xref: /PHP-7.4/Zend/zend_execute.c (revision 96bf925c)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine                                                          |
4    +----------------------------------------------------------------------+
5    | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 2.00 of the Zend license,     |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.zend.com/license/2_00.txt.                                |
11    | If you did not receive a copy of the Zend license and are unable to  |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@zend.com so we can mail you a copy immediately.              |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Dmitry Stogov <dmitry@php.net>                              |
18    +----------------------------------------------------------------------+
19 */
20 
21 #define ZEND_INTENSIVE_DEBUGGING 0
22 
23 #include <stdio.h>
24 #include <signal.h>
25 
26 #include "zend.h"
27 #include "zend_compile.h"
28 #include "zend_execute.h"
29 #include "zend_API.h"
30 #include "zend_ptr_stack.h"
31 #include "zend_constants.h"
32 #include "zend_extensions.h"
33 #include "zend_ini.h"
34 #include "zend_exceptions.h"
35 #include "zend_interfaces.h"
36 #include "zend_closures.h"
37 #include "zend_generators.h"
38 #include "zend_vm.h"
39 #include "zend_dtrace.h"
40 #include "zend_inheritance.h"
41 #include "zend_type_info.h"
42 
43 /* Virtual current working directory support */
44 #include "zend_virtual_cwd.h"
45 
46 #ifdef HAVE_GCC_GLOBAL_REGS
47 # if defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(i386)
48 #  define ZEND_VM_FP_GLOBAL_REG "%esi"
49 #  define ZEND_VM_IP_GLOBAL_REG "%edi"
50 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__x86_64__)
51 #  define ZEND_VM_FP_GLOBAL_REG "%r14"
52 #  define ZEND_VM_IP_GLOBAL_REG "%r15"
53 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
54 #  define ZEND_VM_FP_GLOBAL_REG "r14"
55 #  define ZEND_VM_IP_GLOBAL_REG "r15"
56 # elif defined(__IBMC__) && ZEND_GCC_VERSION >= 4002 && defined(__powerpc64__)
57 #  define ZEND_VM_FP_GLOBAL_REG "r14"
58 #  define ZEND_VM_IP_GLOBAL_REG "r15"
59 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
60 #  define ZEND_VM_FP_GLOBAL_REG "x27"
61 #  define ZEND_VM_IP_GLOBAL_REG "x28"
62 # endif
63 #endif
64 
65 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
66 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
67   register zend_execute_data* volatile execute_data __asm__(ZEND_VM_FP_GLOBAL_REG);
68 # pragma GCC diagnostic warning "-Wvolatile-register-var"
69 #endif
70 
71 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
72 # define EXECUTE_DATA_D     void
73 # define EXECUTE_DATA_C
74 # define EXECUTE_DATA_DC
75 # define EXECUTE_DATA_CC
76 # define NO_EXECUTE_DATA_CC
77 #else
78 # define EXECUTE_DATA_D     zend_execute_data* execute_data
79 # define EXECUTE_DATA_C     execute_data
80 # define EXECUTE_DATA_DC    , EXECUTE_DATA_D
81 # define EXECUTE_DATA_CC    , EXECUTE_DATA_C
82 # define NO_EXECUTE_DATA_CC , NULL
83 #endif
84 
85 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
86 # define OPLINE_D           void
87 # define OPLINE_C
88 # define OPLINE_DC
89 # define OPLINE_CC
90 #else
91 # define OPLINE_D           const zend_op* opline
92 # define OPLINE_C           opline
93 # define OPLINE_DC          , OPLINE_D
94 # define OPLINE_CC          , OPLINE_C
95 #endif
96 
97 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
98 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
99   register const zend_op* volatile opline __asm__(ZEND_VM_IP_GLOBAL_REG);
100 # pragma GCC diagnostic warning "-Wvolatile-register-var"
101 #else
102 #endif
103 
104 #define _CONST_CODE  0
105 #define _TMP_CODE    1
106 #define _VAR_CODE    2
107 #define _UNUSED_CODE 3
108 #define _CV_CODE     4
109 
110 typedef int (ZEND_FASTCALL *incdec_t)(zval *);
111 
112 #define get_zval_ptr(op_type, node, should_free, type) _get_zval_ptr(op_type, node, should_free, type EXECUTE_DATA_CC OPLINE_CC)
113 #define get_zval_ptr_deref(op_type, node, should_free, type) _get_zval_ptr_deref(op_type, node, should_free, type EXECUTE_DATA_CC OPLINE_CC)
114 #define get_zval_ptr_undef(op_type, node, should_free, type) _get_zval_ptr_undef(op_type, node, should_free, type EXECUTE_DATA_CC OPLINE_CC)
115 #define get_op_data_zval_ptr_r(op_type, node, should_free) _get_op_data_zval_ptr_r(op_type, node, should_free EXECUTE_DATA_CC OPLINE_CC)
116 #define get_op_data_zval_ptr_deref_r(op_type, node, should_free) _get_op_data_zval_ptr_deref_r(op_type, node, should_free EXECUTE_DATA_CC OPLINE_CC)
117 #define get_zval_ptr_ptr(op_type, node, should_free, type) _get_zval_ptr_ptr(op_type, node, should_free, type EXECUTE_DATA_CC)
118 #define get_zval_ptr_ptr_undef(op_type, node, should_free, type) _get_zval_ptr_ptr(op_type, node, should_free, type EXECUTE_DATA_CC)
119 #define get_obj_zval_ptr(op_type, node, should_free, type) _get_obj_zval_ptr(op_type, node, should_free, type EXECUTE_DATA_CC OPLINE_CC)
120 #define get_obj_zval_ptr_undef(op_type, node, should_free, type) _get_obj_zval_ptr_undef(op_type, node, should_free, type EXECUTE_DATA_CC OPLINE_CC)
121 #define get_obj_zval_ptr_ptr(op_type, node, should_free, type) _get_obj_zval_ptr_ptr(op_type, node, should_free, type EXECUTE_DATA_CC)
122 
123 #define RETURN_VALUE_USED(opline) ((opline)->result_type != IS_UNUSED)
124 
ZEND_FUNCTION(pass)125 static ZEND_FUNCTION(pass)
126 {
127 }
128 
129 ZEND_API const zend_internal_function zend_pass_function = {
130 	ZEND_INTERNAL_FUNCTION, /* type              */
131 	{0, 0, 0},              /* arg_flags         */
132 	0,                      /* fn_flags          */
133 	NULL,                   /* name              */
134 	NULL,                   /* scope             */
135 	NULL,                   /* prototype         */
136 	0,                      /* num_args          */
137 	0,                      /* required_num_args */
138 	NULL,                   /* arg_info          */
139 	ZEND_FN(pass),          /* handler           */
140 	NULL,                   /* module            */
141 	{NULL,NULL,NULL,NULL}   /* reserved          */
142 };
143 
144 #define FREE_VAR_PTR_AND_EXTRACT_RESULT_IF_NECESSARY(free_op, result) do {	\
145 	zval *__container_to_free = (free_op);									\
146 	if (UNEXPECTED(__container_to_free)										\
147 	 && EXPECTED(Z_REFCOUNTED_P(__container_to_free))) {					\
148 		zend_refcounted *__ref = Z_COUNTED_P(__container_to_free);			\
149 		if (UNEXPECTED(!GC_DELREF(__ref))) {								\
150 			zval *__zv = (result);											\
151 			if (EXPECTED(Z_TYPE_P(__zv) == IS_INDIRECT)) {					\
152 				ZVAL_COPY(__zv, Z_INDIRECT_P(__zv));						\
153 			}																\
154 			rc_dtor_func(__ref);											\
155 		}																	\
156 	}																		\
157 } while (0)
158 
159 #define FREE_OP(should_free) \
160 	if (should_free) { \
161 		zval_ptr_dtor_nogc(should_free); \
162 	}
163 
164 #define FREE_UNFETCHED_OP(type, var) \
165 	if ((type) & (IS_TMP_VAR|IS_VAR)) { \
166 		zval_ptr_dtor_nogc(EX_VAR(var)); \
167 	}
168 
169 #define FREE_OP_VAR_PTR(should_free) \
170 	if (should_free) { \
171 		zval_ptr_dtor_nogc(should_free); \
172 	}
173 
174 #define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
175 
176 #define ZEND_VM_STACK_PAGE_SLOTS (16 * 1024) /* should be a power of 2 */
177 
178 #define ZEND_VM_STACK_PAGE_SIZE  (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))
179 
180 #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
181 	(((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
182 	  + ((page_size) - 1)) & ~((page_size) - 1))
183 
zend_vm_stack_new_page(size_t size,zend_vm_stack prev)184 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
185 	zend_vm_stack page = (zend_vm_stack)emalloc(size);
186 
187 	page->top = ZEND_VM_STACK_ELEMENTS(page);
188 	page->end = (zval*)((char*)page + size);
189 	page->prev = prev;
190 	return page;
191 }
192 
zend_vm_stack_init(void)193 ZEND_API void zend_vm_stack_init(void)
194 {
195 	EG(vm_stack_page_size) = ZEND_VM_STACK_PAGE_SIZE;
196 	EG(vm_stack) = zend_vm_stack_new_page(ZEND_VM_STACK_PAGE_SIZE, NULL);
197 	EG(vm_stack_top) = EG(vm_stack)->top;
198 	EG(vm_stack_end) = EG(vm_stack)->end;
199 }
200 
zend_vm_stack_init_ex(size_t page_size)201 ZEND_API void zend_vm_stack_init_ex(size_t page_size)
202 {
203 	/* page_size must be a power of 2 */
204 	ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
205 	EG(vm_stack_page_size) = page_size;
206 	EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
207 	EG(vm_stack_top) = EG(vm_stack)->top;
208 	EG(vm_stack_end) = EG(vm_stack)->end;
209 }
210 
zend_vm_stack_destroy(void)211 ZEND_API void zend_vm_stack_destroy(void)
212 {
213 	zend_vm_stack stack = EG(vm_stack);
214 
215 	while (stack != NULL) {
216 		zend_vm_stack p = stack->prev;
217 		efree(stack);
218 		stack = p;
219 	}
220 }
221 
zend_vm_stack_extend(size_t size)222 ZEND_API void* zend_vm_stack_extend(size_t size)
223 {
224 	zend_vm_stack stack;
225 	void *ptr;
226 
227 	stack = EG(vm_stack);
228 	stack->top = EG(vm_stack_top);
229 	EG(vm_stack) = stack = zend_vm_stack_new_page(
230 		EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
231 			EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
232 		stack);
233 	ptr = stack->top;
234 	EG(vm_stack_top) = (void*)(((char*)ptr) + size);
235 	EG(vm_stack_end) = stack->end;
236 	return ptr;
237 }
238 
zend_get_compiled_variable_value(const zend_execute_data * execute_data,uint32_t var)239 ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, uint32_t var)
240 {
241 	return EX_VAR(var);
242 }
243 
_get_zval_ptr_tmp(uint32_t var,zend_free_op * should_free EXECUTE_DATA_DC)244 static zend_always_inline zval *_get_zval_ptr_tmp(uint32_t var, zend_free_op *should_free EXECUTE_DATA_DC)
245 {
246 	zval *ret = EX_VAR(var);
247 	*should_free = ret;
248 
249 	ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
250 
251 	return ret;
252 }
253 
_get_zval_ptr_var(uint32_t var,zend_free_op * should_free EXECUTE_DATA_DC)254 static zend_always_inline zval *_get_zval_ptr_var(uint32_t var, zend_free_op *should_free EXECUTE_DATA_DC)
255 {
256 	zval *ret = EX_VAR(var);
257 
258 	*should_free = ret;
259 	return ret;
260 }
261 
_get_zval_ptr_var_deref(uint32_t var,zend_free_op * should_free EXECUTE_DATA_DC)262 static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var, zend_free_op *should_free EXECUTE_DATA_DC)
263 {
264 	zval *ret = EX_VAR(var);
265 
266 	*should_free = ret;
267 	ZVAL_DEREF(ret);
268 	return ret;
269 }
270 
zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)271 static zend_never_inline ZEND_COLD zval* zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)
272 {
273 	if (EXPECTED(EG(exception) == NULL)) {
274 		zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
275 		zend_error(E_NOTICE, "Undefined variable: %s", ZSTR_VAL(cv));
276 	}
277 	return &EG(uninitialized_zval);
278 }
279 
_zval_undefined_op1(EXECUTE_DATA_D)280 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op1(EXECUTE_DATA_D)
281 {
282 	return zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
283 }
284 
_zval_undefined_op2(EXECUTE_DATA_D)285 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op2(EXECUTE_DATA_D)
286 {
287 	return zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
288 }
289 
290 #define ZVAL_UNDEFINED_OP1() _zval_undefined_op1(EXECUTE_DATA_C)
291 #define ZVAL_UNDEFINED_OP2() _zval_undefined_op2(EXECUTE_DATA_C)
292 
_get_zval_cv_lookup(zval * ptr,uint32_t var,int type EXECUTE_DATA_DC)293 static zend_never_inline ZEND_COLD zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type EXECUTE_DATA_DC)
294 {
295 	switch (type) {
296 		case BP_VAR_R:
297 		case BP_VAR_UNSET:
298 			ptr = zval_undefined_cv(var EXECUTE_DATA_CC);
299 			break;
300 		case BP_VAR_IS:
301 			ptr = &EG(uninitialized_zval);
302 			break;
303 		case BP_VAR_RW:
304 			zval_undefined_cv(var EXECUTE_DATA_CC);
305 			/* break missing intentionally */
306 		case BP_VAR_W:
307 			ZVAL_NULL(ptr);
308 			break;
309 	}
310 	return ptr;
311 }
312 
_get_zval_ptr_cv(uint32_t var,int type EXECUTE_DATA_DC)313 static zend_always_inline zval *_get_zval_ptr_cv(uint32_t var, int type EXECUTE_DATA_DC)
314 {
315 	zval *ret = EX_VAR(var);
316 
317 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
318 		if (type == BP_VAR_W) {
319 			ZVAL_NULL(ret);
320 		} else {
321 			return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
322 		}
323 	}
324 	return ret;
325 }
326 
_get_zval_ptr_cv_deref(uint32_t var,int type EXECUTE_DATA_DC)327 static zend_always_inline zval *_get_zval_ptr_cv_deref(uint32_t var, int type EXECUTE_DATA_DC)
328 {
329 	zval *ret = EX_VAR(var);
330 
331 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
332 		if (type == BP_VAR_W) {
333 			ZVAL_NULL(ret);
334 			return ret;
335 		} else {
336 			return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
337 		}
338 	}
339 	ZVAL_DEREF(ret);
340 	return ret;
341 }
342 
_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)343 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
344 {
345 	zval *ret = EX_VAR(var);
346 
347 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
348 		return zval_undefined_cv(var EXECUTE_DATA_CC);
349 	}
350 	return ret;
351 }
352 
_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)353 static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
354 {
355 	zval *ret = EX_VAR(var);
356 
357 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
358 		return zval_undefined_cv(var EXECUTE_DATA_CC);
359 	}
360 	ZVAL_DEREF(ret);
361 	return ret;
362 }
363 
_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)364 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)
365 {
366 	zval *ret = EX_VAR(var);
367 
368 	return ret;
369 }
370 
_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)371 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)
372 {
373 	zval *ret = EX_VAR(var);
374 
375 	if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
376 		ZVAL_NULL(ret);
377 		zval_undefined_cv(var EXECUTE_DATA_CC);
378 		return ret;
379 	}
380 	return ret;
381 }
382 
_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)383 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)
384 {
385 	zval *ret = EX_VAR(var);
386 
387 	if (Z_TYPE_P(ret) == IS_UNDEF) {
388 		ZVAL_NULL(ret);
389 	}
390 	return ret;
391 }
392 
_get_zval_ptr(int op_type,znode_op node,zend_free_op * should_free,int type EXECUTE_DATA_DC OPLINE_DC)393 static zend_always_inline zval *_get_zval_ptr(int op_type, znode_op node, zend_free_op *should_free, int type EXECUTE_DATA_DC OPLINE_DC)
394 {
395 	if (op_type & (IS_TMP_VAR|IS_VAR)) {
396 		if (!ZEND_DEBUG || op_type == IS_VAR) {
397 			return _get_zval_ptr_var(node.var, should_free EXECUTE_DATA_CC);
398 		} else {
399 			ZEND_ASSERT(op_type == IS_TMP_VAR);
400 			return _get_zval_ptr_tmp(node.var, should_free EXECUTE_DATA_CC);
401 		}
402 	} else {
403 		*should_free = NULL;
404 		if (op_type == IS_CONST) {
405 			return RT_CONSTANT(opline, node);
406 		} else if (op_type == IS_CV) {
407 			return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
408 		} else {
409 			return NULL;
410 		}
411 	}
412 }
413 
_get_op_data_zval_ptr_r(int op_type,znode_op node,zend_free_op * should_free EXECUTE_DATA_DC OPLINE_DC)414 static zend_always_inline zval *_get_op_data_zval_ptr_r(int op_type, znode_op node, zend_free_op *should_free EXECUTE_DATA_DC OPLINE_DC)
415 {
416 	if (op_type & (IS_TMP_VAR|IS_VAR)) {
417 		if (!ZEND_DEBUG || op_type == IS_VAR) {
418 			return _get_zval_ptr_var(node.var, should_free EXECUTE_DATA_CC);
419 		} else {
420 			ZEND_ASSERT(op_type == IS_TMP_VAR);
421 			return _get_zval_ptr_tmp(node.var, should_free EXECUTE_DATA_CC);
422 		}
423 	} else {
424 		*should_free = NULL;
425 		if (op_type == IS_CONST) {
426 			return RT_CONSTANT(opline + 1, node);
427 		} else if (op_type == IS_CV) {
428 			return _get_zval_ptr_cv_BP_VAR_R(node.var EXECUTE_DATA_CC);
429 		} else {
430 			return NULL;
431 		}
432 	}
433 }
434 
_get_zval_ptr_deref(int op_type,znode_op node,zend_free_op * should_free,int type EXECUTE_DATA_DC OPLINE_DC)435 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_zval_ptr_deref(int op_type, znode_op node, zend_free_op *should_free, int type EXECUTE_DATA_DC OPLINE_DC)
436 {
437 	if (op_type & (IS_TMP_VAR|IS_VAR)) {
438 		if (op_type == IS_TMP_VAR) {
439 			return _get_zval_ptr_tmp(node.var, should_free EXECUTE_DATA_CC);
440 		} else {
441 			ZEND_ASSERT(op_type == IS_VAR);
442 			return _get_zval_ptr_var_deref(node.var, should_free EXECUTE_DATA_CC);
443 		}
444 	} else {
445 		*should_free = NULL;
446 		if (op_type == IS_CONST) {
447 			return RT_CONSTANT(opline, node);
448 		} else if (op_type == IS_CV) {
449 			return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
450 		} else {
451 			return NULL;
452 		}
453 	}
454 }
455 
_get_op_data_zval_ptr_deref_r(int op_type,znode_op node,zend_free_op * should_free EXECUTE_DATA_DC OPLINE_DC)456 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_op_data_zval_ptr_deref_r(int op_type, znode_op node, zend_free_op *should_free EXECUTE_DATA_DC OPLINE_DC)
457 {
458 	if (op_type & (IS_TMP_VAR|IS_VAR)) {
459 		if (op_type == IS_TMP_VAR) {
460 			return _get_zval_ptr_tmp(node.var, should_free EXECUTE_DATA_CC);
461 		} else {
462 			ZEND_ASSERT(op_type == IS_VAR);
463 			return _get_zval_ptr_var_deref(node.var, should_free EXECUTE_DATA_CC);
464 		}
465 	} else {
466 		*should_free = NULL;
467 		if (op_type == IS_CONST) {
468 			return RT_CONSTANT(opline + 1, node);
469 		} else if (op_type == IS_CV) {
470 			return _get_zval_ptr_cv_deref_BP_VAR_R(node.var EXECUTE_DATA_CC);
471 		} else {
472 			return NULL;
473 		}
474 	}
475 }
476 
_get_zval_ptr_undef(int op_type,znode_op node,zend_free_op * should_free,int type EXECUTE_DATA_DC OPLINE_DC)477 static zend_always_inline zval *_get_zval_ptr_undef(int op_type, znode_op node, zend_free_op *should_free, int type EXECUTE_DATA_DC OPLINE_DC)
478 {
479 	if (op_type & (IS_TMP_VAR|IS_VAR)) {
480 		if (!ZEND_DEBUG || op_type == IS_VAR) {
481 			return _get_zval_ptr_var(node.var, should_free EXECUTE_DATA_CC);
482 		} else {
483 			ZEND_ASSERT(op_type == IS_TMP_VAR);
484 			return _get_zval_ptr_tmp(node.var, should_free EXECUTE_DATA_CC);
485 		}
486 	} else {
487 		*should_free = NULL;
488 		if (op_type == IS_CONST) {
489 			return RT_CONSTANT(opline, node);
490 		} else if (op_type == IS_CV) {
491 			return EX_VAR(node.var);
492 		} else {
493 			return NULL;
494 		}
495 	}
496 }
497 
_get_zval_ptr_ptr_var(uint32_t var,zend_free_op * should_free EXECUTE_DATA_DC)498 static zend_always_inline zval *_get_zval_ptr_ptr_var(uint32_t var, zend_free_op *should_free EXECUTE_DATA_DC)
499 {
500 	zval *ret = EX_VAR(var);
501 
502 	if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
503 		*should_free = NULL;
504 		ret = Z_INDIRECT_P(ret);
505 	} else {
506 		*should_free = ret;
507 	}
508 	return ret;
509 }
510 
_get_zval_ptr_ptr(int op_type,znode_op node,zend_free_op * should_free,int type EXECUTE_DATA_DC)511 static inline zval *_get_zval_ptr_ptr(int op_type, znode_op node, zend_free_op *should_free, int type EXECUTE_DATA_DC)
512 {
513 	if (op_type == IS_CV) {
514 		*should_free = NULL;
515 		return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
516 	} else /* if (op_type == IS_VAR) */ {
517 		ZEND_ASSERT(op_type == IS_VAR);
518 		return _get_zval_ptr_ptr_var(node.var, should_free EXECUTE_DATA_CC);
519 	}
520 }
521 
_get_obj_zval_ptr(int op_type,znode_op op,zend_free_op * should_free,int type EXECUTE_DATA_DC OPLINE_DC)522 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr(int op_type, znode_op op, zend_free_op *should_free, int type EXECUTE_DATA_DC OPLINE_DC)
523 {
524 	if (op_type == IS_UNUSED) {
525 		*should_free = NULL;
526 		return &EX(This);
527 	}
528 	return get_zval_ptr(op_type, op, should_free, type);
529 }
530 
_get_obj_zval_ptr_undef(int op_type,znode_op op,zend_free_op * should_free,int type EXECUTE_DATA_DC OPLINE_DC)531 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_undef(int op_type, znode_op op, zend_free_op *should_free, int type EXECUTE_DATA_DC OPLINE_DC)
532 {
533 	if (op_type == IS_UNUSED) {
534 		*should_free = NULL;
535 		return &EX(This);
536 	}
537 	return get_zval_ptr_undef(op_type, op, should_free, type);
538 }
539 
_get_obj_zval_ptr_ptr(int op_type,znode_op node,zend_free_op * should_free,int type EXECUTE_DATA_DC)540 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, zend_free_op *should_free, int type EXECUTE_DATA_DC)
541 {
542 	if (op_type == IS_UNUSED) {
543 		*should_free = NULL;
544 		return &EX(This);
545 	}
546 	return get_zval_ptr_ptr(op_type, node, should_free, type);
547 }
548 
zend_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr)549 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
550 {
551 	zend_reference *ref;
552 
553 	if (EXPECTED(!Z_ISREF_P(value_ptr))) {
