, 1);
1738 			return SUCCESS;
1739 		case IS_DOUBLE:
1740 			ce = Z_OBJCE_P(readobj);
1741 			zend_error(E_NOTICE, "Object of class %s could not be converted to float", ZSTR_VAL(ce->name));
1742 			ZVAL_DOUBLE(writeobj, 1);
1743 			return SUCCESS;
1744 		case _IS_NUMBER:
1745 			ce = Z_OBJCE_P(readobj);
1746 			zend_error(E_NOTICE, "Object of class %s could not be converted to number", ZSTR_VAL(ce->name));
1747 			ZVAL_LONG(writeobj, 1);
1748 			return SUCCESS;
1749 		default:
1750 			ZVAL_NULL(writeobj);
1751 			break;
1752 	}
1753 	return FAILURE;
1754 }
1755 /* }}} */
1756 
zend_std_get_closure(zval * obj,zend_class_entry ** ce_ptr,zend_function ** fptr_ptr,zend_object ** obj_ptr)1757 ZEND_API int zend_std_get_closure(zval *obj, zend_class_entry **ce_ptr, zend_function **fptr_ptr, zend_object **obj_ptr) /* {{{ */
1758 {
1759 	zval *func;
1760 	zend_class_entry *ce = Z_OBJCE_P(obj);
1761 
1762 	if ((func = zend_hash_find_ex(&ce->function_table, ZSTR_KNOWN(ZEND_STR_MAGIC_INVOKE), 1)) == NULL) {
1763 		return FAILURE;
1764 	}
1765 	*fptr_ptr = Z_FUNC_P(func);
1766 
1767 	*ce_ptr = ce;
1768 	if ((*fptr_ptr)->common.fn_flags & ZEND_ACC_STATIC) {
1769 		if (obj_ptr) {
1770 			*obj_ptr = NULL;
1771 		}
1772 	} else {
1773 		if (obj_ptr) {
1774 			*obj_ptr = Z_OBJ_P(obj);
1775 		}
1776 	}
1777 	return SUCCESS;
1778 }
1779 /* }}} */
1780 
1781 ZEND_API const zend_object_handlers std_object_handlers = {
1782 	0,										/* offset */
1783 
1784 	zend_object_std_dtor,					/* free_obj */
1785 	zend_objects_destroy_object,			/* dtor_obj */
1786 	zend_objects_clone_obj,					/* clone_obj */
1787 
1788 	zend_std_read_property,					/* read_property */
1789 	zend_std_write_property,				/* write_property */
1790 	zend_std_read_dimension,				/* read_dimension */
1791 	zend_std_write_dimension,				/* write_dimension */
1792 	zend_std_get_property_ptr_ptr,			/* get_property_ptr_ptr */
1793 	NULL,									/* get */
1794 	NULL,									/* set */
1795 	zend_std_has_property,					/* has_property */
1796 	zend_std_unset_property,				/* unset_property */
1797 	zend_std_has_dimension,					/* has_dimension */
1798 	zend_std_unset_dimension,				/* unset_dimension */
1799 	zend_std_get_properties,				/* get_properties */
1800 	zend_std_get_method,					/* get_method */
1801 	NULL,									/* call_method */
1802 	zend_std_get_constructor,				/* get_constructor */
1803 	zend_std_get_class_name,				/* get_class_name */
1804 	zend_std_compare_objects,				/* compare_objects */
1805 	zend_std_cast_object_tostring,			/* cast_object */
1806 	NULL,									/* count_elements */
1807 	zend_std_get_debug_info,				/* get_debug_info */
1808 	zend_std_get_closure,					/* get_closure */
1809 	zend_std_get_gc,						/* get_gc */
1810 	NULL,									/* do_operation */
1811 	NULL,									/* compare */
1812 };
1813 
1814 /*
1815  * Local variables:
1816  * tab-width: 4
1817  * c-basic-offset: 4
1818  * indent-tabs-mode: t
1819  * End:
1820  * vim600: sw=4 ts=4 fdm=marker
1821  * vim<600: sw=4 ts=4
1822  */
1823