554 		ZVAL_NEW_REF(value_ptr, value_ptr);
555 	} else if (UNEXPECTED(variable_ptr == value_ptr)) {
556 		return;
557 	}
558 
559 	ref = Z_REF_P(value_ptr);
560 	GC_ADDREF(ref);
561 	if (Z_REFCOUNTED_P(variable_ptr)) {
562 		zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
563 
564 		if (GC_DELREF(garbage) == 0) {
565 			ZVAL_REF(variable_ptr, ref);
566 			rc_dtor_func(garbage);
567 			return;
568 		} else {
569 			gc_check_possible_root(garbage);
570 		}
571 	}
572 	ZVAL_REF(variable_ptr, ref);
573 }
574 
zend_assign_to_typed_property_reference(zend_property_info * prop_info,zval * prop,zval * value_ptr EXECUTE_DATA_DC)575 static zend_never_inline zval* zend_assign_to_typed_property_reference(zend_property_info *prop_info, zval *prop, zval *value_ptr EXECUTE_DATA_DC)
576 {
577 	if (!zend_verify_prop_assignable_by_ref(prop_info, value_ptr, EX_USES_STRICT_TYPES())) {
578 		return &EG(uninitialized_zval);
579 	}
580 	if (Z_ISREF_P(prop)) {
581 		ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(prop), prop_info);
582 	}
583 	zend_assign_to_variable_reference(prop, value_ptr);
584 	ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(prop), prop_info);
585 	return prop;
586 }
587 
zend_wrong_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)588 static zend_never_inline ZEND_COLD zval *zend_wrong_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
589 {
590 	zend_error(E_NOTICE, "Only variables should be assigned by reference");
591 	if (UNEXPECTED(EG(exception) != NULL)) {
592 		return &EG(uninitialized_zval);
593 	}
594 
595 	/* Use IS_TMP_VAR instead of IS_VAR to avoid ISREF check */
596 	Z_TRY_ADDREF_P(value_ptr);
597 	return zend_assign_to_variable(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES());
598 }
599 
zend_format_type(zend_type type,const char ** part1,const char ** part2)600 static void zend_format_type(zend_type type, const char **part1, const char **part2) {
601 	*part1 = ZEND_TYPE_ALLOW_NULL(type) ? "?" : "";
602 	if (ZEND_TYPE_IS_CLASS(type)) {
603 		if (ZEND_TYPE_IS_CE(type)) {
604 			*part2 = ZSTR_VAL(ZEND_TYPE_CE(type)->name);
605 		} else {
606 			*part2 = ZSTR_VAL(ZEND_TYPE_NAME(type));
607 		}
608 	} else {
609 		*part2 = zend_get_type_by_const(ZEND_TYPE_CODE(type));
610 	}
611 }
612 
zend_throw_auto_init_in_prop_error(zend_property_info * prop,const char * type)613 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_prop_error(zend_property_info *prop, const char *type) {
614 	const char *prop_type1, *prop_type2;
615 	zend_format_type(prop->type, &prop_type1, &prop_type2);
616 	zend_type_error(
617 		"Cannot auto-initialize an %s inside property %s::$%s of type %s%s",
618 		type,
619 		ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
620 		prop_type1, prop_type2
621 	);
622 }
623 
zend_throw_auto_init_in_ref_error(zend_property_info * prop,const char * type)624 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_ref_error(zend_property_info *prop, const char *type) {
625 	const char *prop_type1, *prop_type2;
626 	zend_format_type(prop->type, &prop_type1, &prop_type2);
627 	zend_type_error(
628 		"Cannot auto-initialize an %s inside a reference held by property %s::$%s of type %s%s",
629 		type,
630 		ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
631 		prop_type1, prop_type2
632 	);
633 }
634 
zend_throw_access_uninit_prop_by_ref_error(zend_property_info * prop)635 static zend_never_inline ZEND_COLD void zend_throw_access_uninit_prop_by_ref_error(
636 		zend_property_info *prop) {
637 	zend_throw_error(NULL,
638 		"Cannot access uninitialized non-nullable property %s::$%s by reference",
639 		ZSTR_VAL(prop->ce->name),
640 		zend_get_unmangled_property_name(prop->name));
641 }
642 
643 static zend_never_inline zend_bool zend_verify_ref_stdClass_assignable(zend_reference *ref);
644 static zend_never_inline zend_bool zend_verify_ref_array_assignable(zend_reference *ref);
645 
646 /* this should modify object only if it's empty */
make_real_object(zval * object,zval * property OPLINE_DC EXECUTE_DATA_DC)647 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL make_real_object(zval *object, zval *property OPLINE_DC EXECUTE_DATA_DC)
648 {
649 	zend_object *obj;
650 	zval *ref = NULL;
651 	if (Z_ISREF_P(object)) {
652 		ref = object;
653 		object = Z_REFVAL_P(object);
654 	}
655 
656 	if (UNEXPECTED(Z_TYPE_P(object) > IS_FALSE &&
657 			(Z_TYPE_P(object) != IS_STRING || Z_STRLEN_P(object) != 0))) {
658 		if (opline->op1_type != IS_VAR || EXPECTED(!Z_ISERROR_P(object))) {
659 			zend_string *tmp_property_name;
660 			zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
661 
662 			if (opline->opcode == ZEND_PRE_INC_OBJ
663 			 || opline->opcode == ZEND_PRE_DEC_OBJ
664 			 || opline->opcode == ZEND_POST_INC_OBJ
665 			 || opline->opcode == ZEND_POST_DEC_OBJ) {
666 				zend_error(E_WARNING, "Attempt to increment/decrement property '%s' of non-object", ZSTR_VAL(property_name));
667 			} else if (opline->opcode == ZEND_FETCH_OBJ_W
668 					|| opline->opcode == ZEND_FETCH_OBJ_RW
669 					|| opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG
670 					|| opline->opcode == ZEND_ASSIGN_OBJ_REF) {
671 				zend_error(E_WARNING, "Attempt to modify property '%s' of non-object", ZSTR_VAL(property_name));
672 			} else {
673 				zend_error(E_WARNING, "Attempt to assign property '%s' of non-object", ZSTR_VAL(property_name));
674 			}
675 			zend_tmp_string_release(tmp_property_name);
676 		}
677 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
678 			ZVAL_NULL(EX_VAR(opline->result.var));
679 		}
680 		return NULL;
681 	}
682 
683 	if (ref && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(ref))) {
684 		if (UNEXPECTED(!zend_verify_ref_stdClass_assignable(Z_REF_P(ref)))) {
685 			if (RETURN_VALUE_USED(opline)) {
686 				ZVAL_UNDEF(EX_VAR(opline->result.var));
687 			}
688 			return NULL;
689 		}
690 	}
691 
692 	zval_ptr_dtor_nogc(object);
693 	object_init(object);
694 	Z_ADDREF_P(object);
695 	obj = Z_OBJ_P(object);
696 	zend_error(E_WARNING, "Creating default object from empty value");
697 	if (GC_REFCOUNT(obj) == 1) {
698 		/* the enclosing container was deleted, obj is unreferenced */
699 		OBJ_RELEASE(obj);
700 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
701 			ZVAL_NULL(EX_VAR(opline->result.var));
702 		}
703 		return NULL;
704 	}
705 	Z_DELREF_P(object);
706 	return object;
707 }
708 
zend_verify_type_error_common(const zend_function * zf,const zend_arg_info * arg_info,const zend_class_entry * ce,zval * value,const char ** fname,const char ** fsep,const char ** fclass,const char ** need_msg,const char ** need_kind,const char ** need_or_null,const char ** given_msg,const char ** given_kind)709 static ZEND_COLD void zend_verify_type_error_common(
710 		const zend_function *zf, const zend_arg_info *arg_info,
711 		const zend_class_entry *ce, zval *value,
712 		const char **fname, const char **fsep, const char **fclass,
713 		const char **need_msg, const char **need_kind, const char **need_or_null,
714 		const char **given_msg, const char **given_kind)
715 {
716 	zend_bool is_interface = 0;
717 	*fname = ZSTR_VAL(zf->common.function_name);
718 	if (zf->common.scope) {
719 		*fsep =  "::";
720 		*fclass = ZSTR_VAL(zf->common.scope->name);
721 	} else {
722 		*fsep =  "";
723 		*fclass = "";
724 	}
725 
726 	if (ZEND_TYPE_IS_CLASS(arg_info->type)) {
727 		if (ce) {
728 			if (ce->ce_flags & ZEND_ACC_INTERFACE) {
729 				*need_msg = "implement interface ";
730 				is_interface = 1;
731 			} else {
732 				*need_msg = "be an instance of ";
733 			}
734 			*need_kind = ZSTR_VAL(ce->name);
735 		} else {
736 			/* We don't know whether it's a class or interface, assume it's a class */
737 
738 			*need_msg = "be an instance of ";
739 			*need_kind = ZSTR_VAL(ZEND_TYPE_NAME(arg_info->type));
740 		}
741 	} else {
742 		switch (ZEND_TYPE_CODE(arg_info->type)) {
743 			case IS_OBJECT:
744 				*need_msg = "be an ";
745 				*need_kind = "object";
746 				break;
747 			case IS_CALLABLE:
748 				*need_msg = "be callable";
749 				*need_kind = "";
750 				break;
751 			case IS_ITERABLE:
752 				*need_msg = "be iterable";
753 				*need_kind = "";
754 				break;
755 			default:
756 				*need_msg = "be of the type ";
757 				*need_kind = zend_get_type_by_const(ZEND_TYPE_CODE(arg_info->type));
758 				break;
759 		}
760 	}
761 
762 	if (ZEND_TYPE_ALLOW_NULL(arg_info->type)) {
763 		*need_or_null = is_interface ? " or be null" : " or null";
764 	} else {
765 		*need_or_null = "";
766 	}
767 
768 	if (value) {
769 		if (ZEND_TYPE_IS_CLASS(arg_info->type) && Z_TYPE_P(value) == IS_OBJECT) {
770 			*given_msg = "instance of ";
771 			*given_kind = ZSTR_VAL(Z_OBJCE_P(value)->name);
772 		} else {
773 			*given_msg = zend_zval_type_name(value);
774 			*given_kind = "";
775 		}
776 	} else {
777 		*given_msg = "none";
778 		*given_kind = "";
779 	}
780 }
781 
zend_verify_arg_error(const zend_function * zf,const zend_arg_info * arg_info,int arg_num,const zend_class_entry * ce,zval * value)782 static ZEND_COLD void zend_verify_arg_error(
783 		const zend_function *zf, const zend_arg_info *arg_info,
784 		int arg_num, const zend_class_entry *ce, zval *value)
785 {
786 	zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
787 	const char *fname, *fsep, *fclass;
788 	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
789 
790 	if (EG(exception)) {
791 		/* The type verification itself might have already thrown an exception
792 		 * through a promoted warning. */
793 		return;
794 	}
795 
796 	if (value) {
797 		zend_verify_type_error_common(
798 			zf, arg_info, ce, value,
799 			&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind);
800 
801 		if (zf->common.type == ZEND_USER_FUNCTION) {
802 			if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
803 				zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given, called in %s on line %d",
804 						arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind,
805 						ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno);
806 			} else {
807 				zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
808 			}
809 		} else {
810 			zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
811 		}
812 	} else {
813 		zend_missing_arg_error(ptr);
814 	}
815 }
816 
is_null_constant(zend_class_entry * scope,zval * default_value)817 static int is_null_constant(zend_class_entry *scope, zval *default_value)
818 {
819 	if (Z_TYPE_P(default_value) == IS_CONSTANT_AST) {
820 		zval constant;
821 
822 		ZVAL_COPY(&constant, default_value);
823 		if (UNEXPECTED(zval_update_constant_ex(&constant, scope) != SUCCESS)) {
824 			return 0;
825 		}
826 		if (Z_TYPE(constant) == IS_NULL) {
827 			return 1;
828 		}
829 		zval_ptr_dtor_nogc(&constant);
830 	}
831 	return 0;
832 }
833 
zend_verify_weak_scalar_type_hint(zend_uchar type_hint,zval * arg)834 static zend_bool zend_verify_weak_scalar_type_hint(zend_uchar type_hint, zval *arg)
835 {
836 	switch (type_hint) {
837 		case _IS_BOOL: {
838 			zend_bool dest;
839 
840 			if (!zend_parse_arg_bool_weak(arg, &dest)) {
841 				return 0;
842 			}
843 			zval_ptr_dtor(arg);
844 			ZVAL_BOOL(arg, dest);
845 			return 1;
846 		}
847 		case IS_LONG: {
848 			zend_long dest;
849 
850 			if (!zend_parse_arg_long_weak(arg, &dest)) {
851 				return 0;
852 			}
853 			zval_ptr_dtor(arg);
854 			ZVAL_LONG(arg, dest);
855 			return 1;
856 		}
857 		case IS_DOUBLE: {
858 			double dest;
859 
860 			if (!zend_parse_arg_double_weak(arg, &dest)) {
861 				return 0;
862 			}
863 			zval_ptr_dtor(arg);
864 			ZVAL_DOUBLE(arg, dest);
865 			return 1;
866 		}
867 		case IS_STRING: {
868 			zend_string *dest;
869 
870 			/* on success "arg" is converted to IS_STRING */
871 			return zend_parse_arg_str_weak(arg, &dest);
872 		}
873 		default:
874 			return 0;
875 	}
876 }
877 
zend_verify_scalar_type_hint(zend_uchar type_hint,zval * arg,zend_bool strict)878 static zend_bool zend_verify_scalar_type_hint(zend_uchar type_hint, zval *arg, zend_bool strict)
879 {
880 	if (UNEXPECTED(strict)) {
881 		/* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
882 		if (type_hint != IS_DOUBLE || Z_TYPE_P(arg) != IS_LONG) {
883 			return 0;
884 		}
885 	} else if (UNEXPECTED(Z_TYPE_P(arg) == IS_NULL)) {
886 		/* NULL may be accepted only by nullable hints (this is already checked) */
887 		return 0;
888 	}
889 	return zend_verify_weak_scalar_type_hint(type_hint, arg);
890 }
891 
zend_verify_property_type_error(zend_property_info * info,zval * property)892 ZEND_COLD zend_never_inline void zend_verify_property_type_error(zend_property_info *info, zval *property)
893 {
894 	const char *prop_type1, *prop_type2;
895 
896 	/* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
897 	if (EG(exception)) {
898 		return;
899 	}
900 
901 	// TODO Switch to a more standard error message?
902 	zend_format_type(info->type, &prop_type1, &prop_type2);
903 	(void) prop_type1;
904 	if (ZEND_TYPE_IS_CLASS(info->type)) {
905 		zend_type_error("Typed property %s::$%s must be an instance of %s%s, %s used",
906 			ZSTR_VAL(info->ce->name),
907 			zend_get_unmangled_property_name(info->name),
908 			prop_type2,
909 			ZEND_TYPE_ALLOW_NULL(info->type) ? " or null" : "",
910 			Z_TYPE_P(property) == IS_OBJECT ? ZSTR_VAL(Z_OBJCE_P(property)->name) : zend_get_type_by_const(Z_TYPE_P(property)));
911 	} else {
912 		zend_type_error("Typed property %s::$%s must be %s%s, %s used",
913 			ZSTR_VAL(info->ce->name),
914 			zend_get_unmangled_property_name(info->name),
915 			prop_type2,
916 			ZEND_TYPE_ALLOW_NULL(info->type) ? " or null" : "",
917 			Z_TYPE_P(property) == IS_OBJECT ? ZSTR_VAL(Z_OBJCE_P(property)->name) : zend_get_type_by_const(Z_TYPE_P(property)));
918 	}
919 }
920 
zend_resolve_class_type(zend_type * type,zend_class_entry * self_ce)921 static zend_bool zend_resolve_class_type(zend_type *type, zend_class_entry *self_ce) {
922 	zend_class_entry *ce;
923 	zend_string *name = ZEND_TYPE_NAME(*type);
924 	if (zend_string_equals_literal_ci(name, "self")) {
925 		/* We need to explicitly check for this here, to avoid updating the type in the trait and
926 		 * later using the wrong "self" when the trait is used in a class. */
927 		if (UNEXPECTED((self_ce->ce_flags & ZEND_ACC_TRAIT) != 0)) {
928 			zend_throw_error(NULL, "Cannot write a%s value to a 'self' typed static property of a trait", ZEND_TYPE_ALLOW_NULL(*type) ? " non-null" : "");
929 			return 0;
930 		}
931 		ce = self_ce;
932 	} else if (zend_string_equals_literal_ci(name, "parent")) {
933 		if (UNEXPECTED(!self_ce->parent)) {
934 			zend_throw_error(NULL, "Cannot access parent:: when current class scope has no parent");
935 			return 0;
936 		}
937 		ce = self_ce->parent;
938 	} else {
939 		ce = zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
940 		if (UNEXPECTED(!ce)) {
941 			return 0;
942 		}
943 	}
944 
945 	zend_string_release(name);
946 	*type = ZEND_TYPE_ENCODE_CE(ce, ZEND_TYPE_ALLOW_NULL(*type));
947 	return 1;
948 }
949 
950 
i_zend_check_property_type(zend_property_info * info,zval * property,zend_bool strict)951 static zend_always_inline zend_bool i_zend_check_property_type(zend_property_info *info, zval *property, zend_bool strict)
952 {
953 	ZEND_ASSERT(!Z_ISREF_P(property));
954 	if (ZEND_TYPE_IS_CLASS(info->type)) {
955 		if (UNEXPECTED(Z_TYPE_P(property) != IS_OBJECT)) {
956 			return Z_TYPE_P(property) == IS_NULL && ZEND_TYPE_ALLOW_NULL(info->type);
957 		}
958 
959 		if (UNEXPECTED(!ZEND_TYPE_IS_CE(info->type)) && UNEXPECTED(!zend_resolve_class_type(&info->type, info->ce))) {
960 			return 0;
961 		}
962 
963 		return instanceof_function(Z_OBJCE_P(property), ZEND_TYPE_CE(info->type));
964 	}
965 
966 	ZEND_ASSERT(ZEND_TYPE_CODE(info->type) != IS_CALLABLE);
967 	if (EXPECTED(ZEND_TYPE_CODE(info->type) == Z_TYPE_P(property))) {
968 		return 1;
969 	} else if (EXPECTED(Z_TYPE_P(property) == IS_NULL)) {
970 		return ZEND_TYPE_ALLOW_NULL(info->type);
971 	} else if (ZEND_TYPE_CODE(info->type) == _IS_BOOL && EXPECTED(Z_TYPE_P(property) == IS_FALSE || Z_TYPE_P(property) == IS_TRUE)) {
972 		return 1;
973 	} else if (ZEND_TYPE_CODE(info->type) == IS_ITERABLE) {
974 		return zend_is_iterable(property);
975 	} else {
976 		return zend_verify_scalar_type_hint(ZEND_TYPE_CODE(info->type), property, strict);
977 	}
978 }
979 
i_zend_verify_property_type(zend_property_info * info,zval * property,zend_bool strict)980 static zend_bool zend_always_inline i_zend_verify_property_type(zend_property_info *info, zval *property, zend_bool strict)
981 {
982 	if (i_zend_check_property_type(info, property, strict)) {
983 		return 1;
984 	}
985 
986 	zend_verify_property_type_error(info, property);
987 	return 0;
988 }
989 
zend_verify_property_type(zend_property_info * info,zval * property,zend_bool strict)990 zend_bool zend_never_inline zend_verify_property_type(zend_property_info *info, zval *property, zend_bool strict) {
991 	return i_zend_verify_property_type(info, property, strict);
992 }
993 
zend_assign_to_typed_prop(zend_property_info * info,zval * property_val,zval * value EXECUTE_DATA_DC)994 static zend_never_inline zval* zend_assign_to_typed_prop(zend_property_info *info, zval *property_val, zval *value EXECUTE_DATA_DC)
995 {
996 	zval tmp;
997 
998 	ZVAL_DEREF(value);
999 	ZVAL_COPY(&tmp, value);
1000 
1001 	if (UNEXPECTED(!i_zend_verify_property_type(info, &tmp, EX_USES_STRICT_TYPES()))) {
1002 		zval_ptr_dtor(&tmp);
1003 		return &EG(uninitialized_zval);
1004 	}
1005 
1006 	return zend_assign_to_variable(property_val, &tmp, IS_TMP_VAR, EX_USES_STRICT_TYPES());
1007 }
1008 
1009 
zend_check_type(zend_type type,zval * arg,zend_class_entry ** ce,void ** cache_slot,zval * default_value,zend_class_entry * scope,zend_bool is_return_type)1010 static zend_always_inline zend_bool zend_check_type(
1011 		zend_type type,
1012 		zval *arg, zend_class_entry **ce, void **cache_slot,
1013 		zval *default_value, zend_class_entry *scope,
1014 		zend_bool is_return_type)
1015 {
1016 	zend_reference *ref = NULL;
1017 
1018 	if (!ZEND_TYPE_IS_SET(type)) {
1019 		return 1;
1020 	}
1021 
1022 	if (UNEXPECTED(Z_ISREF_P(arg))) {
1023 		ref = Z_REF_P(arg);
1024 		arg = Z_REFVAL_P(arg);
1025 	}
1026 
1027 	if (ZEND_TYPE_IS_CLASS(type)) {
1028 		if (EXPECTED(*cache_slot)) {
1029 			*ce = (zend_class_entry *) *cache_slot;
1030 		} else {
1031 			*ce = zend_fetch_class(ZEND_TYPE_NAME(type), (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
1032 			if (UNEXPECTED(!*ce)) {
1033 				return Z_TYPE_P(arg) == IS_NULL && (ZEND_TYPE_ALLOW_NULL(type) || (default_value && is_null_constant(scope, default_value)));
1034 			}
1035 			*cache_slot = (void *) *ce;
1036 		}
1037 		if (EXPECTED(Z_TYPE_P(arg) == IS_OBJECT)) {
1038 			return instanceof_function(Z_OBJCE_P(arg), *ce);
1039 		}
1040 		return Z_TYPE_P(arg) == IS_NULL && (ZEND_TYPE_ALLOW_NULL(type) || (default_value && is_null_constant(scope, default_value)));
1041 	} else if (EXPECTED(ZEND_TYPE_CODE(type) == Z_TYPE_P(arg))) {
1042 		return 1;
1043 	}
1044 
1045 	if (Z_TYPE_P(arg) == IS_NULL && (ZEND_TYPE_ALLOW_NULL(type) || (default_value && is_null_constant(scope, default_value)))) {
1046 		/* Null passed to nullable type */
1047 		return 1;
1048 	}
1049 
1050 	if (ZEND_TYPE_CODE(type) == IS_CALLABLE) {
1051 		return zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL);
1052 	} else if (ZEND_TYPE_CODE(type) == IS_ITERABLE) {
1053 		return zend_is_iterable(arg);
1054 	} else if (ZEND_TYPE_CODE(type) == _IS_BOOL &&
1055 			   EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
1056 		return 1;
1057 	} else if (ref && ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1058 		return 0; /* we cannot have conversions for typed refs */
1059 	} else {
1060 		return zend_verify_scalar_type_hint(ZEND_TYPE_CODE(type), arg,
1061 			is_return_type ? ZEND_RET_USES_STRICT_TYPES() : ZEND_ARG_USES_STRICT_TYPES());
1062 	}
1063 
1064 	/* Special handling for IS_VOID is not necessary (for return types),
1065 	 * because this case is already checked at compile-time. */
1066 }
1067 
zend_verify_arg_type(zend_function * zf,uint32_t arg_num,zval * arg,zval * default_value,void ** cache_slot)1068 static zend_always_inline int zend_verify_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot)
1069 {
1070 	zend_arg_info *cur_arg_info;
1071 	zend_class_entry *ce;
1072 
1073 	if (EXPECTED(arg_num <= zf->common.num_args)) {
1074 		cur_arg_info = &zf->common.arg_info[arg_num-1];
1075 	} else if (UNEXPECTED(zf->common.fn_flags & ZEND_ACC_VARIADIC)) {
1076 		cur_arg_info = &zf->common.arg_info[zf->common.num_args];
1077 	} else {
1078 		return 1;
1079 	}
1080 
1081 	ce = NULL;
1082 	if (UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, &ce, cache_slot, default_value, zf->common.scope, 0))) {
1083 		zend_verify_arg_error(zf, cur_arg_info, arg_num, ce, arg);
1084 		return 0;
1085 	}
1086 
1087 	return 1;
1088 }
1089 
zend_verify_recv_arg_type(zend_function * zf,uint32_t arg_num,zval * arg,zval * default_value,void ** cache_slot)1090 static zend_always_inline int zend_verify_recv_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot)
1091 {
1092 	zend_arg_info *cur_arg_info = &zf->common.arg_info[arg_num-1];
1093 	zend_class_entry *ce;
1094 
1095 	ZEND_ASSERT(arg_num <= zf->common.num_args);
1096 	cur_arg_info = &zf->common.arg_info[arg_num-1];
1097 
1098 	ce = NULL;
1099 	if (UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, &ce, cache_slot, default_value, zf->common.scope, 0))) {
1100 		zend_verify_arg_error(zf, cur_arg_info, arg_num, ce, arg);
1101 		return 0;
1102 	}
1103 
1104 	return 1;
1105 }
1106 
zend_verify_variadic_arg_type(zend_function * zf,uint32_t arg_num,zval * arg,zval * default_value,void ** cache_slot)1107 static zend_always_inline int zend_verify_variadic_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot)
1108 {
1109 	zend_arg_info *cur_arg_info;
1110 	zend_class_entry *ce;
1111 
1112 	ZEND_ASSERT(arg_num > zf->common.num_args);
1113 	ZEND_ASSERT(zf->common.fn_flags & ZEND_ACC_VARIADIC);
1114 	cur_arg_info = &zf->common.arg_info[zf->common.num_args];
1115 
1116 	ce = NULL;
1117 	if (UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, &ce, cache_slot, default_value, zf->common.scope, 0))) {
1118 		zend_verify_arg_error(zf, cur_arg_info, arg_num, ce, arg);
1119 		return 0;
1120 	}
1121 
1122 	return 1;
1123 }
1124 
zend_verify_internal_arg_types(zend_function * fbc,zend_execute_data * call)1125 static zend_never_inline int zend_verify_internal_arg_types(zend_function *fbc, zend_execute_data *call)
1126 {
1127 	uint32_t i;
1128 	uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
1129 	zval *p = ZEND_CALL_ARG(call, 1);
1130 	void *dummy_cache_slot;
1131 
1132 	for (i = 0; i < num_args; ++i) {
1133 		dummy_cache_slot = NULL;
1134 		if (UNEXPECTED(!zend_verify_arg_type(fbc, i + 1, p, NULL, &dummy_cache_slot))) {
1135 			EG(current_execute_data) = call->prev_execute_data;
1136 			return 0;
1137 		}
1138 		p++;
1139 	}
1140 	return 1;
1141 }
1142 
zend_missing_arg_error(zend_execute_data * execute_data)1143 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *execute_data)
1144 {
1145 	zend_execute_data *ptr = EX(prev_execute_data);
1146 
1147 	if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
1148 		zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
1149 			EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1150 			EX(func)->common.scope ? "::" : "",
1151 			ZSTR_VAL(EX(func)->common.function_name),
1152 			EX_NUM_ARGS(),
1153 			ZSTR_VAL(ptr->func->op_array.filename),
1154 			ptr->opline->lineno,
1155 			EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1156 			EX(func)->common.required_num_args);
1157 	} else {
1158 		zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
1159 			EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1160 			EX(func)->common.scope ? "::" : "",
1161 			ZSTR_VAL(EX(func)->common.function_name),
1162 			EX_NUM_ARGS(),
1163 			EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1164 			EX(func)->common.required_num_args);
1165 	}
1166 }
1167 
zend_verify_return_error(const zend_function * zf,const zend_class_entry * ce,zval * value)1168 static ZEND_COLD void zend_verify_return_error(
1169 		const zend_function *zf, const zend_class_entry *ce, zval *value)
1170 {
1171 	const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1172 	const char *fname, *fsep, *fclass;
1173 	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
1174 
1175 	zend_verify_type_error_common(
1176 		zf, arg_info, ce, value,
1177 		&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind);
1178 
1179 	zend_type_error("Return value of %s%s%s() must %s%s%s, %s%s returned",
1180 		fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
1181 }
1182 
1183 #if ZEND_DEBUG
zend_verify_internal_return_error(const zend_function * zf,const zend_class_entry * ce,zval * value)1184 static ZEND_COLD void zend_verify_internal_return_error(
1185 		const zend_function *zf, const zend_class_entry *ce, zval *value)
1186 {
1187 	const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1188 	const char *fname, *fsep, *fclass;
1189 	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
1190 
1191 	zend_verify_type_error_common(
1192 		zf, arg_info, ce, value,
1193 		&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind);
1194 
1195 	zend_error_noreturn(E_CORE_ERROR, "Return value of %s%s%s() must %s%s%s, %s%s returned",
1196 		fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
1197 }
1198 
zend_verify_void_return_error(const zend_function * zf,const char * returned_msg,const char * returned_kind)1199 static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, const char *returned_msg, const char *returned_kind)
1200 {
1201 	const char *fname = ZSTR_VAL(zf->common.function_name);
1202 	const char *fsep;
1203 	const char *fclass;
1204 
1205 	if (zf->common.scope) {
1206 		fsep =  "::";
1207 		fclass = ZSTR_VAL(zf->common.scope->name);
1208 	} else {
1209 		fsep =  "";
1210 		fclass = "";
1211 	}
1212 
1213 	zend_type_error("%s%s%s() must not return a value, %s%s returned",
1214 		fclass, fsep, fname, returned_msg, returned_kind);
1215 }
1216 
zend_verify_internal_return_type(zend_function * zf,zval * ret)1217 static int zend_verify_internal_return_type(zend_function *zf, zval *ret)
1218 {
1219 	zend_internal_arg_info *ret_info = zf->internal_function.arg_info - 1;
1220 	zend_class_entry *ce = NULL;
1221 	void *dummy_cache_slot = NULL;
1222 
1223 	if (ZEND_TYPE_CODE(ret_info->type) == IS_VOID) {
1224 		if (UNEXPECTED(Z_TYPE_P(ret) != IS_NULL)) {
1225 			zend_verify_void_return_error(zf, zend_zval_type_name(ret), "");
1226 			return 0;
1227 		}
1228 		return 1;
1229 	}
1230 
1231 	if (UNEXPECTED(!zend_check_type(ret_info->type, ret, &ce, &dummy_cache_slot, NULL, NULL, 1))) {
1232 		zend_verify_internal_return_error(zf, ce, ret);
1233 		return 0;
1234 	}
1235 
1236 	return 1;
1237 }
1238 #endif
1239 
zend_verify_return_type(zend_function * zf,zval * ret,void ** cache_slot)1240 static zend_always_inline void zend_verify_return_type(zend_function *zf, zval *ret, void **cache_slot)
1241 {
1242 	zend_arg_info *ret_info = zf->common.arg_info - 1;
1243 	zend_class_entry *ce = NULL;
1244 
1245 	if (UNEXPECTED(!zend_check_type(ret_info->type, ret, &ce, cache_slot, NULL, NULL, 1))) {
1246 		zend_verify_return_error(zf, ce, ret);
1247 	}
1248 }
1249 
zend_verify_missing_return_type(const zend_function * zf,void ** cache_slot)1250 static ZEND_COLD int zend_verify_missing_return_type(const zend_function *zf, void **cache_slot)
1251 {
1252 	zend_arg_info *ret_info = zf->common.arg_info - 1;
1253 
1254 	if (ZEND_TYPE_IS_SET(ret_info->type) && UNEXPECTED(ZEND_TYPE_CODE(ret_info->type) != IS_VOID)) {
1255 		zend_class_entry *ce = NULL;
1256 		if (ZEND_TYPE_IS_CLASS(ret_info->type)) {
1257 			if (EXPECTED(*cache_slot)) {
1258 				ce = (zend_class_entry*) *cache_slot;
1259 			} else {
1260 				ce = zend_fetch_class(ZEND_TYPE_NAME(ret_info->type), (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
1261 				if (ce) {
1262 					*cache_slot = (void*)ce;
1263 				}
1264 			}
1265 		}
1266 		zend_verify_return_error(zf, ce, NULL);
1267 		return 0;
1268 	}
1269 	return 1;
1270 }
1271 
zend_use_object_as_array(void)1272 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_object_as_array(void)
1273 {
1274 	zend_throw_error(NULL, "Cannot use object as array");
1275 }
1276 
zend_illegal_offset(void)1277 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_offset(void)
1278 {
1279 	zend_error(E_WARNING, "Illegal offset type");
1280 }
1281 
zend_assign_to_object_dim(zval * object,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1282 static zend_never_inline void zend_assign_to_object_dim(zval *object, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1283 {
1284 	Z_OBJ_HT_P(object)->write_dimension(object, dim, value);
1285 
1286 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1287 		ZVAL_COPY(EX_VAR(opline->result.var), value);
1288 	}
1289 }
1290 
zend_binary_op(zval * ret,zval * op1,zval * op2 OPLINE_DC)1291 static zend_always_inline int zend_binary_op(zval *ret, zval *op1, zval *op2 OPLINE_DC)
1292 {
1293 	static const binary_op_type zend_binary_ops[] = {
1294 		add_function,
1295 		sub_function,
1296 		mul_function,
1297 		div_function,
1298 		mod_function,
1299 		shift_left_function,
1300 		shift_right_function,
1301 		concat_function,
1302 		bitwise_or_function,
1303 		bitwise_and_function,
1304 		bitwise_xor_function,
1305 		pow_function
1306 	};
1307 	/* size_t cast makes GCC to better optimize 64-bit PIC code */
1308 	size_t opcode = (size_t)opline->extended_value;
1309 
1310 	return zend_binary_ops[opcode - ZEND_ADD](ret, op1, op2);
1311 }
1312 
zend_binary_assign_op_obj_dim(zval * object,zval * property OPLINE_DC EXECUTE_DATA_DC)1313 static zend_never_inline void zend_binary_assign_op_obj_dim(zval *object, zval *property OPLINE_DC EXECUTE_DATA_DC)
1314 {
1315 	zend_free_op free_op_data1;
1316 	zval *value;
1317 	zval *z;
1318 	zval rv, res;
1319 
1320 	value = get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1, &free_op_data1);
1321 	if ((z = Z_OBJ_HT_P(object)->read_dimension(object, property, BP_VAR_R, &rv)) != NULL) {
1322 
1323 		if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
1324 			zval rv2;
1325 			zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1326 
1327 			if (z == &rv) {
1328 				zval_ptr_dtor(&rv);
1329 			}
1330 			ZVAL_COPY_VALUE(z, value);
1331 		}
1332 		if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1333 			Z_OBJ_HT_P(object)->write_dimension(object, property, &res);
1334 		}
1335 		if (z == &rv) {
1336 			zval_ptr_dtor(&rv);
1337 		}
1338 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1339 			ZVAL_COPY(EX_VAR(opline->result.var), &res);
1340 		}
1341 		zval_ptr_dtor(&res);
1342 	} else {
1343 		zend_use_object_as_array();
1344 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1345 			ZVAL_NULL(EX_VAR(opline->result.var));
1346 		}
1347 	}
1348 	FREE_OP(free_op_data1);
1349 }
1350 
zend_binary_assign_op_typed_ref(zend_reference * ref,zval * value OPLINE_DC EXECUTE_DATA_DC)1351 static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *ref, zval *value OPLINE_DC EXECUTE_DATA_DC)
1352 {
1353 	zval z_copy;
1354 
1355 	/* Make sure that in-place concatenation is used if the LHS is a string. */
1356 	if (opline->extended_value == ZEND_CONCAT && Z_TYPE(ref->val) == IS_STRING) {
1357 		concat_function(&ref->val, &ref->val, value);
1358 		ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
1359 		return;
1360 	}
1361 
1362 	zend_binary_op(&z_copy, &ref->val, value OPLINE_CC);
1363 	if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, EX_USES_STRICT_TYPES()))) {
1364 		zval_ptr_dtor(&ref->val);
1365 		ZVAL_COPY_VALUE(&ref->val, &z_copy);
1366 	} else {
1367 		zval_ptr_dtor(&z_copy);
1368 	}
1369 }
1370 
zend_binary_assign_op_typed_prop(zend_property_info * prop_info,zval * zptr,zval * value OPLINE_DC EXECUTE_DATA_DC)1371 static zend_never_inline void zend_binary_assign_op_typed_prop(zend_property_info *prop_info, zval *zptr, zval *value OPLINE_DC EXECUTE_DATA_DC)
1372 {
1373 	zval z_copy;
1374 
1375 	/* Make sure that in-place concatenation is used if the LHS is a string. */
1376 	if (opline->extended_value == ZEND_CONCAT && Z_TYPE_P(zptr) == IS_STRING) {
1377 		concat_function(zptr, zptr, value);
1378 		ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
1379 		return;
1380 	}
1381 
1382 	zend_binary_op(&z_copy, zptr, value OPLINE_CC);
1383 	if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
1384 		zval_ptr_dtor(zptr);
1385 		ZVAL_COPY_VALUE(zptr, &z_copy);
1386 	} else {
1387 		zval_ptr_dtor(&z_copy);
1388 	}
1389 }
1390 
zend_check_string_offset(zval * dim,int type EXECUTE_DATA_DC)1391 static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type EXECUTE_DATA_DC)
1392 {
1393 	zend_long offset;
1394 
1395 try_again:
1396 	if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1397 		switch(Z_TYPE_P(dim)) {
1398 			case IS_STRING:
1399 				if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
1400 					break;
1401 				}
1402 				if (type != BP_VAR_UNSET) {
1403 					zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
1404 				}
1405 				break;
1406 			case IS_UNDEF:
1407 				ZVAL_UNDEFINED_OP2();
1408 			case IS_DOUBLE:
1409 			case IS_NULL:
1410 			case IS_FALSE:
1411 			case IS_TRUE:
1412 				zend_error(E_NOTICE, "String offset cast occurred");
1413 				break;
1414 			case IS_REFERENCE:
1415 				dim = Z_REFVAL_P(dim);
1416 				goto try_again;
1417 			default:
1418 				zend_illegal_offset();
1419 				break;
1420 		}
1421 
1422 		offset = zval_get_long_func(dim);
1423 	} else {
1424 		offset = Z_LVAL_P(dim);
1425 	}
1426 
1427 	return offset;
1428 }
1429 
zend_wrong_string_offset(EXECUTE_DATA_D)1430 static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
1431 {
1432 	const char *msg = NULL;
1433 	const zend_op *opline = EX(opline);
1434 	const zend_op *end;
1435 	uint32_t var;
1436 
1437 	if (UNEXPECTED(EG(exception) != NULL)) {
1438 		return;
1439 	}
1440 
1441 	switch (opline->opcode) {
1442 		case ZEND_ASSIGN_OP:
1443 		case ZEND_ASSIGN_DIM_OP:
1444 		case ZEND_ASSIGN_OBJ_OP:
1445 		case ZEND_ASSIGN_STATIC_PROP_OP:
1446 			msg = "Cannot use assign-op operators with string offsets";
1447 			break;
1448 		case ZEND_FETCH_DIM_W:
1449 		case ZEND_FETCH_DIM_RW:
1450 		case ZEND_FETCH_DIM_FUNC_ARG:
1451 		case ZEND_FETCH_DIM_UNSET:
1452 		case ZEND_FETCH_LIST_W:
1453 			/* TODO: Encode the "reason" into opline->extended_value??? */
1454 			var = opline->result.var;
1455 			opline++;
1456 			end = EG(current_execute_data)->func->op_array.opcodes +
1457 				EG(current_execute_data)->func->op_array.last;
1458 			while (opline < end) {
1459 				if (opline->op1_type == IS_VAR && opline->op1.var == var) {
1460 					switch (opline->opcode) {
1461 						case ZEND_FETCH_OBJ_W:
1462 						case ZEND_FETCH_OBJ_RW:
1463 						case ZEND_FETCH_OBJ_FUNC_ARG:
1464 						case ZEND_FETCH_OBJ_UNSET:
1465 						case ZEND_ASSIGN_OBJ:
1466 						case ZEND_ASSIGN_OBJ_OP:
1467 						case ZEND_ASSIGN_OBJ_REF:
1468 							msg = "Cannot use string offset as an object";
1469 							break;
1470 						case ZEND_FETCH_DIM_W:
1471 						case ZEND_FETCH_DIM_RW:
1472 						case ZEND_FETCH_DIM_FUNC_ARG:
1473 						case ZEND_FETCH_DIM_UNSET:
1474 						case ZEND_FETCH_LIST_W:
1475 						case ZEND_ASSIGN_DIM:
1476 						case ZEND_ASSIGN_DIM_OP:
1477 							msg = "Cannot use string offset as an array";
1478 							break;
1479 						case ZEND_ASSIGN_STATIC_PROP_OP:
1480 						case ZEND_ASSIGN_OP:
1481 							msg = "Cannot use assign-op operators with string offsets";
1482 							break;
1483 						case ZEND_PRE_INC_OBJ:
1484 						case ZEND_PRE_DEC_OBJ:
1485 						case ZEND_POST_INC_OBJ:
1486 						case ZEND_POST_DEC_OBJ:
1487 						case ZEND_PRE_INC:
1488 						case ZEND_PRE_DEC:
1489 						case ZEND_POST_INC:
1490 						case ZEND_POST_DEC:
1491 							msg = "Cannot increment/decrement string offsets";
1492 							break;
1493 						case ZEND_ASSIGN_REF:
1494 						case ZEND_ADD_ARRAY_ELEMENT:
1495 						case ZEND_INIT_ARRAY:
1496 						case ZEND_MAKE_REF:
1497 							msg = "Cannot create references to/from string offsets";
1498 							break;
1499 						case ZEND_RETURN_BY_REF:
1500 						case ZEND_VERIFY_RETURN_TYPE:
1501 							msg = "Cannot return string offsets by reference";
1502 							break;
1503 						case ZEND_UNSET_DIM:
1504 						case ZEND_UNSET_OBJ:
1505 							msg = "Cannot unset string offsets";
1506 							break;
1507 						case ZEND_YIELD:
1508 							msg = "Cannot yield string offsets by reference";
1509 							break;
1510 						case ZEND_SEND_REF:
1511 						case ZEND_SEND_VAR_EX:
1512 						case ZEND_SEND_FUNC_ARG:
1513 							msg = "Only variables can be passed by reference";
1514 							break;
1515 						case ZEND_FE_RESET_RW:
1516 							msg = "Cannot iterate on string offsets by reference";
1517 							break;
1518 						EMPTY_SWITCH_DEFAULT_CASE();
1519 					}
1520 					break;
1521 				}
1522 				if (opline->op2_type == IS_VAR && opline->op2.var == var) {
1523 					ZEND_ASSERT(opline->opcode == ZEND_ASSIGN_REF);
1524 					msg = "Cannot create references to/from string offsets";
1525 					break;
1526 				}
1527 				opline++;
1528 			}
1529 			break;
1530 		EMPTY_SWITCH_DEFAULT_CASE();
1531 	}
1532 	ZEND_ASSERT(msg != NULL);
1533 	zend_throw_error(NULL, "%s", msg);
1534 }
1535 
zend_wrong_property_read(zval * property)1536 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_read(zval *property)
1537 {
1538 	zend_string *tmp_property_name;
1539 	zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
1540 	zend_error(E_NOTICE, "Trying to get property '%s' of non-object", ZSTR_VAL(property_name));
1541 	zend_tmp_string_release(tmp_property_name);
1542 }
1543 
zend_deprecated_function(const zend_function * fbc)1544 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_deprecated_function(const zend_function *fbc)
1545 {
1546 	zend_error(E_DEPRECATED, "Function %s%s%s() is deprecated",
1547 		fbc->common.scope ? ZSTR_VAL(fbc->common.scope->name) : "",
1548 		fbc->common.scope ? "::" : "",
1549 		ZSTR_VAL(fbc->common.function_name));
1550 }
1551 
zend_abstract_method(const zend_function * fbc)1552 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_abstract_method(const zend_function *fbc)
1553 {
1554 	zend_throw_error(NULL, "Cannot call abstract method %s::%s()",
1555 		ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
1556 }
1557 
zend_assign_to_string_offset(zval * str,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1558 static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1559 {
1560 	zend_uchar c;
1561 	size_t string_len;
1562 	zend_long offset;
1563 
1564 	offset = zend_check_string_offset(dim, BP_VAR_W EXECUTE_DATA_CC);
1565 	if (UNEXPECTED(EG(exception) != NULL)) {
1566 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1567 			ZVAL_UNDEF(EX_VAR(opline->result.var));
1568 		}
1569 		return;
1570 	}
1571 	if (offset < -(zend_long)Z_STRLEN_P(str)) {
1572 		/* Error on negative offset */
1573 		zend_error(E_WARNING, "Illegal string offset:  " ZEND_LONG_FMT, offset);
1574 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1575 			ZVAL_NULL(EX_VAR(opline->result.var));
1576 		}
1577 		return;
1578 	}
1579 
1580 	if (Z_TYPE_P(value) != IS_STRING) {
1581 		/* Convert to string, just the time to pick the 1st byte */
1582 		zend_string *tmp = zval_try_get_string_func(value);
1583 		if (UNEXPECTED(!tmp)) {
1584 			if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1585 				ZVAL_UNDEF(EX_VAR(opline->result.var));
1586 			}
1587 			return;
1588 		}
1589 
1590 		string_len = ZSTR_LEN(tmp);
1591 		c = (zend_uchar)ZSTR_VAL(tmp)[0];
1592 		zend_string_release_ex(tmp, 0);
1593 	} else {
1594 		string_len = Z_STRLEN_P(value);
1595 		c = (zend_uchar)Z_STRVAL_P(value)[0];
1596 	}
1597 
1598 	if (string_len == 0) {
1599 		/* Error on empty input string */
1600 		zend_error(E_WARNING, "Cannot assign an empty string to a string offset");
1601 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1602 			ZVAL_NULL(EX_VAR(opline->result.var));
1603 		}
1604 		return;
1605 	}
1606 
1607 	if (offset < 0) { /* Handle negative offset */
1608 		offset += (zend_long)Z_STRLEN_P(str);
1609 	}
1610 
1611 	if ((size_t)offset >= Z_STRLEN_P(str)) {
1612 		/* Extend string if needed */
1613 		zend_long old_len = Z_STRLEN_P(str);
1614 		ZVAL_NEW_STR(str, zend_string_extend(Z_STR_P(str), offset + 1, 0));
1615 		memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
1616 		Z_STRVAL_P(str)[offset+1] = 0;
1617 	} else if (!Z_REFCOUNTED_P(str)) {
1618 		ZVAL_NEW_STR(str, zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0));
1619 	} else if (Z_REFCOUNT_P(str) > 1) {
1620 		Z_DELREF_P(str);
1621 		ZVAL_NEW_STR(str, zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0));
1622 	} else {
1623 		zend_string_forget_hash_val(Z_STR_P(str));
1624 	}
1625 
1626 	Z_STRVAL_P(str)[offset] = c;
1627 
1628 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1629 		/* Return the new character */
1630 		ZVAL_INTERNED_STR(EX_VAR(opline->result.var), ZSTR_CHAR(c));
1631 	}
1632 }
1633 
zend_get_prop_not_accepting_double(zend_reference * ref)1634 static zend_property_info *zend_get_prop_not_accepting_double(zend_reference *ref)
1635 {
1636 	zend_property_info *prop;
1637 	ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
1638 		if (ZEND_TYPE_CODE(prop->type) != IS_DOUBLE) {
1639 			return prop;
1640 		}
1641 	} ZEND_REF_FOREACH_TYPE_SOURCES_END();
1642 	return NULL;
1643 }
1644 
zend_throw_incdec_ref_error(zend_reference * ref OPLINE_DC)1645 static ZEND_COLD zend_long zend_throw_incdec_ref_error(zend_reference *ref OPLINE_DC)
1646 {
1647 	zend_property_info *error_prop = zend_get_prop_not_accepting_double(ref);
1648 	/* Currently there should be no way for a typed reference to accept both int and double.
1649 	 * Generalize this and the related property code once this becomes possible. */
1650 	ZEND_ASSERT(error_prop);
1651 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1652 		zend_type_error(
1653 			"Cannot increment a reference held by property %s::$%s of type %sint past its maximal value",
1654 			ZSTR_VAL(error_prop->ce->name),
1655 			zend_get_unmangled_property_name(error_prop->name),
1656 			ZEND_TYPE_ALLOW_NULL(error_prop->type) ? "?" : "");
1657 		return ZEND_LONG_MAX;
1658 	} else {
1659 		zend_type_error(
1660 			"Cannot decrement a reference held by property %s::$%s of type %sint past its minimal value",
1661 			ZSTR_VAL(error_prop->ce->name),
1662 			zend_get_unmangled_property_name(error_prop->name),
1663 			ZEND_TYPE_ALLOW_NULL(error_prop->type) ? "?" : "");
1664 		return ZEND_LONG_MIN;
1665 	}
1666 }
1667 
zend_throw_incdec_prop_error(zend_property_info * prop OPLINE_DC)1668 static ZEND_COLD zend_long zend_throw_incdec_prop_error(zend_property_info *prop OPLINE_DC) {
1669 	const char *prop_type1, *prop_type2;
1670 	zend_format_type(prop->type, &prop_type1, &prop_type2);
1671 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1672 		zend_type_error("Cannot increment property %s::$%s of type %s%s past its maximal value",
1673 			ZSTR_VAL(prop->ce->name),
1674 			zend_get_unmangled_property_name(prop->name),
1675 			prop_type1, prop_type2);
1676 		return ZEND_LONG_MAX;
1677 	} else {
1678 		zend_type_error("Cannot decrement property %s::$%s of type %s%s past its minimal value",
1679 			ZSTR_VAL(prop->ce->name),
1680 			zend_get_unmangled_property_name(prop->name),
1681 			prop_type1, prop_type2);
1682 		return ZEND_LONG_MIN;
1683 	}
1684 }
1685 
zend_incdec_typed_ref(zend_reference * ref,zval * copy OPLINE_DC EXECUTE_DATA_DC)1686 static void zend_incdec_typed_ref(zend_reference *ref, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1687 {
1688 	zval tmp;
1689 	zval *var_ptr = &ref->val;
1690 
1691 	if (!copy) {
1692 		copy = &tmp;
1693 	}
1694 
1695 	ZVAL_COPY(copy, var_ptr);
1696 
1697 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1698 		increment_function(var_ptr);
1699 	} else {
1700 		decrement_function(var_ptr);
1701 	}
1702 
1703 	if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1704 		zend_long val = zend_throw_incdec_ref_error(ref OPLINE_CC);
1705 		ZVAL_LONG(var_ptr, val);
1706 	} else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, EX_USES_STRICT_TYPES()))) {
1707 		zval_ptr_dtor(var_ptr);
1708 		ZVAL_COPY_VALUE(var_ptr, copy);
1709 		ZVAL_UNDEF(copy);
1710 	} else if (copy == &tmp) {
1711 		zval_ptr_dtor(&tmp);
1712 	}
1713 }
1714 
zend_incdec_typed_prop(zend_property_info * prop_info,zval * var_ptr,zval * copy OPLINE_DC EXECUTE_DATA_DC)1715 static void zend_incdec_typed_prop(zend_property_info *prop_info, zval *var_ptr, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1716 {
1717 	zval tmp;
1718 
1719 	if (!copy) {
1720 		copy = &tmp;
1721 	}
1722 
1723 	ZVAL_COPY(copy, var_ptr);
1724 
1725 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1726 		increment_function(var_ptr);
1727 	} else {
1728 		decrement_function(var_ptr);
1729 	}
1730 
1731 	if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1732 		zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1733 		ZVAL_LONG(var_ptr, val);
1734 	} else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
1735 		zval_ptr_dtor(var_ptr);
1736 		ZVAL_COPY_VALUE(var_ptr, copy);
1737 		ZVAL_UNDEF(copy);
1738 	} else if (copy == &tmp) {
1739 		zval_ptr_dtor(&tmp);
1740 	}
1741 }
1742 
zend_pre_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)1743 static void zend_pre_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
1744 {
1745 	if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
1746 		if (ZEND_IS_INCREMENT(opline->opcode)) {
1747 			fast_long_increment_function(prop);
1748 		} else {
1749 			fast_long_decrement_function(prop);
1750 		}
1751 		if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)) {
1752 			zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1753 			ZVAL_LONG(prop, val);
1754 		}
1755 	} else {
1756 		do {
1757 			if (Z_ISREF_P(prop)) {
1758 				zend_reference *ref = Z_REF_P(prop);
1759 				prop = Z_REFVAL_P(prop);
1760 				if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
1761 					zend_incdec_typed_ref(ref, NULL OPLINE_CC EXECUTE_DATA_CC);
1762 					break;
1763 				}
1764 			}
1765 
1766 			if (UNEXPECTED(prop_info)) {
1767 				zend_incdec_typed_prop(prop_info, prop, NULL OPLINE_CC EXECUTE_DATA_CC);
1768 			} else if (ZEND_IS_INCREMENT(opline->opcode)) {
1769 				increment_function(prop);
1770 			} else {
1771 				decrement_function(prop);
1772 			}
1773 		} while (0);
1774 	}
1775 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1776 		ZVAL_COPY(EX_VAR(opline->result.var), prop);
1777 	}
1778 }
1779 
zend_post_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)1780 static void zend_post_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
1781 {
1782 	if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
1783 		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(prop));
1784 		if (ZEND_IS_INCREMENT(opline->opcode)) {
1785 			fast_long_increment_function(prop);
1786 		} else {
1787 			fast_long_decrement_function(prop);
1788 		}
1789 		if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)) {
1790 			zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1791 			ZVAL_LONG(prop, val);
1792 		}
1793 	} else {
1794 		if (Z_ISREF_P(prop)) {
1795 			zend_reference *ref = Z_REF_P(prop);
1796 			prop = Z_REFVAL_P(prop);
1797 			if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1798 				zend_incdec_typed_ref(ref, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
1799 				return;
1800 			}
1801 		}
1802 
1803 		if (UNEXPECTED(prop_info)) {
1804 			zend_incdec_typed_prop(prop_info, prop, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
1805 		} else {
1806 			ZVAL_COPY(EX_VAR(opline->result.var), prop);
1807 			if (ZEND_IS_INCREMENT(opline->opcode)) {
1808 				increment_function(prop);
1809 			} else {
1810 				decrement_function(prop);
1811 			}
1812 		}
1813 	}
1814 }
1815 
zend_post_incdec_overloaded_property(zval * object,zval * property,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)1816 static zend_never_inline void zend_post_incdec_overloaded_property(zval *object, zval *property, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
1817 {
1818 	zval rv, obj;
1819 	zval *z;
1820 	zval z_copy;
1821 
1822 	ZVAL_OBJ(&obj, Z_OBJ_P(object));
1823 	Z_ADDREF(obj);
1824 	z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
1825 	if (UNEXPECTED(EG(exception))) {
1826 		OBJ_RELEASE(Z_OBJ(obj));
1827 		ZVAL_UNDEF(EX_VAR(opline->result.var));
1828 		return;
1829 	}
1830 
1831 	if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
1832 		zval rv2;
1833 		zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1834 		if (z == &rv) {
1835 			zval_ptr_dtor(&rv);
1836 		}
1837 		ZVAL_COPY_VALUE(z, value);
1838 	}
1839 
1840 	ZVAL_COPY_DEREF(&z_copy, z);
1841 	ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
1842 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1843 		increment_function(&z_copy);
1844 	} else {
1845 		decrement_function(&z_copy);
1846 	}
1847 	Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot);
1848 	OBJ_RELEASE(Z_OBJ(obj));
1849 	zval_ptr_dtor(&z_copy);
1850 	zval_ptr_dtor(z);
1851 }
1852 
zend_pre_incdec_overloaded_property(zval * object,zval * property,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)1853 static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object, zval *property, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
1854 {
1855 	zval rv;
1856 	zval *z, obj;
1857 	zval z_copy;
1858 
1859 	ZVAL_OBJ(&obj, Z_OBJ_P(object));
1860 	Z_ADDREF(obj);
1861 	z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
1862 	if (UNEXPECTED(EG(exception))) {
1863 		OBJ_RELEASE(Z_OBJ(obj));
1864 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1865 			ZVAL_NULL(EX_VAR(opline->result.var));
1866 		}
1867 		return;
1868 	}
1869 
1870 	if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
1871 		zval rv2;
1872 		zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1873 
1874 		if (z == &rv) {
1875 			zval_ptr_dtor(&rv);
1876 		}
1877 		ZVAL_COPY_VALUE(z, value);
1878 	}
1879 	ZVAL_COPY_DEREF(&z_copy, z);
1880 	if (ZEND_IS_INCREMENT(opline->opcode)) {
1881 		increment_function(&z_copy);
1882 	} else {
1883 		decrement_function(&z_copy);
1884 	}
1885 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1886 		ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
1887 	}
1888 	Z_OBJ_HT(obj)->write_property(&obj, property, &z_copy, cache_slot);
1889 	OBJ_RELEASE(Z_OBJ(obj));
1890 	zval_ptr_dtor(&z_copy);
1891 	zval_ptr_dtor(z);
1892 }
1893 
zend_assign_op_overloaded_property(zval * object,zval * property,void ** cache_slot,zval * value OPLINE_DC EXECUTE_DATA_DC)1894 static zend_never_inline void zend_assign_op_overloaded_property(zval *object, zval *property, void **cache_slot, zval *value OPLINE_DC EXECUTE_DATA_DC)
1895 {
1896 	zval *z;
1897 	zval rv, obj, res;
1898 
1899 	ZVAL_OBJ(&obj, Z_OBJ_P(object));
1900 	Z_ADDREF(obj);
1901 	z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
1902 	if (UNEXPECTED(EG(exception))) {
1903 		OBJ_RELEASE(Z_OBJ(obj));
1904 		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1905 			ZVAL_UNDEF(EX_VAR(opline->result.var));
1906 		}
1907 		return;
1908 	}
1909 	if (Z_TYPE_P(z) == IS_OBJECT && Z_OBJ_HT_P(z)->get) {
1910 		zval rv2;
1911 		zval *value = Z_OBJ_HT_P(z)->get(z, &rv2);
1912 
1913 		if (z == &rv) {
1914 			zval_ptr_dtor(&rv);
1915 		}
1916 		ZVAL_COPY_VALUE(z, value);
1917 	}
1918 	if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1919 		Z_OBJ_HT(obj)->write_property(&obj, property, &res, cache_slot);
1920 	}
1921 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1922 		ZVAL_COPY(EX_VAR(opline->result.var), &res);
1923 	}
1924 	zval_ptr_dtor(z);
1925 	zval_ptr_dtor(&res);
1926 	OBJ_RELEASE(Z_OBJ(obj));
1927 }
1928 
1929 /* Utility Functions for Extensions */
zend_extension_statement_handler(const zend_extension * extension,zend_execute_data * frame)1930 static void zend_extension_statement_handler(const zend_extension *extension, zend_execute_data *frame)
1931 {
1932 	if (extension->statement_handler) {
1933 		extension->statement_handler(frame);
1934 	}
1935 }
1936 
1937 
zend_extension_fcall_begin_handler(const zend_extension * extension,zend_execute_data * frame)1938 static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_execute_data *frame)
1939 {
1940 	if (extension->fcall_begin_handler) {
1941 		extension->fcall_begin_handler(frame);
1942 	}
1943 }
1944 
1945 
zend_extension_fcall_end_handler(const zend_extension * extension,zend_execute_data * frame)1946 static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_execute_data *frame)
1947 {
1948 	if (extension->fcall_end_handler) {
1949 		extension->fcall_end_handler(frame);
1950 	}
1951 }
1952 
1953 
zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)1954 static zend_always_inline HashTable *zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)
1955 {
1956 	HashTable *ht;
1957 
1958 	if (EXPECTED(fetch_type & (ZEND_FETCH_GLOBAL_LOCK | ZEND_FETCH_GLOBAL))) {
1959 		ht = &EG(symbol_table);
1960 	} else {
1961 		ZEND_ASSERT(fetch_type & ZEND_FETCH_LOCAL);
1962 		if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
1963 			zend_rebuild_symbol_table();
1964 		}
1965 		ht = EX(symbol_table);
1966 	}
1967 	return ht;
1968 }
1969 
zend_undefined_offset(zend_long lval)1970 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_offset(zend_long lval)
1971 {
1972 	zend_error(E_NOTICE, "Undefined offset: " ZEND_LONG_FMT, lval);
1973 }
1974 
zend_undefined_index(const zend_string * offset)1975 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_index(const zend_string *offset)
1976 {
1977 	zend_error(E_NOTICE, "Undefined index: %s", ZSTR_VAL(offset));
1978 }
1979 
zend_undefined_offset_write(HashTable * ht,zend_long lval)1980 static zend_never_inline ZEND_COLD int ZEND_FASTCALL zend_undefined_offset_write(
1981 		HashTable *ht, zend_long lval)
1982 {
1983 	/* The array may be destroyed while throwing the notice.
1984 	 * Temporarily increase the refcount to detect this situation. */
1985 	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
1986 		GC_ADDREF(ht);
1987 	}
1988 	zend_undefined_offset(lval);
1989 	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
1990 		zend_array_destroy(ht);
1991 		return FAILURE;
1992 	}
1993 	if (EG(exception)) {
1994 		return FAILURE;
1995 	}
1996 	return SUCCESS;
1997 }
1998 
zend_undefined_index_write(HashTable * ht,zend_string * offset)1999 static zend_never_inline ZEND_COLD int ZEND_FASTCALL zend_undefined_index_write(
2000 		HashTable *ht, zend_string *offset)
2001 {
2002 	/* The array may be destroyed while throwing the notice.
2003 	 * Temporarily increase the refcount to detect this situation. */
2004 	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2005 		GC_ADDREF(ht);
2006 	}
2007 	zend_undefined_index(offset);
2008 	if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2009 		zend_array_destroy(ht);
2010 		return FAILURE;
2011 	}
2012 	if (EG(exception)) {
2013 		return FAILURE;
2014 	}
2015 	return SUCCESS;
2016 }
2017 
zend_undefined_method(const zend_class_entry * ce,const zend_string * method)2018 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
2019 {
2020 	zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
2021 }
2022 
zend_invalid_method_call(zval * object,zval * function_name)2023 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_invalid_method_call(zval *object, zval *function_name)
2024 {
2025 	zend_throw_error(NULL, "Call to a member function %s() on %s", Z_STRVAL_P(function_name), zend_get_type_by_const(Z_TYPE_P(object)));
2026 }
2027 
zend_non_static_method_call(const zend_function * fbc)2028 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_non_static_method_call(const zend_function *fbc)
2029 {
2030 	if (fbc->common.fn_flags & ZEND_ACC_ALLOW_STATIC) {
2031 		zend_error(E_DEPRECATED,
2032 			"Non-static method %s::%s() should not be called statically",
2033 			ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2034 	} else {
2035 		zend_throw_error(
2036 			zend_ce_error,
2037 			"Non-static method %s::%s() cannot be called statically",
2038 			ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2039 	}
2040 }
2041 
zend_param_must_be_ref(const zend_function * func,uint32_t arg_num)2042 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_param_must_be_ref(const zend_function *func, uint32_t arg_num)
2043 {
2044 	zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
2045 		arg_num,
2046 		func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
2047 		func->common.scope ? "::" : "",
2048 		ZSTR_VAL(func->common.function_name));
2049 }
2050 
zend_use_scalar_as_array(void)2051 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(void)
2052 {
2053 	zend_error(E_WARNING, "Cannot use a scalar value as an array");
2054 }
2055 
zend_cannot_add_element(void)2056 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
2057 {
2058 	zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
2059 }
2060 
zend_use_resource_as_offset(const zval * dim)2061 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_resource_as_offset(const zval *dim)
2062 {
2063 	zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
2064 }
2065 
zend_use_new_element_for_string(void)2066 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_string(void)
2067 {
2068 	zend_throw_error(NULL, "[] operator not supported for strings");
2069 }
2070 
zend_binary_assign_op_dim_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2071 static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2072 {
2073 	if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2074 		if (opline->op2_type == IS_UNUSED) {
2075 			zend_use_new_element_for_string();
2076 		} else {
2077 			zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
2078 			zend_wrong_string_offset(EXECUTE_DATA_C);
2079 		}
2080 	} else if (EXPECTED(!Z_ISERROR_P(container))) {
2081 		zend_use_scalar_as_array();
2082 	}
2083 }
2084 
slow_index_convert(HashTable * ht,const zval * dim,zend_value * value EXECUTE_DATA_DC)2085 static zend_never_inline zend_uchar slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2086 {
2087 	switch (Z_TYPE_P(dim)) {
2088 		case IS_UNDEF: {
2089 			/* The array may be destroyed while throwing the notice.
2090 			 * Temporarily increase the refcount to detect this situation. */
2091 			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2092 				GC_ADDREF(ht);
2093 			}
2094 			ZVAL_UNDEFINED_OP2();
2095 			if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2096 				zend_array_destroy(ht);
2097 				return IS_NULL;
2098 			}
2099 			if (EG(exception)) {
2100 				return IS_NULL;
2101 			}
2102 			/* break missing intentionally */
2103 		}
2104 		case IS_NULL:
2105 			value->str = ZSTR_EMPTY_ALLOC();
2106 			return IS_STRING;
2107 		case IS_DOUBLE:
2108 			value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2109 			return IS_LONG;
2110 		case IS_RESOURCE:
2111 			zend_use_resource_as_offset(dim);
2112 			value->lval = Z_RES_HANDLE_P(dim);
2113 			return IS_LONG;
2114 		case IS_FALSE:
2115 			value->lval = 0;
2116 			return IS_LONG;
2117 		case IS_TRUE:
2118 			value->lval = 1;
2119 			return IS_LONG;
2120 		default:
2121 			zend_illegal_offset();
2122 			return IS_NULL;
2123 	}
2124 }
2125 
zend_fetch_dimension_address_inner(HashTable * ht,const zval * dim,int dim_type,int type EXECUTE_DATA_DC)2126 static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2127 {
2128 	zval *retval = NULL;
2129 	zend_string *offset_key;
2130 	zend_ulong hval;
2131 
2132 try_again:
2133 	if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
2134 		hval = Z_LVAL_P(dim);
2135 num_index:
2136 		ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
2137 		return retval;
2138 num_undef:
2139 		switch (type) {
2140 			case BP_VAR_R:
2141 				zend_undefined_offset(hval);
2142 				/* break missing intentionally */
2143 			case BP_VAR_UNSET:
2144 			case BP_VAR_IS:
2145 				retval = &EG(uninitialized_zval);
2146 				break;
2147 			case BP_VAR_RW:
2148 				if (UNEXPECTED(zend_undefined_offset_write(ht, hval) == FAILURE)) {
2149 					return NULL;
2150 				}
2151 				/* break missing intentionally */
2152 			case BP_VAR_W:
2153 				retval = zend_hash_index_add_new(ht, hval, &EG(uninitialized_zval));
2154 				break;
2155 		}
2156 	} else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
2157 		offset_key = Z_STR_P(dim);
2158 		if (ZEND_CONST_COND(dim_type != IS_CONST, 1)) {
2159 			if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
2160 				goto num_index;
2161 			}
2162 		}
2163 str_index:
2164 		retval = zend_hash_find_ex(ht, offset_key, ZEND_CONST_COND(dim_type == IS_CONST, 0));
2165 		if (retval) {
2166 			/* support for $GLOBALS[...] */
2167 			if (UNEXPECTED(Z_TYPE_P(retval) == IS_INDIRECT)) {
2168 				retval = Z_INDIRECT_P(retval);
2169 				if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
2170 					switch (type) {
2171 						case BP_VAR_R:
2172 							zend_undefined_index(offset_key);
2173 							/* break missing intentionally */
2174 						case BP_VAR_UNSET:
2175 						case BP_VAR_IS:
2176 							retval = &EG(uninitialized_zval);
2177 							break;
2178 						case BP_VAR_RW:
2179 							if (UNEXPECTED(zend_undefined_index_write(ht, offset_key))) {
2180 								return NULL;
2181 							}
2182 							/* break missing intentionally */
2183 						case BP_VAR_W:
2184 							ZVAL_NULL(retval);
2185 							break;
2186 					}
2187 				}
2188 			}
2189 		} else {
2190 			switch (type) {
2191 				case BP_VAR_R:
2192 					zend_undefined_index(offset_key);
2193 					/* break missing intentionally */
2194 				case BP_VAR_UNSET:
2195 				case BP_VAR_IS:
2196 					retval = &EG(uninitialized_zval);
2197 					break;
2198 				case BP_VAR_RW:
2199 					/* Key may be released while throwing the undefined index warning. */
2200 					zend_string_addref(offset_key);
2201 					if (UNEXPECTED(zend_undefined_index_write(ht, offset_key) == FAILURE)) {
2202 						zend_string_release(offset_key);
2203 						return NULL;
2204 					}
2205 					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
2206 					zend_string_release(offset_key);
2207 					break;
2208 				case BP_VAR_W:
2209 					retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
2210 					break;
2211 			}
2212 		}
2213 	} else if (EXPECTED(Z_TYPE_P(dim) == IS_REFERENCE)) {
2214 		dim = Z_REFVAL_P(dim);
2215 		goto try_again;
2216 	} else {
2217 		zend_value val;
2218 		zend_uchar t = slow_index_convert(ht, dim, &val EXECUTE_DATA_CC);
2219 
2220 		if (t == IS_STRING) {
2221 			offset_key = val.str;
2222 			goto str_index;
2223 		} else if (t == IS_LONG) {
2224 			hval = val.lval;
2225 			goto num_index;
2226 		} else {
2227 			retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
2228 					NULL : &EG(uninitialized_zval);
2229 		}
2230 	}
2231 	return retval;
2232 }
2233 
zend_fetch_dimension_address_inner_W(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2234 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2235 {
2236 	return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_W EXECUTE_DATA_CC);
2237 }
2238 
zend_fetch_dimension_address_inner_W_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2239 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2240 {
2241 	return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_W EXECUTE_DATA_CC);
2242 }
2243 
zend_fetch_dimension_address_inner_RW(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2244 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2245 {
2246 	return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_RW EXECUTE_DATA_CC);
2247 }
2248 
zend_fetch_dimension_address_inner_RW_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2249 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2250 {
2251 	return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_RW EXECUTE_DATA_CC);
2252 }
2253 
zend_fetch_dimension_address(zval * result,zval * container,zval * dim,int dim_type,int type EXECUTE_DATA_DC)2254 static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container, zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2255 {
2256 	zval *retval;
2257 
2258 	if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2259 try_array:
2260 		SEPARATE_ARRAY(container);
2261 fetch_from_array:
2262 		if (dim == NULL) {
2263 			retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
2264 			if (UNEXPECTED(retval == NULL)) {
2265 				zend_cannot_add_element();
2266 				ZVAL_ERROR(result);
2267 				return;
2268 			}
2269 		} else {
2270 			retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2271 			if (UNEXPECTED(!retval)) {
2272 				ZVAL_ERROR(result);
2273 				return;
2274 			}
2275 		}
2276 		ZVAL_INDIRECT(result, retval);
2277 		return;
2278 	} else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2279 		zend_reference *ref = Z_REF_P(container);
2280 		container = Z_REFVAL_P(container);
2281 		if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2282 			goto try_array;
2283 		} else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2284 			if (type != BP_VAR_UNSET) {
2285 				if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2286 					if (UNEXPECTED(!zend_verify_ref_array_assignable(ref))) {
2287 						ZVAL_ERROR(result);
2288 						return;
2289 					}
2290 				}
2291 				array_init(container);
2292 				goto fetch_from_array;
2293 			} else {
2294 				goto return_null;
2295 			}
2296 		}
2297 	}
2298 	if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2299 		if (dim == NULL) {
2300 			zend_use_new_element_for_string();
2301 		} else {
2302 			zend_check_string_offset(dim, type EXECUTE_DATA_CC);
2303 			zend_wrong_string_offset(EXECUTE_DATA_C);
2304 		}
2305 		ZVAL_ERROR(result);
2306 	} else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2307 		if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2308 			dim = ZVAL_UNDEFINED_OP2();
2309 		}
2310 		if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2311 			dim++;
2312 		}
2313 		retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result);
2314 
2315 		if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
2316 			zend_class_entry *ce = Z_OBJCE_P(container);
2317 
2318 			ZVAL_NULL(result);
2319 			zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2320 		} else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
2321 			if (!Z_ISREF_P(retval)) {
2322 				if (result != retval) {
2323 					ZVAL_COPY(result, retval);
2324 					retval = result;
2325 				}
2326 				if (Z_TYPE_P(retval) != IS_OBJECT) {
2327 					zend_class_entry *ce = Z_OBJCE_P(container);
2328 					zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2329 				}
2330 			} else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) {
2331 				ZVAL_UNREF(retval);
2332 			}
2333 			if (result != retval) {
2334 				ZVAL_INDIRECT(result, retval);
2335 			}
2336 		} else {
2337 			ZVAL_ERROR(result);
2338 		}
2339 	} else {
2340 		if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2341 			if (type != BP_VAR_W && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2342 				ZVAL_UNDEFINED_OP1();
2343 			}
2344 			if (type != BP_VAR_UNSET) {
2345 				array_init(container);
2346 				goto fetch_from_array;
2347 			} else {
2348 return_null:
2349 				/* for read-mode only */
2350 				if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2351 					ZVAL_UNDEFINED_OP2();
2352 				}
2353 				ZVAL_NULL(result);
2354 			}
2355 		} else if (EXPECTED(Z_ISERROR_P(container))) {
2356 			ZVAL_ERROR(result);
2357 		} else {
2358 			if (type == BP_VAR_UNSET) {
2359 				zend_error(E_WARNING, "Cannot unset offset in a non-array variable");
2360 				ZVAL_NULL(result);
2361 			} else {
2362 				zend_use_scalar_as_array();
2363 				ZVAL_ERROR(result);
2364 			}
2365 		}
2366 	}
2367 }
2368 
zend_fetch_dimension_address_W(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2369 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_W(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2370 {
2371 	zval *result = EX_VAR(opline->result.var);
2372 	zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W EXECUTE_DATA_CC);
2373 }
2374 
zend_fetch_dimension_address_RW(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2375 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_RW(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2376 {
2377 	zval *result = EX_VAR(opline->result.var);
2378 	zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW EXECUTE_DATA_CC);
2379 }
2380 
zend_fetch_dimension_address_UNSET(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2381 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_UNSET(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2382 {
2383 	zval *result = EX_VAR(opline->result.var);
2384 	zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET EXECUTE_DATA_CC);
2385 }
2386 
zend_fetch_dimension_address_read(zval * result,zval * container,zval * dim,int dim_type,int type,int is_list,int slow EXECUTE_DATA_DC)2387 static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, int is_list, int slow EXECUTE_DATA_DC)
2388 {
2389 	zval *retval;
2390 
2391 	if (!slow) {
2392 		if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2393 try_array:
2394 			retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2395 			ZVAL_COPY_DEREF(result, retval);
2396 			return;
2397 		} else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2398 			container = Z_REFVAL_P(container);
2399 			if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2400 				goto try_array;
2401 			}
2402 		}
2403 	}
2404 	if (!is_list && EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2405 		zend_long offset;
2406 
2407 try_string_offset:
2408 		if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
2409 			switch (Z_TYPE_P(dim)) {
2410 				/* case IS_LONG: */
2411 				case IS_STRING:
2412 					if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, -1)) {
2413 						break;
2414 					}
2415 					if (type == BP_VAR_IS) {
2416 						ZVAL_NULL(result);
2417 						return;
2418 					}
2419 					zend_error(E_WARNING, "Illegal string offset '%s'", Z_STRVAL_P(dim));
2420 					break;
2421 				case IS_UNDEF:
2422 					ZVAL_UNDEFINED_OP2();
2423 				case IS_DOUBLE:
2424 				case IS_NULL:
2425 				case IS_FALSE:
2426 				case IS_TRUE:
2427 					if (type != BP_VAR_IS) {
2428 						zend_error(E_NOTICE, "String offset cast occurred");
2429 					}
2430 					break;
2431 				case IS_REFERENCE:
2432 					dim = Z_REFVAL_P(dim);
2433 					goto try_string_offset;
2434 				default:
2435 					zend_illegal_offset();
2436 					break;
2437 			}
2438 
2439 			offset = zval_get_long_func(dim);
2440 		} else {
2441 			offset = Z_LVAL_P(dim);
2442 		}
2443 
2444 		if (UNEXPECTED(Z_STRLEN_P(container) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
2445 			if (type != BP_VAR_IS) {
2446 				zend_error(E_NOTICE, "Uninitialized string offset: " ZEND_LONG_FMT, offset);
2447 				ZVAL_EMPTY_STRING(result);
2448 			} else {
2449 				ZVAL_NULL(result);
2450 			}
2451 		} else {
2452 			zend_uchar c;
2453 			zend_long real_offset;
2454 
2455 			real_offset = (UNEXPECTED(offset < 0)) /* Handle negative offset */
2456 				? (zend_long)Z_STRLEN_P(container) + offset : offset;
2457 			c = (zend_uchar)Z_STRVAL_P(container)[real_offset];
2458 
2459 			ZVAL_INTERNED_STR(result, ZSTR_CHAR(c));
2460 		}
2461 	} else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2462 		if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2463 			dim = ZVAL_UNDEFINED_OP2();
2464 		}
2465 		if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2466 			dim++;
2467 		}
2468 		retval = Z_OBJ_HT_P(container)->read_dimension(container, dim, type, result);
2469 
2470 		ZEND_ASSERT(result != NULL);
2471 		if (retval) {
2472 			if (result != retval) {
2473 				ZVAL_COPY_DEREF(result, retval);
2474 			} else if (UNEXPECTED(Z_ISREF_P(retval))) {
2475 				zend_unwrap_reference(result);
2476 			}
2477 		} else {
2478 			ZVAL_NULL(result);
2479 		}
2480 	} else {
2481 		if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2482 			container = ZVAL_UNDEFINED_OP1();
2483 		}
2484 		if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2485 			ZVAL_UNDEFINED_OP2();
2486 		}
2487 		if (!is_list && type != BP_VAR_IS) {
2488 			zend_error(E_NOTICE, "Trying to access array offset on value of type %s",
2489 				zend_zval_type_name(container));
2490 		}
2491 		ZVAL_NULL(result);
2492 	}
2493 }
2494 
zend_fetch_dimension_address_read_R(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2495 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_R(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2496 {
2497 	zval *result = EX_VAR(opline->result.var);
2498 	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
2499 }
2500 
zend_fetch_dimension_address_read_R_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2501 static zend_never_inline void zend_fetch_dimension_address_read_R_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2502 {
2503 	zval *result = EX_VAR(opline->result.var);
2504 	zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 0, 1 EXECUTE_DATA_CC);
2505 }
2506 
zend_fetch_dimension_address_read_IS(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2507 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_IS(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2508 {
2509 	zval *result = EX_VAR(opline->result.var);
2510 	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 0, 0 EXECUTE_DATA_CC);
2511 }
2512 
zend_fetch_dimension_address_LIST_r(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2513 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2514 {
2515 	zval *result = EX_VAR(opline->result.var);
2516 	zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0 EXECUTE_DATA_CC);
2517 }
2518 
zend_fetch_dimension_const(zval * result,zval * container,zval * dim,int type)2519 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)
2520 {
2521 	zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 0, 0 NO_EXECUTE_DATA_CC);
2522 }
2523 
zend_find_array_dim_slow(HashTable * ht,zval * offset EXECUTE_DATA_DC)2524 static zend_never_inline zval* ZEND_FASTCALL zend_find_array_dim_slow(HashTable *ht, zval *offset EXECUTE_DATA_DC)
2525 {
2526 	zend_ulong hval;
2527 
2528 	if (Z_TYPE_P(offset) == IS_DOUBLE) {
2529 		hval = zend_dval_to_lval(Z_DVAL_P(offset));
2530 num_idx:
2531 		return zend_hash_index_find(ht, hval);
2532 	} else if (Z_TYPE_P(offset) == IS_NULL) {
2533 str_idx:
2534 		return zend_hash_find_ex_ind(ht, ZSTR_EMPTY_ALLOC(), 1);
2535 	} else if (Z_TYPE_P(offset) == IS_FALSE) {
2536 		hval = 0;
2537 		goto num_idx;
2538 	} else if (Z_TYPE_P(offset) == IS_TRUE) {
2539 		hval = 1;
2540 		goto num_idx;
2541 	} else if (Z_TYPE_P(offset) == IS_RESOURCE) {
2542 		hval = Z_RES_HANDLE_P(offset);
2543 		goto num_idx;
2544 	} else if (/*OP2_TYPE == IS_CV &&*/ Z_TYPE_P(offset) == IS_UNDEF) {
2545 		ZVAL_UNDEFINED_OP2();
2546 		goto str_idx;
2547 	} else {
2548 		zend_error(E_WARNING, "Illegal offset type in isset or empty");
2549 		return NULL;
2550 	}
2551 }
2552 
zend_isset_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2553 static zend_never_inline int ZEND_FASTCALL zend_isset_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2554 {
2555 	if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2556 		offset = ZVAL_UNDEFINED_OP2();
2557 	}
2558 
2559 	if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2560 		return Z_OBJ_HT_P(container)->has_dimension(container, offset, 0);
2561 	} else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2562 		zend_long lval;
2563 
2564 		if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2565 			lval = Z_LVAL_P(offset);
2566 str_offset:
2567 			if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2568 				lval += (zend_long)Z_STRLEN_P(container);
2569 			}
2570 			if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2571 				return 1;
2572 			} else {
2573 				return 0;
2574 			}
2575 		} else {
2576 			/*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2577 				ZVAL_DEREF(offset);
2578 			/*}*/
2579 			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
2580 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
2581 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
2582 				lval = zval_get_long(offset);
2583 				goto str_offset;
2584 			}
2585 			return 0;
2586 		}
2587 	} else {
2588 		return 0;
2589 	}
2590 }
2591 
zend_isempty_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2592 static zend_never_inline int ZEND_FASTCALL zend_isempty_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2593 {
2594 	if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2595 		offset = ZVAL_UNDEFINED_OP2();
2596 	}
2597 
2598 	if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2599 		return !Z_OBJ_HT_P(container)->has_dimension(container, offset, 1);
2600 	} else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2601 		zend_long lval;
2602 
2603 		if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2604 			lval = Z_LVAL_P(offset);
2605 str_offset:
2606 			if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2607 				lval += (zend_long)Z_STRLEN_P(container);
2608 			}
2609 			if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2610 				return (Z_STRVAL_P(container)[lval] == '0');
2611 			} else {
2612 				return 1;
2613 			}
2614 		} else {
2615 			/*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2616 				ZVAL_DEREF(offset);
2617 			/*}*/
2618 			if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
2619 					|| (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
2620 						&& IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
2621 				lval = zval_get_long(offset);
2622 				goto str_offset;
2623 			}
2624 			return 1;
2625 		}
2626 	} else {
2627 		return 1;
2628 	}
2629 }
2630 
zend_array_key_exists_fast(HashTable * ht,zval * key OPLINE_DC EXECUTE_DATA_DC)2631 static zend_never_inline uint32_t ZEND_FASTCALL zend_array_key_exists_fast(HashTable *ht, zval *key OPLINE_DC EXECUTE_DATA_DC)
2632 {
2633 	zend_string *str;
2634 	zend_ulong hval;
2635 
2636 try_again:
2637 	if (EXPECTED(Z_TYPE_P(key) == IS_STRING)) {
2638 		str = Z_STR_P(key);
2639 		if (ZEND_HANDLE_NUMERIC(str, hval)) {
2640 			goto num_key;
2641 		}
2642 str_key:
2643 		return zend_hash_find_ind(ht, str) != NULL ? IS_TRUE : IS_FALSE;
2644 	} else if (EXPECTED(Z_TYPE_P(key) == IS_LONG)) {
2645 		hval = Z_LVAL_P(key);
2646 num_key:
2647 		return zend_hash_index_find(ht, hval) != NULL ? IS_TRUE : IS_FALSE;
2648 	} else if (EXPECTED(Z_ISREF_P(key))) {
2649 		key = Z_REFVAL_P(key);
2650 		goto try_again;
2651 	} else if (Z_TYPE_P(key) <= IS_NULL) {
2652 		if (UNEXPECTED(Z_TYPE_P(key) == IS_UNDEF)) {
2653 			ZVAL_UNDEFINED_OP1();
2654 		}
2655 		str = ZSTR_EMPTY_ALLOC();
2656 		goto str_key;
2657 	} else {
2658 		zend_error(E_WARNING, "array_key_exists(): The first argument should be either a string or an integer");
2659 		return IS_FALSE;
2660 	}
2661 }
2662 
zend_array_key_exists_slow(zval * subject,zval * key OPLINE_DC EXECUTE_DATA_DC)2663 static zend_never_inline uint32_t ZEND_FASTCALL zend_array_key_exists_slow(zval *subject, zval *key OPLINE_DC EXECUTE_DATA_DC)
2664 {
2665 	if (EXPECTED(Z_TYPE_P(subject) == IS_OBJECT)) {
2666 		zend_error(E_DEPRECATED, "array_key_exists(): "
2667 			"Using array_key_exists() on objects is deprecated. "
2668 			"Use isset() or property_exists() instead");
2669 
2670 		HashTable *ht = zend_get_properties_for(subject, ZEND_PROP_PURPOSE_ARRAY_CAST);
2671 		uint32_t result = zend_array_key_exists_fast(ht, key OPLINE_CC EXECUTE_DATA_CC);
2672 		zend_release_properties(ht);
2673 		return result;
2674 	} else {
2675 		if (UNEXPECTED(Z_TYPE_P(key) == IS_UNDEF)) {
2676 			ZVAL_UNDEFINED_OP1();
2677 		}
2678 		if (UNEXPECTED(Z_TYPE_INFO_P(subject) == IS_UNDEF)) {
2679 			ZVAL_UNDEFINED_OP2();
2680 		}
2681 		zend_internal_type_error(EX_USES_STRICT_TYPES(), "array_key_exists() expects parameter 2 to be array, %s given", zend_get_type_by_const(Z_TYPE_P(subject)));
2682 		return IS_NULL;
2683 	}
2684 }
2685 
promotes_to_array(zval * val)2686 static zend_always_inline zend_bool promotes_to_array(zval *val) {
2687 	return Z_TYPE_P(val) <= IS_FALSE
2688 		|| (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE);
2689 }
2690 
promotes_to_object(zval * val)2691 static zend_always_inline zend_bool promotes_to_object(zval *val) {
2692 	ZVAL_DEREF(val);
2693 	return Z_TYPE_P(val) <= IS_FALSE
2694 		|| (Z_TYPE_P(val) == IS_STRING && Z_STRLEN_P(val) == 0);
2695 }
2696 
check_type_array_assignable(zend_type type)2697 static zend_always_inline zend_bool check_type_array_assignable(zend_type type) {
2698 	if (!type) {
2699 		return 1;
2700 	}
2701 	return ZEND_TYPE_IS_CODE(type)
2702 		&& (ZEND_TYPE_CODE(type) == IS_ARRAY || ZEND_TYPE_CODE(type) == IS_ITERABLE);
2703 }
2704 
check_type_stdClass_assignable(zend_type type)2705 static zend_always_inline zend_bool check_type_stdClass_assignable(zend_type type) {
2706 	if (!type) {
2707 		return 1;
2708 	}
2709 	if (ZEND_TYPE_IS_CLASS(type)) {
2710 		if (ZEND_TYPE_IS_CE(type)) {
2711 			return ZEND_TYPE_CE(type) == zend_standard_class_def;
2712 		} else {
2713 			return zend_string_equals_literal_ci(ZEND_TYPE_NAME(type), "stdclass");
2714 		}
2715 	} else {
2716 		return ZEND_TYPE_CODE(type) == IS_OBJECT;
2717 	}
2718 }
2719 
2720 /* Checks whether an array can be assigned to the reference. Returns conflicting property if
2721  * assignment is not possible, NULL otherwise. */
zend_verify_ref_array_assignable(zend_reference * ref)2722 static zend_never_inline zend_bool zend_verify_ref_array_assignable(zend_reference *ref) {
2723 	zend_property_info *prop;
2724 	ZEND_ASSERT(ZEND_REF_HAS_TYPE_SOURCES(ref));
2725 	ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
2726 		if (!check_type_array_assignable(prop->type)) {
2727 			zend_throw_auto_init_in_ref_error(prop, "array");
2728 			return 0;
2729 		}
2730 	} ZEND_REF_FOREACH_TYPE_SOURCES_END();
2731 	return 1;
2732 }
2733 
2734 /* Checks whether an stdClass can be assigned to the reference. Returns conflicting property if
2735  * assignment is not possible, NULL otherwise. */
zend_verify_ref_stdClass_assignable(zend_reference * ref)2736 static zend_never_inline zend_bool zend_verify_ref_stdClass_assignable(zend_reference *ref) {
2737 	zend_property_info *prop;
2738 	ZEND_ASSERT(ZEND_REF_HAS_TYPE_SOURCES(ref));
2739 	ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
2740 		if (!check_type_stdClass_assignable(prop->type)) {
2741 			zend_throw_auto_init_in_ref_error(prop, "stdClass");
2742 			return 0;
2743 		}
2744 	} ZEND_REF_FOREACH_TYPE_SOURCES_END();
2745 	return 1;
2746 }
2747 
zend_object_fetch_property_type_info(zend_object * obj,zval * slot)2748 static zend_property_info *zend_object_fetch_property_type_info(
2749 		zend_object *obj, zval *slot)
2750 {
2751 	if (EXPECTED(!ZEND_CLASS_HAS_TYPE_HINTS(obj->ce))) {
2752 		return NULL;
2753 	}
2754 
2755 	/* Not a declared property */
2756 	if (UNEXPECTED(slot < obj->properties_table ||
2757 			slot >= obj->properties_table + obj->ce->default_properties_count)) {
2758 		return NULL;
2759 	}
2760 
2761 	return zend_get_typed_property_info_for_slot(obj, slot);
2762 }
2763 
zend_handle_fetch_obj_flags(zval * result,zval * ptr,zend_object * obj,zend_property_info * prop_info,uint32_t flags)2764 static zend_never_inline zend_bool zend_handle_fetch_obj_flags(
2765 		zval *result, zval *ptr, zend_object *obj, zend_property_info *prop_info, uint32_t flags)
2766 {
2767 	switch (flags) {
2768 		case ZEND_FETCH_DIM_WRITE:
2769 			if (promotes_to_array(ptr)) {
2770 				if (!prop_info) {
2771 					prop_info = zend_object_fetch_property_type_info(obj, ptr);
2772 					if (!prop_info) {
2773 						break;
2774 					}
2775 				}
2776 				if (!check_type_array_assignable(prop_info->type)) {
2777 					zend_throw_auto_init_in_prop_error(prop_info, "array");
2778 					if (result) ZVAL_ERROR(result);
2779 					return 0;
2780 				}
2781 			}
2782 			break;
2783 		case ZEND_FETCH_OBJ_WRITE:
2784 			if (promotes_to_object(ptr)) {
2785 				if (!prop_info) {
2786 					prop_info = zend_object_fetch_property_type_info(obj, ptr);
2787 					if (!prop_info) {
2788 						break;
2789 					}
2790 				}
2791 				if (!check_type_stdClass_assignable(prop_info->type)) {
2792 					zend_throw_auto_init_in_prop_error(prop_info, "stdClass");
2793 					if (result) ZVAL_ERROR(result);
2794 					return 0;
2795 				}
2796 	        }
2797 			break;
2798 		case ZEND_FETCH_REF:
2799 			if (Z_TYPE_P(ptr) != IS_REFERENCE) {
2800 				if (!prop_info) {
2801 					prop_info = zend_object_fetch_property_type_info(obj, ptr);
2802 					if (!prop_info) {
2803 						break;
2804 					}
2805 				}
2806 				if (Z_TYPE_P(ptr) == IS_UNDEF) {
2807 					if (!ZEND_TYPE_ALLOW_NULL(prop_info->type)) {
2808 						zend_throw_access_uninit_prop_by_ref_error(prop_info);
2809 						if (result) ZVAL_ERROR(result);
2810 						return 0;
2811 					}
2812 					ZVAL_NULL(ptr);
2813 				}
2814 
2815 				ZVAL_NEW_REF(ptr, ptr);
2816 				ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(ptr), prop_info);
2817 			}
2818 			break;
2819 		EMPTY_SWITCH_DEFAULT_CASE()
2820 	}
2821 	return 1;
2822 }
2823 
zend_fetch_property_address(zval * result,zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,void ** cache_slot,int type,uint32_t flags,zend_bool init_undef OPLINE_DC EXECUTE_DATA_DC)2824 static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type, uint32_t flags, zend_bool init_undef OPLINE_DC EXECUTE_DATA_DC)
2825 {
2826 	zval *ptr;
2827 
2828 	if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
2829 		do {
2830 			if (Z_ISREF_P(container) && Z_TYPE_P(Z_REFVAL_P(container)) == IS_OBJECT) {
2831 				container = Z_REFVAL_P(container);
2832 				break;
2833 			}
2834 
2835 			if (container_op_type == IS_CV
2836 			 && type != BP_VAR_W
2837 			 && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2838 				ZVAL_UNDEFINED_OP1();
2839 			}
2840 
2841 			/* this should modify object only if it's empty */
2842 			if (type == BP_VAR_UNSET) {
2843 				ZVAL_NULL(result);
2844 				return;
2845 			}
2846 
2847 			container = make_real_object(container, prop_ptr OPLINE_CC EXECUTE_DATA_CC);
2848 			if (UNEXPECTED(!container)) {
2849 				ZVAL_ERROR(result);
2850 				return;
2851 			}
2852 		} while (0);
2853 	}
2854 	if (prop_op_type == IS_CONST &&
2855 	    EXPECTED(Z_OBJCE_P(container) == CACHED_PTR_EX(cache_slot))) {
2856 		uintptr_t prop_offset = (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
2857 		zend_object *zobj = Z_OBJ_P(container);
2858 
2859 		if (EXPECTED(IS_VALID_PROPERTY_OFFSET(prop_offset))) {
2860 			ptr = OBJ_PROP(zobj, prop_offset);
2861 			if (EXPECTED(Z_TYPE_P(ptr) != IS_UNDEF)) {
2862 				ZVAL_INDIRECT(result, ptr);
2863 				if (flags) {
2864 					zend_property_info *prop_info = CACHED_PTR_EX(cache_slot + 2);
2865 					if (prop_info) {
2866 						zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags);
2867 					}
2868 				}
2869 				return;
2870 			}
2871 		} else if (EXPECTED(zobj->properties != NULL)) {
2872 			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
2873 				if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
2874 					GC_DELREF(zobj->properties);
2875 				}
2876 				zobj->properties = zend_array_dup(zobj->properties);
2877 			}
2878 			ptr = zend_hash_find_ex(zobj->properties, Z_STR_P(prop_ptr), 1);
2879 			if (EXPECTED(ptr)) {
2880 				ZVAL_INDIRECT(result, ptr);
2881 				return;
2882 			}
2883 		}
2884 	}
2885 	ptr = Z_OBJ_HT_P(container)->get_property_ptr_ptr(container, prop_ptr, type, cache_slot);
2886 	if (NULL == ptr) {
2887 		ptr = Z_OBJ_HT_P(container)->read_property(container, prop_ptr, type, cache_slot, result);
2888 		if (ptr == result) {
2889 			if (UNEXPECTED(Z_ISREF_P(ptr) && Z_REFCOUNT_P(ptr) == 1)) {
2890 				ZVAL_UNREF(ptr);
2891 			}
2892 			return;
2893 		}
2894 		if (UNEXPECTED(EG(exception))) {
2895 			ZVAL_ERROR(result);
2896 			return;
2897 		}
2898 	} else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
2899 		ZVAL_ERROR(result);
2900 		return;
2901 	}
2902 
2903 	ZVAL_INDIRECT(result, ptr);
2904 	if (flags) {
2905 		zend_property_info *prop_info;
2906 
2907 		if (prop_op_type == IS_CONST) {
2908 			prop_info = CACHED_PTR_EX(cache_slot + 2);
2909 			if (prop_info) {
2910 				if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags))) {
2911 					return;
2912 				}
2913 			}
2914 		} else {
2915 			if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, Z_OBJ_P(container), NULL, flags))) {
2916 				return;
2917 			}
2918 		}
2919 	}
2920 	if (init_undef && UNEXPECTED(Z_TYPE_P(ptr) == IS_UNDEF)) {
2921 		ZVAL_NULL(ptr);
2922 	}
2923 }
2924 
zend_assign_to_property_reference(zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2925 static zend_always_inline void zend_assign_to_property_reference(zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2926 {
2927 	zval variable, *variable_ptr = &variable;
2928 	void **cache_addr = (prop_op_type == IS_CONST) ? CACHE_ADDR(opline->extended_value & ~ZEND_RETURNS_FUNCTION) : NULL;
2929 
2930 	zend_fetch_property_address(variable_ptr, container, container_op_type, prop_ptr, prop_op_type,
2931 		cache_addr, BP_VAR_W, 0, 0 OPLINE_CC EXECUTE_DATA_CC);
2932 
2933 	if (Z_TYPE_P(variable_ptr) == IS_INDIRECT) {
2934 		variable_ptr = Z_INDIRECT_P(variable_ptr);
2935 	}
2936 
2937 	if (UNEXPECTED(Z_ISERROR_P(variable_ptr))) {
2938 		variable_ptr = &EG(uninitialized_zval);
2939 	} else if (UNEXPECTED(Z_TYPE(variable) != IS_INDIRECT)) {
2940 		zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
2941 		zval_ptr_dtor(&variable);
2942 		variable_ptr = &EG(uninitialized_zval);
2943 	} else if (/*OP_DATA_TYPE == IS_VAR &&*/ UNEXPECTED(Z_ISERROR_P(value_ptr))) {
2944 		variable_ptr = &EG(uninitialized_zval);
2945 	} else if (/*OP_DATA_TYPE == IS_VAR &&*/
2946 	           (opline->extended_value & ZEND_RETURNS_FUNCTION) &&
2947 			   UNEXPECTED(!Z_ISREF_P(value_ptr))) {
2948 
2949 		variable_ptr = zend_wrong_assign_to_variable_reference(
2950 			variable_ptr, value_ptr OPLINE_CC EXECUTE_DATA_CC);
2951 	} else {
2952 		zend_property_info *prop_info = NULL;
2953 
2954 		if (prop_op_type == IS_CONST) {
2955 			prop_info = (zend_property_info *) CACHED_PTR_EX(cache_addr + 2);
2956 		} else {
2957 			ZVAL_DEREF(container);
2958 			prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(container), variable_ptr);
2959 		}
2960 
2961 		if (UNEXPECTED(prop_info)) {
2962 			variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr EXECUTE_DATA_CC);
2963 		} else {
2964 			zend_assign_to_variable_reference(variable_ptr, value_ptr);
2965 		}
2966 	}
2967 
2968 	if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2969 		ZVAL_COPY(EX_VAR(opline->result.var), variable_ptr);
2970 	}
2971 }
2972 
zend_assign_to_property_reference_this_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2973 static zend_never_inline void zend_assign_to_property_reference_this_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2974 {
2975 	zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_CONST, value_ptr
2976 		OPLINE_CC EXECUTE_DATA_CC);
2977 }
2978 
zend_assign_to_property_reference_var_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2979 static zend_never_inline void zend_assign_to_property_reference_var_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2980 {
2981 	zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_CONST, value_ptr
2982 		OPLINE_CC EXECUTE_DATA_CC);
2983 }
2984 
zend_assign_to_property_reference_this_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2985 static zend_never_inline void zend_assign_to_property_reference_this_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2986 {
2987 	zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_VAR, value_ptr
2988 		OPLINE_CC EXECUTE_DATA_CC);
2989 }
2990 
zend_assign_to_property_reference_var_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2991 static zend_never_inline void zend_assign_to_property_reference_var_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2992 {
2993 	zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_VAR, value_ptr
2994 		OPLINE_CC EXECUTE_DATA_CC);
2995 }
2996 
zend_fetch_static_property_address_ex(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type OPLINE_DC EXECUTE_DATA_DC)2997 static zend_never_inline int zend_fetch_static_property_address_ex(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type OPLINE_DC EXECUTE_DATA_DC) {
2998 	zend_free_op free_op1;
2999 	zend_string *name, *tmp_name;
3000 	zend_class_entry *ce;
3001 	zend_property_info *property_info;
3002 
3003 	zend_uchar op1_type = opline->op1_type, op2_type = opline->op2_type;
3004 
3005 	if (EXPECTED(op2_type == IS_CONST)) {
3006 		zval *class_name = RT_CONSTANT(opline, opline->op2);
3007 
3008 		ZEND_ASSERT(op1_type != IS_CONST || CACHED_PTR(cache_slot) == NULL);
3009 
3010 		if (EXPECTED((ce = CACHED_PTR(cache_slot)) == NULL)) {
3011 			ce = zend_fetch_class_by_name(Z_STR_P(class_name), Z_STR_P(class_name + 1), ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
3012 			if (UNEXPECTED(ce == NULL)) {
3013 				FREE_UNFETCHED_OP(op1_type, opline->op1.var);
3014 				return FAILURE;
3015 			}
3016 			if (UNEXPECTED(op1_type != IS_CONST)) {
3017 				CACHE_PTR(cache_slot, ce);
3018 			}
3019 		}
3020 	} else {
3021 		if (EXPECTED(op2_type == IS_UNUSED)) {
3022 			ce = zend_fetch_class(NULL, opline->op2.num);
3023 			if (UNEXPECTED(ce == NULL)) {
3024 				FREE_UNFETCHED_OP(op1_type, opline->op1.var);
3025 				return FAILURE;
3026 			}
3027 		} else {
3028 			ce = Z_CE_P(EX_VAR(opline->op2.var));
3029 		}
3030 		if (EXPECTED(op1_type == IS_CONST) && EXPECTED(CACHED_PTR(cache_slot) == ce)) {
3031 			*retval = CACHED_PTR(cache_slot + sizeof(void *));
3032 			*prop_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3033 			return SUCCESS;
3034 		}
3035 	}
3036 
3037 	if (EXPECTED(op1_type == IS_CONST)) {
3038 		name = Z_STR_P(RT_CONSTANT(opline, opline->op1));
3039 	} else {
3040 		zval *varname = get_zval_ptr_undef(opline->op1_type, opline->op1, &free_op1, BP_VAR_R);
3041 		if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {
3042 			name = Z_STR_P(varname);
3043 			tmp_name = NULL;
3044 		} else {
3045 			if (op1_type == IS_CV && UNEXPECTED(Z_TYPE_P(varname) == IS_UNDEF)) {
3046 				zval_undefined_cv(opline->op1.var EXECUTE_DATA_CC);
3047 			}
3048 			name = zval_get_tmp_string(varname, &tmp_name);
3049 		}
3050 	}
3051 
3052 	*retval = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3053 
3054 	if (UNEXPECTED(op1_type != IS_CONST)) {
3055 		zend_tmp_string_release(tmp_name);
3056 
3057 		if (op1_type != IS_CV) {
3058 			zval_ptr_dtor_nogc(free_op1);
3059 		}
3060 	}
3061 
3062 	if (UNEXPECTED(*retval == NULL)) {
3063 		return FAILURE;
3064 	}
3065 
3066 	*prop_info = property_info;
3067 
3068 	if (EXPECTED(op1_type == IS_CONST)) {
3069 		CACHE_POLYMORPHIC_PTR(cache_slot, ce, *retval);
3070 		CACHE_PTR(cache_slot + sizeof(void *) * 2, property_info);
3071 	}
3072 
3073 	return SUCCESS;
3074 }
3075 
3076 
zend_fetch_static_property_address(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type,int flags OPLINE_DC EXECUTE_DATA_DC)3077 static zend_always_inline int zend_fetch_static_property_address(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type, int flags OPLINE_DC EXECUTE_DATA_DC) {
3078 	int success;
3079 	zend_property_info *property_info;
3080 
3081 	if (opline->op1_type == IS_CONST && (opline->op2_type == IS_CONST || (opline->op2_type == IS_UNUSED && (opline->op2.num == ZEND_FETCH_CLASS_SELF || opline->op2.num == ZEND_FETCH_CLASS_PARENT))) && EXPECTED(CACHED_PTR(cache_slot) != NULL)) {
3082 		*retval = CACHED_PTR(cache_slot + sizeof(void *));
3083 		property_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3084 
3085 		if ((fetch_type == BP_VAR_R || fetch_type == BP_VAR_RW)
3086 				&& UNEXPECTED(Z_TYPE_P(*retval) == IS_UNDEF) && UNEXPECTED(property_info->type != 0)) {
3087 			zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
3088 				ZSTR_VAL(property_info->ce->name),
3089 				zend_get_unmangled_property_name(property_info->name));
3090 			return FAILURE;
3091 		}
3092 	} else {
3093 		success = zend_fetch_static_property_address_ex(retval, &property_info, cache_slot, fetch_type OPLINE_CC EXECUTE_DATA_CC);
3094 		if (UNEXPECTED(success != SUCCESS)) {
3095 			return FAILURE;
3096 		}
3097 	}
3098 
3099 	if (flags && property_info->type) {
3100 		zend_handle_fetch_obj_flags(NULL, *retval, NULL, property_info, flags);
3101 	}
3102 
3103 	if (prop_info) {
3104 		*prop_info = property_info;
3105 	}
3106 
3107 	return SUCCESS;
3108 }
3109 
zend_throw_ref_type_error_type(zend_property_info * prop1,zend_property_info * prop2,zval * zv)3110 ZEND_API ZEND_COLD void zend_throw_ref_type_error_type(zend_property_info *prop1, zend_property_info *prop2, zval *zv) {
3111 	const char *prop1_type1, *prop1_type2, *prop2_type1, *prop2_type2;
3112 	zend_format_type(prop1->type, &prop1_type1, &prop1_type2);
3113 	zend_format_type(prop2->type, &prop2_type1, &prop2_type2);
3114 	zend_type_error("Reference with value of type %s held by property %s::$%s of type %s%s is not compatible with property %s::$%s of type %s%s",
3115 		Z_TYPE_P(zv) == IS_OBJECT ? ZSTR_VAL(Z_OBJCE_P(zv)->name) : zend_get_type_by_const(Z_TYPE_P(zv)),
3116 		ZSTR_VAL(prop1->ce->name),
3117 		zend_get_unmangled_property_name(prop1->name),
3118 		prop1_type1, prop1_type2,
3119 		ZSTR_VAL(prop2->ce->name),
3120 		zend_get_unmangled_property_name(prop2->name),
3121 		prop2_type1, prop2_type2
3122 	);
3123 }
3124 
zend_throw_ref_type_error_zval(zend_property_info * prop,zval * zv)3125 ZEND_API ZEND_COLD void zend_throw_ref_type_error_zval(zend_property_info *prop, zval *zv) {
3126 	const char *prop_type1, *prop_type2;
3127 	zend_format_type(prop->type, &prop_type1, &prop_type2);
3128 	zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s%s",
3129 		Z_TYPE_P(zv) == IS_OBJECT ? ZSTR_VAL(Z_OBJCE_P(zv)->name) : zend_get_type_by_const(Z_TYPE_P(zv)),
3130 		ZSTR_VAL(prop->ce->name),
3131 		zend_get_unmangled_property_name(prop->name),
3132 		prop_type1, prop_type2
3133 	);
3134 }
3135 
zend_throw_conflicting_coercion_error(zend_property_info * prop1,zend_property_info * prop2,zval * zv)3136 ZEND_API ZEND_COLD void zend_throw_conflicting_coercion_error(zend_property_info *prop1, zend_property_info *prop2, zval *zv) {
3137 	const char *prop1_type1, *prop1_type2, *prop2_type1, *prop2_type2;
3138 	zend_format_type(prop1->type, &prop1_type1, &prop1_type2);
3139 	zend_format_type(prop2->type, &prop2_type1, &prop2_type2);
3140 	zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s%s and property %s::$%s of type %s%s, as this would result in an inconsistent type conversion",
3141 		Z_TYPE_P(zv) == IS_OBJECT ? ZSTR_VAL(Z_OBJCE_P(zv)->name) : zend_get_type_by_const(Z_TYPE_P(zv)),
3142 		ZSTR_VAL(prop1->ce->name),
3143 		zend_get_unmangled_property_name(prop1->name),
3144 		prop1_type1, prop1_type2,
3145 		ZSTR_VAL(prop2->ce->name),
3146 		zend_get_unmangled_property_name(prop2->name),
3147 		prop2_type1, prop2_type2
3148 	);
3149 }
3150 
3151 /* 1: valid, 0: invalid, -1: may be valid after type coercion */
i_zend_verify_type_assignable_zval(zend_type * type_ptr,zend_class_entry * self_ce,zval * zv,zend_bool strict)3152 static zend_always_inline int i_zend_verify_type_assignable_zval(
3153 		zend_type *type_ptr, zend_class_entry *self_ce, zval *zv, zend_bool strict) {
3154 	zend_type type = *type_ptr;
3155 	zend_uchar type_code;
3156 	zend_uchar zv_type = Z_TYPE_P(zv);
3157 
3158 	if (ZEND_TYPE_ALLOW_NULL(type) && zv_type == IS_NULL) {
3159 		return 1;
3160 	}
3161 
3162 	if (ZEND_TYPE_IS_CLASS(type)) {
3163 		if (!ZEND_TYPE_IS_CE(type)) {
3164 			if (!zend_resolve_class_type(type_ptr, self_ce)) {
3165 				return 0;
3166 			}
3167 			type = *type_ptr;
3168 		}
3169 		return zv_type == IS_OBJECT && instanceof_function(Z_OBJCE_P(zv), ZEND_TYPE_CE(type));
3170 	}
3171 
3172 	type_code = ZEND_TYPE_CODE(type);
3173 	if (type_code == zv_type ||
3174 			(type_code == _IS_BOOL && (zv_type == IS_FALSE || zv_type == IS_TRUE))) {
3175 		return 1;
3176 	}
3177 
3178 	if (type_code == IS_ITERABLE) {
3179 		return zend_is_iterable(zv);
3180 	}
3181 
3182 	/* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
3183 	if (strict) {
3184 		if (type_code == IS_DOUBLE && zv_type == IS_LONG) {
3185 			return -1;
3186 		}
3187 		return 0;
3188 	}
3189 
3190 	/* No weak conversions for arrays and objects */
3191 	if (type_code == IS_ARRAY || type_code == IS_OBJECT) {
3192 		return 0;
3193 	}
3194 
3195 	/* NULL may be accepted only by nullable hints (this is already checked) */
3196 	if (zv_type == IS_NULL) {
3197 		return 0;
3198 	}
3199 
3200 	/* Coercion may be necessary, check separately */
3201 	return -1;
3202 }
3203 
zend_verify_ref_assignable_zval(zend_reference * ref,zval * zv,zend_bool strict)3204 ZEND_API zend_bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference *ref, zval *zv, zend_bool strict)
3205 {
3206 	zend_property_info *prop;
3207 
3208 	/* The value must satisfy each property type, and coerce to the same value for each property
3209 	 * type. Right now, the latter rule means that *if* coercion is necessary, then all types
3210 	 * must be the same (modulo nullability). To handle this, remember the first type we see and
3211 	 * compare against it when coercion becomes necessary. */
3212 	zend_property_info *seen_prop = NULL;
3213 	zend_uchar seen_type;
3214 	zend_bool needs_coercion = 0;
3215 
3216 	ZEND_ASSERT(Z_TYPE_P(zv) != IS_REFERENCE);
3217 	ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3218 		int result = i_zend_verify_type_assignable_zval(&prop->type, prop->ce, zv, strict);
3219 		if (result == 0) {
3220 			zend_throw_ref_type_error_zval(prop, zv);
3221 			return 0;
3222 		}
3223 
3224 		if (result < 0) {
3225 			needs_coercion = 1;
3226 		}
3227 
3228 		if (!seen_prop) {
3229 			seen_prop = prop;
3230 			seen_type = ZEND_TYPE_IS_CLASS(prop->type) ? IS_OBJECT : ZEND_TYPE_CODE(prop->type);
3231 		} else if (needs_coercion && seen_type != ZEND_TYPE_CODE(prop->type)) {
3232 			zend_throw_conflicting_coercion_error(seen_prop, prop, zv);
3233 			return 0;
3234 		}
3235 	} ZEND_REF_FOREACH_TYPE_SOURCES_END();
3236 
3237 	if (UNEXPECTED(needs_coercion && !zend_verify_weak_scalar_type_hint(seen_type, zv))) {
3238 		zend_throw_ref_type_error_zval(seen_prop, zv);
3239 		return 0;
3240 	}
3241 
3242 	return 1;
3243 }
3244 
i_zval_ptr_dtor_noref(zval * zval_ptr)3245 static zend_always_inline void i_zval_ptr_dtor_noref(zval *zval_ptr) {
3246 	if (Z_REFCOUNTED_P(zval_ptr)) {
3247 		zend_refcounted *ref = Z_COUNTED_P(zval_ptr);
3248 		ZEND_ASSERT(Z_TYPE_P(zval_ptr) != IS_REFERENCE);
3249 		if (!GC_DELREF(ref)) {
3250 			rc_dtor_func(ref);
3251 		} else if (UNEXPECTED(GC_MAY_LEAK(ref))) {
3252 			gc_possible_root(ref);
3253 		}
3254 	}
3255 }
3256 
zend_assign_to_typed_ref(zval * variable_ptr,zval * orig_value,zend_uchar value_type,zend_bool strict,zend_refcounted * ref)3257 ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, zend_uchar value_type, zend_bool strict, zend_refcounted *ref)
3258 {
3259 	zend_bool ret;
3260 	zval value;
3261 	ZVAL_COPY(&value, orig_value);
3262 	ret = zend_verify_ref_assignable_zval(Z_REF_P(variable_ptr), &value, strict);
3263 	variable_ptr = Z_REFVAL_P(variable_ptr);
3264 	if (EXPECTED(ret)) {
3265 		i_zval_ptr_dtor_noref(variable_ptr);
3266 		ZVAL_COPY_VALUE(variable_ptr, &value);
3267 	} else {
3268 		zval_ptr_dtor_nogc(&value);
3269 	}
3270 	if (value_type & (IS_VAR|IS_TMP_VAR)) {
3271 		if (UNEXPECTED(ref)) {
3272 			if (UNEXPECTED(GC_DELREF(ref) == 0)) {
3273 				zval_ptr_dtor(orig_value);
3274 				efree_size(ref, sizeof(zend_reference));
3275 			}
3276 		} else {
3277 			i_zval_ptr_dtor_noref(orig_value);
3278 		}
3279 	}
3280 	return variable_ptr;
3281 }
3282 
zend_verify_prop_assignable_by_ref(zend_property_info * prop_info,zval * orig_val,zend_bool strict)3283 ZEND_API zend_bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref(zend_property_info *prop_info, zval *orig_val, zend_bool strict) {
3284 	zval *val = orig_val;
3285 	if (Z_ISREF_P(val) && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(val))) {
3286 		int result;
3287 
3288 		val = Z_REFVAL_P(val);
3289 		result = i_zend_verify_type_assignable_zval(&prop_info->type, prop_info->ce, val, strict);
3290 		if (result > 0) {
3291 			return 1;
3292 		}
3293 
3294 		if (result < 0) {
3295 			zend_property_info *ref_prop = ZEND_REF_FIRST_SOURCE(Z_REF_P(orig_val));
3296 			if (ZEND_TYPE_CODE(prop_info->type) != ZEND_TYPE_CODE(ref_prop->type)) {
3297 				/* Invalid due to conflicting coercion */
3298 				zend_throw_ref_type_error_type(ref_prop, prop_info, val);
3299 				return 0;
3300 			}
3301 			if (zend_verify_weak_scalar_type_hint(ZEND_TYPE_CODE(prop_info->type), val)) {
3302 				return 1;
3303 			}
3304 		}
3305 	} else {
3306 		ZVAL_DEREF(val);
3307 		if (i_zend_check_property_type(prop_info, val, strict)) {
3308 			return 1;
3309 		}
3310 	}
3311 
3312 	zend_verify_property_type_error(prop_info, val);
3313 	return 0;
3314 }
3315 
zend_ref_add_type_source(zend_property_info_source_list * source_list,zend_property_info * prop)3316 ZEND_API void ZEND_FASTCALL zend_ref_add_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
3317 {
3318 	zend_property_info_list *list;
3319 	if (source_list->ptr == NULL) {
3320 		source_list->ptr = prop;
3321 		return;
3322 	}
3323 
3324 	list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3325 	if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3326 		list = emalloc(sizeof(zend_property_info_list) + (4 - 1) * sizeof(zend_property_info *));
3327 		list->ptr[0] = source_list->ptr;
3328 		list->num_allocated = 4;
3329 		list->num = 1;
3330 	} else if (list->num_allocated == list->num) {
3331 		list->num_allocated = list->num * 2;
3332 		list = erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *));
3333 	}
3334 
3335 	list->ptr[list->num++] = prop;
3336 	source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(list);
3337 }
3338 
zend_ref_del_type_source(zend_property_info_source_list * source_list,zend_property_info * prop)3339 ZEND_API void ZEND_FASTCALL zend_ref_del_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
3340 {
3341 	zend_property_info_list *list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3342 	zend_property_info **ptr, **end;
3343 
3344 	if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3345 		ZEND_ASSERT(source_list->ptr == prop);
3346 		source_list->ptr = NULL;
3347 		return;
3348 	}
3349 
3350 	if (list->num == 1) {
3351 		ZEND_ASSERT(*list->ptr == prop);
3352 		efree(list);
3353 		source_list->ptr = NULL;
3354 		return;
3355 	}
3356 
3357 	/* Checking against end here to get a more graceful failure mode if we missed adding a type
3358 	 * source at some point. */
3359 	ptr = list->ptr;
3360 	end = ptr + list->num;
3361 	while (ptr < end && *ptr != prop) {
3362 		ptr++;
3363 	}
3364 	ZEND_ASSERT(*ptr == prop);
3365 
3366 	/* Copy the last list element into the deleted slot. */
3367 	*ptr = list->ptr[--list->num];
3368 
3369 	if (list->num >= 4 && list->num * 4 == list->num_allocated) {
3370 		list->num_allocated = list->num * 2;
3371 		source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *)));
3372 	}
3373 }
3374 
zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)3375 static zend_never_inline void zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)
3376 {
3377 	zval *result = EX_VAR(opline->result.var);
3378 
3379 	switch (type) {
3380 		case BP_VAR_R:
3381 			if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3382 				ZVAL_OBJ(result, Z_OBJ(EX(This)));
3383 				Z_ADDREF_P(result);
3384 			} else {
3385 				ZVAL_NULL(result);
3386 				zend_error(E_NOTICE,"Undefined variable: this");
3387 			}
3388 			break;
3389 		case BP_VAR_IS:
3390 			if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3391 				ZVAL_OBJ(result, Z_OBJ(EX(This)));
3392 				Z_ADDREF_P(result);
3393 			} else {
3394 				ZVAL_NULL(result);
3395 			}
3396 			break;
3397 		case BP_VAR_RW:
3398 		case BP_VAR_W:
3399 			ZVAL_UNDEF(result);
3400 			zend_throw_error(NULL, "Cannot re-assign $this");
3401 			break;
3402 		case BP_VAR_UNSET:
3403 			ZVAL_UNDEF(result);
3404 			zend_throw_error(NULL, "Cannot unset $this");
3405 			break;
3406 		EMPTY_SWITCH_DEFAULT_CASE()
3407 	}
3408 }
3409 
zend_wrong_clone_call(zend_function * clone,zend_class_entry * scope)3410 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_clone_call(zend_function *clone, zend_class_entry *scope)
3411 {
3412 	zend_throw_error(NULL, "Call to %s %s::__clone() from context '%s'", zend_visibility_string(clone->common.fn_flags), ZSTR_VAL(clone->common.scope->name), scope ? ZSTR_VAL(scope->name) : "");
3413 }
3414 
3415 #if ZEND_INTENSIVE_DEBUGGING
3416 
3417 #define CHECK_SYMBOL_TABLES()													\
3418 	zend_hash_apply(&EG(symbol_table), zend_check_symbol);			\
3419 	if (&EG(symbol_table)!=EX(symbol_table)) {							\
3420 		zend_hash_apply(EX(symbol_table), zend_check_symbol);	\
3421 	}
3422 
zend_check_symbol(zval * pz)3423 static int zend_check_symbol(zval *pz)
3424 {
3425 	if (Z_TYPE_P(pz) == IS_INDIRECT) {
3426 		pz = Z_INDIRECT_P(pz);
3427 	}
3428 	if (Z_TYPE_P(pz) > 10) {
3429 		fprintf(stderr, "Warning!  %x has invalid type!\n", *pz);
3430 /* See http://support.microsoft.com/kb/190351 */
3431 #ifdef ZEND_WIN32
3432 		fflush(stderr);
3433 #endif
3434 	} else if (Z_TYPE_P(pz) == IS_ARRAY) {
3435 		zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol);
3436 	} else if (Z_TYPE_P(pz) == IS_OBJECT) {
3437 		/* OBJ-TBI - doesn't support new object model! */
3438 		zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol);
3439 	}
3440 
3441 	return 0;
3442 }
3443 
3444 
3445 #else
3446 #define CHECK_SYMBOL_TABLES()
3447 #endif
3448 
execute_internal(zend_execute_data * execute_data,zval * return_value)3449 ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value)
3450 {
3451 	execute_data->func->internal_function.handler(execute_data, return_value);
3452 }
3453 
zend_clean_and_cache_symbol_table(zend_array * symbol_table)3454 ZEND_API void zend_clean_and_cache_symbol_table(zend_array *symbol_table) /* {{{ */
3455 {
3456 	/* Clean before putting into the cache, since clean could call dtors,
3457 	 * which could use the cached hash. Also do this before the check for
3458 	 * available cache slots, as those may be used by a dtor as well. */
3459 	zend_symtable_clean(symbol_table);
3460 	if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
3461 		zend_array_destroy(symbol_table);
3462 	} else {
3463 		*(EG(symtable_cache_ptr)++) = symbol_table;
3464 	}
3465 }
3466 /* }}} */
3467 
i_free_compiled_variables(zend_execute_data * execute_data)3468 static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3469 {
3470 	zval *cv = EX_VAR_NUM(0);
3471 	int count = EX(func)->op_array.last_var;
3472 	while (EXPECTED(count != 0)) {
3473 		if (Z_REFCOUNTED_P(cv)) {
3474 			zend_refcounted *r = Z_COUNTED_P(cv);
3475 			if (!GC_DELREF(r)) {
3476 				ZVAL_NULL(cv);
3477 				rc_dtor_func(r);
3478 			} else {
3479 				gc_check_possible_root(r);
3480 			}
3481 		}
3482 		cv++;
3483 		count--;
3484 	}
3485 }
3486 /* }}} */
3487 
zend_free_compiled_variables(zend_execute_data * execute_data)3488 ZEND_API void zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3489 {
3490 	i_free_compiled_variables(execute_data);
3491 }
3492 /* }}} */
3493 
3494 #define ZEND_VM_INTERRUPT_CHECK() do { \
3495 		if (UNEXPECTED(EG(vm_interrupt))) { \
3496 			ZEND_VM_INTERRUPT(); \
3497 		} \
3498 	} while (0)
3499 
3500 #define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \
3501 		if (UNEXPECTED(EG(vm_interrupt))) { \
3502 			ZEND_VM_LOOP_INTERRUPT(); \
3503 		} \
3504 	} while (0)
3505 
3506 /*
3507  * Stack Frame Layout (the whole stack frame is allocated at once)
3508  * ==================
3509  *
3510  *                             +========================================+
3511  * EG(current_execute_data) -> | zend_execute_data                      |
3512  *                             +----------------------------------------+
3513  *     EX_VAR_NUM(0) --------> | VAR[0] = ARG[1]                        |
3514  *                             | ...                                    |
3515  *                             | VAR[op_array->num_args-1] = ARG[N]     |
3516  *                             | ...                                    |
3517  *                             | VAR[op_array->last_var-1]              |
3518  *                             | VAR[op_array->last_var] = TMP[0]       |
3519  *                             | ...                                    |
3520  *                             | VAR[op_array->last_var+op_array->T-1]  |
3521  *                             | ARG[N+1] (extra_args)                  |
3522  *                             | ...                                    |
3523  *                             +----------------------------------------+
3524  */
3525 
3526 /* zend_copy_extra_args is used when the actually passed number of arguments
3527  * (EX_NUM_ARGS) is greater than what the function defined (op_array->num_args).
3528  *
3529  * The extra arguments will be copied into the call frame after all the compiled variables.
3530  *
3531  * If there are extra arguments copied, a flag "ZEND_CALL_FREE_EXTRA_ARGS" will be set
3532  * on the zend_execute_data, and when the executor leaves the function, the
3533  * args will be freed in zend_leave_helper.
3534  */
zend_copy_extra_args(EXECUTE_DATA_D)3535 static zend_never_inline void zend_copy_extra_args(EXECUTE_DATA_D)
3536 {
3537 	zend_op_array *op_array = &EX(func)->op_array;
3538 	uint32_t first_extra_arg = op_array->num_args;
3539 	uint32_t num_args = EX_NUM_ARGS();
3540 	zval *src;
3541 	size_t delta;
3542 	uint32_t count;
3543 	uint32_t type_flags = 0;
3544 
3545 	if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
3546 		/* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
3547 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3548 		opline += first_extra_arg;
3549 #else
3550 		EX(opline) += first_extra_arg;
3551 #endif
3552 
3553 	}
3554 
3555 	/* move extra args into separate array after all CV and TMP vars */
3556 	src = EX_VAR_NUM(num_args - 1);
3557 	delta = op_array->last_var + op_array->T - first_extra_arg;
3558 	count = num_args - first_extra_arg;
3559 	if (EXPECTED(delta != 0)) {
3560 		delta *= sizeof(zval);
3561 		do {
3562 			type_flags |= Z_TYPE_INFO_P(src);
3563 			ZVAL_COPY_VALUE((zval*)(((char*)src) + delta), src);
3564 			ZVAL_UNDEF(src);
3565 			src--;
3566 		} while (--count);
3567 		if (Z_TYPE_INFO_REFCOUNTED(type_flags)) {
3568 			ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3569 		}
3570 	} else {
3571 		do {
3572 			if (Z_REFCOUNTED_P(src)) {
3573 				ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3574 				break;
3575 			}
3576 			src--;
3577 		} while (--count);
3578 	}
3579 }
3580 
zend_init_cvs(uint32_t first,uint32_t last EXECUTE_DATA_DC)3581 static zend_always_inline void zend_init_cvs(uint32_t first, uint32_t last EXECUTE_DATA_DC)
3582 {
3583 	if (EXPECTED(first < last)) {
3584 		uint32_t count = last - first;
3585 		zval *var = EX_VAR_NUM(first);
3586 
3587 		do {
3588 			ZVAL_UNDEF(var);
3589 			var++;
3590 		} while (--count);
3591 	}
3592 }
3593 
i_init_func_execute_data(zend_op_array * op_array,zval * return_value,zend_bool may_be_trampoline EXECUTE_DATA_DC)3594 static zend_always_inline void i_init_func_execute_data(zend_op_array *op_array, zval *return_value, zend_bool may_be_trampoline EXECUTE_DATA_DC) /* {{{ */
3595 {
3596 	uint32_t first_extra_arg, num_args;
3597 	ZEND_ASSERT(EX(func) == (zend_function*)op_array);
3598 
3599 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3600 	opline = op_array->opcodes;
3601 #else
3602 	EX(opline) = op_array->opcodes;
3603 #endif
3604 	EX(call) = NULL;
3605 	EX(return_value) = return_value;
3606 
3607 	/* Handle arguments */
3608 	first_extra_arg = op_array->num_args;
3609 	num_args = EX_NUM_ARGS();
3610 	if (UNEXPECTED(num_args > first_extra_arg)) {
3611 		if (!may_be_trampoline || EXPECTED(!(op_array->fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE))) {
3612 			zend_copy_extra_args(EXECUTE_DATA_C);
3613 		}
3614 	} else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
3615 		/* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
3616 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3617 		opline += num_args;
3618 #else
3619 		EX(opline) += num_args;
3620 #endif
3621 	}
3622 
3623 	/* Initialize CV variables (skip arguments) */
3624 	zend_init_cvs(num_args, op_array->last_var EXECUTE_DATA_CC);
3625 
3626 	EX(run_time_cache) = RUN_TIME_CACHE(op_array);
3627 
3628 	EG(current_execute_data) = execute_data;
3629 }
3630 /* }}} */
3631 
init_func_run_time_cache_i(zend_op_array * op_array)3632 static zend_always_inline void init_func_run_time_cache_i(zend_op_array *op_array) /* {{{ */
3633 {
3634 	void **run_time_cache;
3635 
3636 	ZEND_ASSERT(RUN_TIME_CACHE(op_array) == NULL);
3637 	run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
3638 	memset(run_time_cache, 0, op_array->cache_size);
3639 	ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
3640 }
3641 /* }}} */
3642 
init_func_run_time_cache(zend_op_array * op_array)3643 static zend_never_inline void ZEND_FASTCALL init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
3644 {
3645 	init_func_run_time_cache_i(op_array);
3646 }
3647 /* }}} */
3648 
zend_fetch_function(zend_string * name)3649 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function(zend_string *name) /* {{{ */
3650 {
3651 	zval *zv = zend_hash_find(EG(function_table), name);
3652 
3653 	if (EXPECTED(zv != NULL)) {
3654 		zend_function *fbc = Z_FUNC_P(zv);
3655 
3656 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
3657 			init_func_run_time_cache_i(&fbc->op_array);
3658 		}
3659 		return fbc;
3660 	}
3661 	return NULL;
3662 } /* }}} */
3663 
zend_fetch_function_str(const char * name,size_t len)3664 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name, size_t len) /* {{{ */
3665 {
3666 	zval *zv = zend_hash_str_find(EG(function_table), name, len);
3667 
3668 	if (EXPECTED(zv != NULL)) {
3669 		zend_function *fbc = Z_FUNC_P(zv);
3670 
3671 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
3672 			init_func_run_time_cache_i(&fbc->op_array);
3673 		}
3674 		return fbc;
3675 	}
3676 	return NULL;
3677 } /* }}} */
3678 
zend_init_func_run_time_cache(zend_op_array * op_array)3679 ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
3680 {
3681 	if (!RUN_TIME_CACHE(op_array)) {
3682 		init_func_run_time_cache_i(op_array);
3683 	}
3684 } /* }}} */
3685 
i_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3686 static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3687 {
3688 	ZEND_ASSERT(EX(func) == (zend_function*)op_array);
3689 
3690 	EX(opline) = op_array->opcodes;
3691 	EX(call) = NULL;
3692 	EX(return_value) = return_value;
3693 
3694 	zend_attach_symbol_table(execute_data);
3695 
3696 	if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
3697 		void *ptr;
3698 
3699 		ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
3700 		ptr = emalloc(op_array->cache_size + sizeof(void*));
3701 		ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
3702 		ptr = (char*)ptr + sizeof(void*);
3703 		ZEND_MAP_PTR_SET(op_array->run_time_cache, ptr);
3704 		memset(ptr, 0, op_array->cache_size);
3705 	}
3706 	EX(run_time_cache) = RUN_TIME_CACHE(op_array);
3707 
3708 	EG(current_execute_data) = execute_data;
3709 }
3710 /* }}} */
3711 
zend_init_func_execute_data(zend_execute_data * ex,zend_op_array * op_array,zval * return_value)3712 ZEND_API void zend_init_func_execute_data(zend_execute_data *ex, zend_op_array *op_array, zval *return_value) /* {{{ */
3713 {
3714 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3715 	zend_execute_data *orig_execute_data = execute_data;
3716 #endif
3717 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3718 	const zend_op *orig_opline = opline;
3719 #endif
3720 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3721 	execute_data = ex;
3722 #else
3723 	zend_execute_data *execute_data = ex;
3724 #endif
3725 
3726 	EX(prev_execute_data) = EG(current_execute_data);
3727 	if (!RUN_TIME_CACHE(op_array)) {
3728 		init_func_run_time_cache(op_array);
3729 	}
3730 	i_init_func_execute_data(op_array, return_value, 1 EXECUTE_DATA_CC);
3731 
3732 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3733     EX(opline) = opline;
3734 	opline = orig_opline;
3735 #endif
3736 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3737 	execute_data = orig_execute_data;
3738 #endif
3739 }
3740 /* }}} */
3741 
zend_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3742 ZEND_API void zend_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3743 {
3744 	EX(prev_execute_data) = EG(current_execute_data);
3745 	i_init_code_execute_data(execute_data, op_array, return_value);
3746 }
3747 /* }}} */
3748 
zend_init_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3749 ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3750 {
3751 	if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
3752 		zend_init_code_execute_data(execute_data, op_array, return_value);
3753 	} else {
3754 		zend_init_func_execute_data(execute_data, op_array, return_value);
3755 	}
3756 }
3757 /* }}} */
3758 
zend_vm_stack_copy_call_frame(zend_execute_data * call,uint32_t passed_args,uint32_t additional_args)3759 static zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
3760 {
3761 	zend_execute_data *new_call;
3762 	int used_stack = (EG(vm_stack_top) - (zval*)call) + additional_args;
3763 
3764 	/* copy call frame into new stack segment */
3765 	new_call = zend_vm_stack_extend(used_stack * sizeof(zval));
3766 	*new_call = *call;
3767 	ZEND_ADD_CALL_FLAG(new_call, ZEND_CALL_ALLOCATED);
3768 
3769 	if (passed_args) {
3770 		zval *src = ZEND_CALL_ARG(call, 1);
3771 		zval *dst = ZEND_CALL_ARG(new_call, 1);
3772 		do {
3773 			ZVAL_COPY_VALUE(dst, src);
3774 			passed_args--;
3775 			src++;
3776 			dst++;
3777 		} while (passed_args);
3778 	}
3779 
3780 	/* delete old call_frame from previous stack segment */
3781 	EG(vm_stack)->prev->top = (zval*)call;
3782 
3783 	/* delete previous stack segment if it became empty */
3784 	if (UNEXPECTED(EG(vm_stack)->prev->top == ZEND_VM_STACK_ELEMENTS(EG(vm_stack)->prev))) {
3785 		zend_vm_stack r = EG(vm_stack)->prev;
3786 
3787 		EG(vm_stack)->prev = r->prev;
3788 		efree(r);
3789 	}
3790 
3791 	return new_call;
3792 }
3793 /* }}} */
3794 
zend_vm_stack_extend_call_frame(zend_execute_data ** call,uint32_t passed_args,uint32_t additional_args)3795 static zend_always_inline void zend_vm_stack_extend_call_frame(zend_execute_data **call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
3796 {
3797 	if (EXPECTED((uint32_t)(EG(vm_stack_end) - EG(vm_stack_top)) > additional_args)) {
3798 		EG(vm_stack_top) += additional_args;
3799 	} else {
3800 		*call = zend_vm_stack_copy_call_frame(*call, passed_args, additional_args);
3801 	}
3802 }
3803 /* }}} */
3804 
zend_get_running_generator(EXECUTE_DATA_D)3805 static zend_always_inline zend_generator *zend_get_running_generator(EXECUTE_DATA_D) /* {{{ */
3806 {
3807 	/* The generator object is stored in EX(return_value) */
3808 	zend_generator *generator = (zend_generator *) EX(return_value);
3809 	/* However control may currently be delegated to another generator.
3810 	 * That's the one we're interested in. */
3811 	return generator;
3812 }
3813 /* }}} */
3814 
cleanup_unfinished_calls(zend_execute_data * execute_data,uint32_t op_num)3815 static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
3816 {
3817 	if (UNEXPECTED(EX(call))) {
3818 		zend_execute_data *call = EX(call);
3819 		zend_op *opline = EX(func)->op_array.opcodes + op_num;
3820 		int level;
3821 		int do_exit;
3822 
3823 		if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
3824 			opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
3825 			opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
3826 			opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
3827 			opline->opcode == ZEND_INIT_USER_CALL ||
3828 			opline->opcode == ZEND_INIT_METHOD_CALL ||
3829 			opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
3830 			opline->opcode == ZEND_NEW)) {
3831 			ZEND_ASSERT(op_num);
3832 			opline--;
3833 		}
3834 
3835 		do {
3836 			/* If the exception was thrown during a function call there might be
3837 			 * arguments pushed to the stack that have to be dtor'ed. */
3838 
3839 			/* find the number of actually passed arguments */
3840 			level = 0;
3841 			do_exit = 0;
3842 			do {
3843 				switch (opline->opcode) {
3844 					case ZEND_DO_FCALL:
3845 					case ZEND_DO_ICALL:
3846 					case ZEND_DO_UCALL:
3847 					case ZEND_DO_FCALL_BY_NAME:
3848 						level++;
3849 						break;
3850 					case ZEND_INIT_FCALL:
3851 					case ZEND_INIT_FCALL_BY_NAME:
3852 					case ZEND_INIT_NS_FCALL_BY_NAME:
3853 					case ZEND_INIT_DYNAMIC_CALL:
3854 					case ZEND_INIT_USER_CALL:
3855 					case ZEND_INIT_METHOD_CALL:
3856 					case ZEND_INIT_STATIC_METHOD_CALL:
3857 					case ZEND_NEW:
3858 						if (level == 0) {
3859 							ZEND_CALL_NUM_ARGS(call) = 0;
3860 							do_exit = 1;
3861 						}
3862 						level--;
3863 						break;
3864 					case ZEND_SEND_VAL:
3865 					case ZEND_SEND_VAL_EX:
3866 					case ZEND_SEND_VAR:
3867 					case ZEND_SEND_VAR_EX:
3868 					case ZEND_SEND_FUNC_ARG:
3869 					case ZEND_SEND_REF:
3870 					case ZEND_SEND_VAR_NO_REF:
3871 					case ZEND_SEND_VAR_NO_REF_EX:
3872 					case ZEND_SEND_USER:
3873 						if (level == 0) {
3874 							ZEND_CALL_NUM_ARGS(call) = opline->op2.num;
3875 							do_exit = 1;
3876 						}
3877 						break;
3878 					case ZEND_SEND_ARRAY:
3879 					case ZEND_SEND_UNPACK:
3880 						if (level == 0) {
3881 							do_exit = 1;
3882 						}
3883 						break;
3884 				}
3885 				if (!do_exit) {
3886 					opline--;
3887 				}
3888 			} while (!do_exit);
3889 			if (call->prev_execute_data) {
3890 				/* skip current call region */
3891 				level = 0;
3892 				do_exit = 0;
3893 				do {
3894 					switch (opline->opcode) {
3895 						case ZEND_DO_FCALL:
3896 						case ZEND_DO_ICALL:
3897 						case ZEND_DO_UCALL:
3898 						case ZEND_DO_FCALL_BY_NAME:
3899 							level++;
3900 							break;
3901 						case ZEND_INIT_FCALL:
3902 						case ZEND_INIT_FCALL_BY_NAME:
3903 						case ZEND_INIT_NS_FCALL_BY_NAME:
3904 						case ZEND_INIT_DYNAMIC_CALL:
3905 						case ZEND_INIT_USER_CALL:
3906 						case ZEND_INIT_METHOD_CALL:
3907 						case ZEND_INIT_STATIC_METHOD_CALL:
3908 						case ZEND_NEW:
3909 							if (level == 0) {
3910 								do_exit = 1;
3911 							}
3912 							level--;
3913 							break;
3914 					}
3915 					opline--;
3916 				} while (!do_exit);
3917 			}
3918 
3919 			zend_vm_stack_free_args(EX(call));
3920 
3921 			if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
3922 				OBJ_RELEASE(Z_OBJ(call->This));
3923 			}
3924 			if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
3925 				zend_object_release(ZEND_CLOSURE_OBJECT(call->func));
3926 			} else if (call->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
3927 				zend_string_release_ex(call->func->common.function_name, 0);
3928 				zend_free_trampoline(call->func);
3929 			}
3930 
3931 			EX(call) = call->prev_execute_data;
3932 			zend_vm_stack_free_call_frame(call);
3933 			call = EX(call);
3934 		} while (call);
3935 	}
3936 }
3937 /* }}} */
3938 
find_live_range(const zend_op_array * op_array,uint32_t op_num,uint32_t var_num)3939 static const zend_live_range *find_live_range(const zend_op_array *op_array, uint32_t op_num, uint32_t var_num) /* {{{ */
3940 {
3941 	int i;
3942 	for (i = 0; i < op_array->last_live_range; i++) {
3943 		const zend_live_range *range = &op_array->live_range[i];
3944 		if (op_num >= range->start && op_num < range->end
3945 				&& var_num == (range->var & ~ZEND_LIVE_MASK)) {
3946 			return range;
3947 		}
3948 	}
3949 	return NULL;
3950 }
3951 /* }}} */
3952 
cleanup_live_vars(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)3953 static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
3954 {
3955 	int i;
3956 
3957 	for (i = 0; i < EX(func)->op_array.last_live_range; i++) {
3958 		const zend_live_range *range = &EX(func)->op_array.live_range[i];
3959 		if (range->start > op_num) {
3960 			/* further blocks will not be relevant... */
3961 			break;
3962 		} else if (op_num < range->end) {
3963 			if (!catch_op_num || catch_op_num >= range->end) {
3964 				uint32_t kind = range->var & ZEND_LIVE_MASK;
3965 				uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
3966 				zval *var = EX_VAR(var_num);
3967 
3968 				if (kind == ZEND_LIVE_TMPVAR) {
3969 					zval_ptr_dtor_nogc(var);
3970 				} else if (kind == ZEND_LIVE_NEW) {
3971 					zend_object *obj;
3972 					ZEND_ASSERT(Z_TYPE_P(var) == IS_OBJECT);
3973 					obj = Z_OBJ_P(var);
3974 					zend_object_store_ctor_failed(obj);
3975 					OBJ_RELEASE(obj);
3976 				} else if (kind == ZEND_LIVE_LOOP) {
3977 					if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
3978 						zend_hash_iterator_del(Z_FE_ITER_P(var));
3979 					}
3980 					zval_ptr_dtor_nogc(var);
3981 				} else if (kind == ZEND_LIVE_ROPE) {
3982 					zend_string **rope = (zend_string **)var;
3983 					zend_op *last = EX(func)->op_array.opcodes + op_num;
3984 					while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT)
3985 							|| last->result.var != var_num) {
3986 						ZEND_ASSERT(last >= EX(func)->op_array.opcodes);
3987 						last--;
3988 					}
3989 					if (last->opcode == ZEND_ROPE_INIT) {
3990 						zend_string_release_ex(*rope, 0);
3991 					} else {
3992 						int j = last->extended_value;
3993 						do {
3994 							zend_string_release_ex(rope[j], 0);
3995 						} while (j--);
3996 					}
3997 				} else if (kind == ZEND_LIVE_SILENCE) {
3998 					/* restore previous error_reporting value */
3999 					if (!EG(error_reporting) && Z_LVAL_P(var) != 0) {
4000 						EG(error_reporting) = Z_LVAL_P(var);
4001 					}
4002 				}
4003 			}
4004 		}
4005 	}
4006 }
4007 /* }}} */
4008 
zend_cleanup_unfinished_execution(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)4009 ZEND_API void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
4010 	cleanup_unfinished_calls(execute_data, op_num);
4011 	cleanup_live_vars(execute_data, op_num, catch_op_num);
4012 }
4013 
4014 #if ZEND_VM_SPEC
zend_swap_operands(zend_op * op)4015 static void zend_swap_operands(zend_op *op) /* {{{ */
4016 {
4017 	znode_op     tmp;
4018 	zend_uchar   tmp_type;
4019 
4020 	tmp          = op->op1;
4021 	tmp_type     = op->op1_type;
4022 	op->op1      = op->op2;
4023 	op->op1_type = op->op2_type;
4024 	op->op2      = tmp;
4025 	op->op2_type = tmp_type;
4026 }
4027 /* }}} */
4028 #endif
4029 
zend_init_dynamic_call_string(zend_string * function,uint32_t num_args)4030 static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_string *function, uint32_t num_args) /* {{{ */
4031 {
4032 	zend_function *fbc;
4033 	zval *func;
4034 	zend_class_entry *called_scope;
4035 	zend_string *lcname;
4036 	const char *colon;
4037 
4038 	if ((colon = zend_memrchr(ZSTR_VAL(function), ':', ZSTR_LEN(function))) != NULL &&
4039 		colon > ZSTR_VAL(function) &&
4040 		*(colon-1) == ':'
4041 	) {
4042 		zend_string *mname;
4043 		size_t cname_length = colon - ZSTR_VAL(function) - 1;
4044 		size_t mname_length = ZSTR_LEN(function) - cname_length - (sizeof("::") - 1);
4045 
4046 		lcname = zend_string_init(ZSTR_VAL(function), cname_length, 0);
4047 
4048 		called_scope = zend_fetch_class_by_name(lcname, NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4049 		if (UNEXPECTED(called_scope == NULL)) {
4050 			zend_string_release_ex(lcname, 0);
4051 			return NULL;
4052 		}
4053 
4054 		mname = zend_string_init(ZSTR_VAL(function) + (cname_length + sizeof("::") - 1), mname_length, 0);
4055 
4056 		if (called_scope->get_static_method) {
4057 			fbc = called_scope->get_static_method(called_scope, mname);
4058 		} else {
4059 			fbc = zend_std_get_static_method(called_scope, mname, NULL);
4060 		}
4061 		if (UNEXPECTED(fbc == NULL)) {
4062 			if (EXPECTED(!EG(exception))) {
4063 				zend_undefined_method(called_scope, mname);
4064 			}
4065 			zend_string_release_ex(lcname, 0);
4066 			zend_string_release_ex(mname, 0);
4067 			return NULL;
4068 		}
4069 
4070 		zend_string_release_ex(lcname, 0);
4071 		zend_string_release_ex(mname, 0);
4072 
4073 		if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
4074 			zend_non_static_method_call(fbc);
4075 			if (UNEXPECTED(EG(exception) != NULL)) {
4076 				return NULL;
4077 			}
4078 		}
4079 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4080 			init_func_run_time_cache(&fbc->op_array);
4081 		}
4082 	} else {
4083 		if (ZSTR_VAL(function)[0] == '\\') {
4084 			lcname = zend_string_alloc(ZSTR_LEN(function) - 1, 0);
4085 			zend_str_tolower_copy(ZSTR_VAL(lcname), ZSTR_VAL(function) + 1, ZSTR_LEN(function) - 1);
4086 		} else {
4087 			lcname = zend_string_tolower(function);
4088 		}
4089 		if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {
4090 			zend_throw_error(NULL, "Call to undefined function %s()", ZSTR_VAL(function));
4091 			zend_string_release_ex(lcname, 0);
4092 			return NULL;
4093 		}
4094 		zend_string_release_ex(lcname, 0);
4095 
4096 		fbc = Z_FUNC_P(func);
4097 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4098 			init_func_run_time_cache(&fbc->op_array);
4099 		}
4100 		called_scope = NULL;
4101 	}
4102 
4103 	return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC,
4104 		fbc, num_args, called_scope);
4105 }
4106 /* }}} */
4107 
zend_init_dynamic_call_object(zval * function,uint32_t num_args)4108 static zend_never_inline zend_execute_data *zend_init_dynamic_call_object(zval *function, uint32_t num_args) /* {{{ */
4109 {
4110 	zend_function *fbc;
4111 	void *object_or_called_scope;
4112 	zend_class_entry *called_scope;
4113 	zend_object *object;
4114 	uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4115 
4116 	if (EXPECTED(Z_OBJ_HANDLER_P(function, get_closure)) &&
4117 	    EXPECTED(Z_OBJ_HANDLER_P(function, get_closure)(function, &called_scope, &fbc, &object) == SUCCESS)) {
4118 
4119 	    object_or_called_scope = called_scope;
4120 		if (fbc->common.fn_flags & ZEND_ACC_CLOSURE) {
4121 			/* Delay closure destruction until its invocation */
4122 			GC_ADDREF(ZEND_CLOSURE_OBJECT(fbc));
4123 			call_info |= ZEND_CALL_CLOSURE;
4124 			if (fbc->common.fn_flags & ZEND_ACC_FAKE_CLOSURE) {
4125 				call_info |= ZEND_CALL_FAKE_CLOSURE;
4126 			}
4127 			if (object) {
4128 				call_info |= ZEND_CALL_HAS_THIS;
4129 				object_or_called_scope = object;
4130 			}
4131 		} else if (object) {
4132 			call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4133 			GC_ADDREF(object); /* For $this pointer */
4134 			object_or_called_scope = object;
4135 		}
4136 	} else {
4137 		zend_throw_error(NULL, "Function name must be a string");
4138 		return NULL;
4139 	}
4140 
4141 	if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4142 		init_func_run_time_cache(&fbc->op_array);
4143 	}
4144 
4145 	return zend_vm_stack_push_call_frame(call_info,
4146 		fbc, num_args, object_or_called_scope);
4147 }
4148 /* }}} */
4149 
zend_init_dynamic_call_array(zend_array * function,uint32_t num_args)4150 static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_array *function, uint32_t num_args) /* {{{ */
4151 {
4152 	zend_function *fbc;
4153 	void *object_or_called_scope;
4154 	uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4155 
4156 	if (zend_hash_num_elements(function) == 2) {
4157 		zval *obj;
4158 		zval *method;
4159 		obj = zend_hash_index_find(function, 0);
4160 		method = zend_hash_index_find(function, 1);
4161 
4162 		if (UNEXPECTED(!obj) || UNEXPECTED(!method)) {
4163 			zend_throw_error(NULL, "Array callback has to contain indices 0 and 1");
4164 			return NULL;
4165 		}
4166 
4167 		ZVAL_DEREF(obj);
4168 		if (UNEXPECTED(Z_TYPE_P(obj) != IS_STRING) && UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
4169 			zend_throw_error(NULL, "First array member is not a valid class name or object");
4170 			return NULL;
4171 		}
4172 
4173 		ZVAL_DEREF(method);
4174 		if (UNEXPECTED(Z_TYPE_P(method) != IS_STRING)) {
4175 			zend_throw_error(NULL, "Second array member is not a valid method");
4176 			return NULL;
4177 		}
4178 
4179 		if (Z_TYPE_P(obj) == IS_STRING) {
4180 			zend_class_entry *called_scope = zend_fetch_class_by_name(Z_STR_P(obj), NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4181 
4182 			if (UNEXPECTED(called_scope == NULL)) {
4183 				return NULL;
4184 			}
4185 
4186 			if (called_scope->get_static_method) {
4187 				fbc = called_scope->get_static_method(called_scope, Z_STR_P(method));
4188 			} else {
4189 				fbc = zend_std_get_static_method(called_scope, Z_STR_P(method), NULL);
4190 			}
4191 			if (UNEXPECTED(fbc == NULL)) {
4192 				if (EXPECTED(!EG(exception))) {
4193 					zend_undefined_method(called_scope, Z_STR_P(method));
4194 				}
4195 				return NULL;
4196 			}
4197 			if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
4198 				zend_non_static_method_call(fbc);
4199 				if (UNEXPECTED(EG(exception) != NULL)) {
4200 					return NULL;
4201 				}
4202 			}
4203 			object_or_called_scope = called_scope;
4204 		} else {
4205 			zend_object *object = Z_OBJ_P(obj);
4206 
4207 			fbc = Z_OBJ_HT_P(obj)->get_method(&object, Z_STR_P(method), NULL);
4208 			if (UNEXPECTED(fbc == NULL)) {
4209 				if (EXPECTED(!EG(exception))) {
4210 					zend_undefined_method(object->ce, Z_STR_P(method));
4211 				}
4212 				return NULL;
4213 			}
4214 
4215 			if ((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
4216 				object_or_called_scope = object->ce;
4217 			} else {
4218 				call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4219 				GC_ADDREF(object); /* For $this pointer */
4220 				object_or_called_scope = object;
4221 			}
4222 		}
4223 	} else {
4224 		zend_throw_error(NULL, "Function name must be a string");
4225 		return NULL;
4226 	}
4227 
4228 	if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4229 		init_func_run_time_cache(&fbc->op_array);
4230 	}
4231 
4232 	return zend_vm_stack_push_call_frame(call_info,
4233 		fbc, num_args, object_or_called_scope);
4234 }
4235 /* }}} */
4236 
4237 #define ZEND_FAKE_OP_ARRAY ((zend_op_array*)(zend_intptr_t)-1)
4238 
zend_include_or_eval(zval * inc_filename,int type)4239 static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval *inc_filename, int type) /* {{{ */
4240 {
4241 	zend_op_array *new_op_array = NULL;
4242 	zval tmp_inc_filename;
4243 
4244 	ZVAL_UNDEF(&tmp_inc_filename);
4245 	if (Z_TYPE_P(inc_filename) != IS_STRING) {
4246 		zend_string *tmp = zval_try_get_string_func(inc_filename);
4247 
4248 		if (UNEXPECTED(!tmp)) {
4249 			return NULL;
4250 		}
4251 		ZVAL_STR(&tmp_inc_filename, tmp);
4252 		inc_filename = &tmp_inc_filename;
4253 	}
4254 
4255 	switch (type) {
4256 		case ZEND_INCLUDE_ONCE:
4257 		case ZEND_REQUIRE_ONCE: {
4258 				zend_file_handle file_handle;
4259 				zend_string *resolved_path;
4260 
4261 				resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename));
4262 				if (EXPECTED(resolved_path)) {
4263 					if (zend_hash_exists(&EG(included_files), resolved_path)) {
4264 						goto already_compiled;
4265 					}
4266 				} else if (UNEXPECTED(EG(exception))) {
4267 					break;
4268 				} else if (UNEXPECTED(strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename))) {
4269 					zend_message_dispatcher(
4270 						(type == ZEND_INCLUDE_ONCE) ?
4271 							ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4272 							Z_STRVAL_P(inc_filename));
4273 					break;
4274 				} else {
4275 					resolved_path = zend_string_copy(Z_STR_P(inc_filename));
4276 				}
4277 
4278 				if (SUCCESS == zend_stream_open(ZSTR_VAL(resolved_path), &file_handle)) {
4279 
4280 					if (!file_handle.opened_path) {
4281 						file_handle.opened_path = zend_string_copy(resolved_path);
4282 					}
4283 
4284 					if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path)) {
4285 						zend_op_array *op_array = zend_compile_file(&file_handle, (type==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE));
4286 						zend_destroy_file_handle(&file_handle);
4287 						zend_string_release_ex(resolved_path, 0);
4288 						if (Z_TYPE(tmp_inc_filename) != IS_UNDEF) {
4289 							zval_ptr_dtor_str(&tmp_inc_filename);
4290 						}
4291 						return op_array;
4292 					} else {
4293 						zend_file_handle_dtor(&file_handle);
4294 already_compiled:
4295 						new_op_array = ZEND_FAKE_OP_ARRAY;
4296 					}
4297 				} else {
4298 					zend_message_dispatcher(
4299 						(type == ZEND_INCLUDE_ONCE) ?
4300 							ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4301 							Z_STRVAL_P(inc_filename));
4302 				}
4303 				zend_string_release_ex(resolved_path, 0);
4304 			}
4305 			break;
4306 		case ZEND_INCLUDE:
4307 		case ZEND_REQUIRE:
4308 			if (UNEXPECTED(strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename))) {
4309 				zend_message_dispatcher(
4310 					(type == ZEND_INCLUDE) ?
4311 						ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4312 						Z_STRVAL_P(inc_filename));
4313 				break;
4314 			}
4315 			new_op_array = compile_filename(type, inc_filename);
4316 			break;
4317 		case ZEND_EVAL: {
4318 				char *eval_desc = zend_make_compiled_string_description("eval()'d code");
4319 				new_op_array = zend_compile_string(inc_filename, eval_desc);
4320 				efree(eval_desc);
4321 			}
4322 			break;
4323 		EMPTY_SWITCH_DEFAULT_CASE()
4324 	}
4325 
4326 	if (Z_TYPE(tmp_inc_filename) != IS_UNDEF) {
4327 		zval_ptr_dtor_str(&tmp_inc_filename);
4328 	}
4329 	return new_op_array;
4330 }
4331 /* }}} */
4332 
zend_do_fcall_overloaded(zend_execute_data * call,zval * ret)4333 static ZEND_COLD int ZEND_FASTCALL zend_do_fcall_overloaded(zend_execute_data *call, zval *ret) /* {{{ */
4334 {
4335 	zend_function *fbc = call->func;
4336 	zend_object *object;
4337 
4338 	/* Not sure what should be done here if it's a static method */
4339 	if (UNEXPECTED(Z_TYPE(call->This) != IS_OBJECT)) {
4340 		zend_vm_stack_free_args(call);
4341 		if (fbc->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) {
4342 			zend_string_release_ex(fbc->common.function_name, 0);
4343 		}
4344 		efree(fbc);
4345 		zend_vm_stack_free_call_frame(call);
4346 
4347 		zend_throw_error(NULL, "Cannot call overloaded function for non-object");
4348 		return 0;
4349 	}
4350 
4351 	object = Z_OBJ(call->This);
4352 
4353 	ZVAL_NULL(ret);
4354 
4355 	EG(current_execute_data) = call;
4356 	object->handlers->call_method(fbc->common.function_name, object, call, ret);
4357 	EG(current_execute_data) = call->prev_execute_data;
4358 
4359 	zend_vm_stack_free_args(call);
4360 
4361 	if (fbc->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY) {
4362 		zend_string_release_ex(fbc->common.function_name, 0);
4363 	}
4364 	efree(fbc);
4365 
4366 	return 1;
4367 }
4368 /* }}} */
4369 
zend_fe_reset_iterator(zval * array_ptr,int by_ref OPLINE_DC EXECUTE_DATA_DC)4370 static zend_never_inline zend_bool ZEND_FASTCALL zend_fe_reset_iterator(zval *array_ptr, int by_ref OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4371 {
4372 	zend_class_entry *ce = Z_OBJCE_P(array_ptr);
4373 	zend_object_iterator *iter = ce->get_iterator(ce, array_ptr, by_ref);
4374 	zend_bool is_empty;
4375 
4376 	if (UNEXPECTED(!iter) || UNEXPECTED(EG(exception))) {
4377 		if (iter) {
4378 			OBJ_RELEASE(&iter->std);
4379 		}
4380 		if (!EG(exception)) {
4381 			zend_throw_exception_ex(NULL, 0, "Object of type %s did not create an Iterator", ZSTR_VAL(ce->name));
4382 		}
4383 		ZVAL_UNDEF(EX_VAR(opline->result.var));
4384 		return 1;
4385 	}
4386 
4387 	iter->index = 0;
4388 	if (iter->funcs->rewind) {
4389 		iter->funcs->rewind(iter);
4390 		if (UNEXPECTED(EG(exception) != NULL)) {
4391 			OBJ_RELEASE(&iter->std);
4392 			ZVAL_UNDEF(EX_VAR(opline->result.var));
4393 			return 1;
4394 		}
4395 	}
4396 
4397 	is_empty = iter->funcs->valid(iter) != SUCCESS;
4398 
4399 	if (UNEXPECTED(EG(exception) != NULL)) {
4400 		OBJ_RELEASE(&iter->std);
4401 		ZVAL_UNDEF(EX_VAR(opline->result.var));
4402 		return 1;
4403 	}
4404 	iter->index = -1; /* will be set to 0 before using next handler */
4405 
4406 	ZVAL_OBJ(EX_VAR(opline->result.var), &iter->std);
4407 	Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
4408 
4409 	return is_empty;
4410 }
4411 /* }}} */
4412 
_zend_quick_get_constant(const zval * key,uint32_t flags,int check_defined_only OPLINE_DC EXECUTE_DATA_DC)4413 static zend_always_inline int _zend_quick_get_constant(
4414 		const zval *key, uint32_t flags, int check_defined_only OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4415 {
4416 	zval *zv;
4417 	const zval *orig_key = key;
4418 	zend_constant *c = NULL;
4419 
4420 	zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4421 	if (zv) {
4422 		c = (zend_constant*)Z_PTR_P(zv);
4423 	} else {
4424 		key++;
4425 		zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4426 		if (zv && (ZEND_CONSTANT_FLAGS((zend_constant*)Z_PTR_P(zv)) & CONST_CS) == 0) {
4427 			c = (zend_constant*)Z_PTR_P(zv);
4428 		} else {
4429 			if ((flags & (IS_CONSTANT_IN_NAMESPACE|IS_CONSTANT_UNQUALIFIED)) == (IS_CONSTANT_IN_NAMESPACE|IS_CONSTANT_UNQUALIFIED)) {
4430 				key++;
4431 				zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4432 				if (zv) {
4433 					c = (zend_constant*)Z_PTR_P(zv);
4434 				} else {
4435 				    key++;
4436 					zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4437 					if (zv && (ZEND_CONSTANT_FLAGS((zend_constant*)Z_PTR_P(zv)) & CONST_CS) == 0) {
4438 						c = (zend_constant*)Z_PTR_P(zv);
4439 					}
4440 				}
4441 			}
4442 		}
4443 	}
4444 
4445 	if (!c) {
4446 		if (!check_defined_only) {
4447 			if ((opline->op1.num & IS_CONSTANT_UNQUALIFIED) != 0) {
4448 				char *actual = (char *)zend_memrchr(Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)), '\\', Z_STRLEN_P(RT_CONSTANT(opline, opline->op2)));
4449 				if (!actual) {
4450 					ZVAL_STR_COPY(EX_VAR(opline->result.var), Z_STR_P(RT_CONSTANT(opline, opline->op2)));
4451 				} else {
4452 					actual++;
4453 					ZVAL_STRINGL(EX_VAR(opline->result.var),
4454 							actual, Z_STRLEN_P(RT_CONSTANT(opline, opline->op2)) - (actual - Z_STRVAL_P(RT_CONSTANT(opline, opline->op2))));
4455 				}
4456 				/* non-qualified constant - allow text substitution */
4457 				zend_error(E_WARNING, "Use of undefined constant %s - assumed '%s' (this will throw an Error in a future version of PHP)",
4458 						Z_STRVAL_P(EX_VAR(opline->result.var)), Z_STRVAL_P(EX_VAR(opline->result.var)));
4459 			} else {
4460 				zend_throw_error(NULL, "Undefined constant '%s'", Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
4461 				ZVAL_UNDEF(EX_VAR(opline->result.var));
4462 			}
4463 		}
4464 		return FAILURE;
4465 	}
4466 
4467 	if (!check_defined_only) {
4468 		ZVAL_COPY_OR_DUP(EX_VAR(opline->result.var), &c->value);
4469 		if (!(ZEND_CONSTANT_FLAGS(c) & (CONST_CS|CONST_CT_SUBST))) {
4470 			const char *ns_sep;
4471 			size_t shortname_offset;
4472 			size_t shortname_len;
4473 			zend_bool is_deprecated;
4474 
4475 			if (flags & IS_CONSTANT_UNQUALIFIED) {
4476 				const zval *access_key;
4477 
4478 				if (!(flags & IS_CONSTANT_IN_NAMESPACE)) {
4479 					access_key = orig_key - 1;
4480 				} else {
4481 					if (key < orig_key + 2) {
4482 						goto check_short_name;
4483 					} else {
4484 						access_key = orig_key + 2;
4485 					}
4486 				}
4487 				is_deprecated = !zend_string_equals(c->name, Z_STR_P(access_key));
4488 			} else {
4489 check_short_name:
4490 				/* Namespaces are always case-insensitive. Only compare shortname. */
4491 				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
4492 				if (ns_sep) {
4493 					shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
4494 					shortname_len = ZSTR_LEN(c->name) - shortname_offset;
4495 				} else {
4496 					shortname_offset = 0;
4497 					shortname_len = ZSTR_LEN(c->name);
4498 				}
4499 
4500 				is_deprecated = memcmp(ZSTR_VAL(c->name) + shortname_offset, Z_STRVAL_P(orig_key - 1) + shortname_offset, shortname_len) != 0;
4501 			}
4502 
4503 			if (is_deprecated) {
4504 				zend_error(E_DEPRECATED,
4505 					"Case-insensitive constants are deprecated. "
4506 					"The correct casing for this constant is \"%s\"",
4507 					ZSTR_VAL(c->name));
4508 				return SUCCESS;
4509 			}
4510 		}
4511 	}
4512 
4513 	CACHE_PTR(opline->extended_value, c);
4514 	return SUCCESS;
4515 }
4516 /* }}} */
4517 
zend_quick_get_constant(const zval * key,uint32_t flags OPLINE_DC EXECUTE_DATA_DC)4518 static zend_never_inline void ZEND_FASTCALL zend_quick_get_constant(
4519 		const zval *key, uint32_t flags OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4520 {
4521 	_zend_quick_get_constant(key, flags, 0 OPLINE_CC EXECUTE_DATA_CC);
4522 } /* }}} */
4523 
zend_quick_check_constant(const zval * key OPLINE_DC EXECUTE_DATA_DC)4524 static zend_never_inline int ZEND_FASTCALL zend_quick_check_constant(
4525 		const zval *key OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4526 {
4527 	return _zend_quick_get_constant(key, 0, 1 OPLINE_CC EXECUTE_DATA_CC);
4528 } /* }}} */
4529 
4530 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4531 /* Special versions of functions that sets EX(opline) before calling zend_vm_stack_extend() */
_zend_vm_stack_push_call_frame_ex(uint32_t used_stack,uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)4532 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame_ex(uint32_t used_stack, uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
4533 {
4534 	zend_execute_data *call = (zend_execute_data*)EG(vm_stack_top);
4535 
4536 	ZEND_ASSERT_VM_STACK_GLOBAL;
4537 
4538 	if (UNEXPECTED(used_stack > (size_t)(((char*)EG(vm_stack_end)) - (char*)call))) {
4539 		EX(opline) = opline; /* this is the only difference */
4540 		call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
4541 		ZEND_ASSERT_VM_STACK_GLOBAL;
4542 		zend_vm_init_call_frame(call, call_info | ZEND_CALL_ALLOCATED, func, num_args, object_or_called_scope);
4543 		return call;
4544 	} else {
4545 		EG(vm_stack_top) = (zval*)((char*)call + used_stack);
4546 		zend_vm_init_call_frame(call, call_info, func, num_args, object_or_called_scope);
4547 		return call;
4548 	}
4549 } /* }}} */
4550 
_zend_vm_stack_push_call_frame(uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)4551 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame(uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
4552 {
4553 	uint32_t used_stack = zend_vm_calc_used_stack(num_args, func);
4554 
4555 	return _zend_vm_stack_push_call_frame_ex(used_stack, call_info,
4556 		func, num_args, object_or_called_scope);
4557 } /* }}} */
4558 #else
4559 # define _zend_vm_stack_push_call_frame_ex zend_vm_stack_push_call_frame_ex
4560 # define _zend_vm_stack_push_call_frame    zend_vm_stack_push_call_frame
4561 #endif
4562 
4563 #ifdef ZEND_VM_TRACE_HANDLERS
4564 # include "zend_vm_trace_handlers.h"
4565 #elif defined(ZEND_VM_TRACE_MAP)
4566 # include "zend_vm_trace_map.h"
4567 #endif
4568 
4569 #define ZEND_VM_NEXT_OPCODE_EX(check_exception, skip) \
4570 	CHECK_SYMBOL_TABLES() \
4571 	if (check_exception) { \
4572 		OPLINE = EX(opline) + (skip); \
4573 	} else { \
4574 		ZEND_ASSERT(!EG(exception)); \
4575 		OPLINE = opline + (skip); \
4576 	} \
4577 	ZEND_VM_CONTINUE()
4578 
4579 #define ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION() \
4580 	ZEND_VM_NEXT_OPCODE_EX(1, 1)
4581 
4582 #define ZEND_VM_NEXT_OPCODE() \
4583 	ZEND_VM_NEXT_OPCODE_EX(0, 1)
4584 
4585 #define ZEND_VM_SET_NEXT_OPCODE(new_op) \
4586 	CHECK_SYMBOL_TABLES() \
4587 	OPLINE = new_op
4588 
4589 #define ZEND_VM_SET_OPCODE(new_op) \
4590 	CHECK_SYMBOL_TABLES() \
4591 	OPLINE = new_op; \
4592 	ZEND_VM_INTERRUPT_CHECK()
4593 
4594 #define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
4595 	ZEND_VM_SET_OPCODE(ZEND_OFFSET_TO_OPLINE(opline, offset))
4596 
4597 #define ZEND_VM_JMP_EX(new_op, check_exception) do { \
4598 		if (check_exception && UNEXPECTED(EG(exception))) { \
4599 			HANDLE_EXCEPTION(); \
4600 		} \
4601 		ZEND_VM_SET_OPCODE(new_op); \
4602 		ZEND_VM_CONTINUE(); \
4603 	} while (0)
4604 
4605 #define ZEND_VM_JMP(new_op) \
4606 	ZEND_VM_JMP_EX(new_op, 1)
4607 
4608 #define ZEND_VM_INC_OPCODE() \
4609 	OPLINE++
4610 
4611 
4612 #ifndef VM_SMART_OPCODES
4613 # define VM_SMART_OPCODES 1
4614 #endif
4615 
4616 #if VM_SMART_OPCODES
4617 # define ZEND_VM_REPEATABLE_OPCODE \
4618 	do {
4619 # define ZEND_VM_REPEAT_OPCODE(_opcode) \
4620 	} while (UNEXPECTED((++opline)->opcode == _opcode)); \
4621 	OPLINE = opline; \
4622 	ZEND_VM_CONTINUE()
4623 # define ZEND_VM_SMART_BRANCH(_result, _check) do { \
4624 		if ((_check) && UNEXPECTED(EG(exception))) { \
4625 			break; \
4626 		} \
4627 		if (EXPECTED((opline+1)->opcode == ZEND_JMPZ)) { \
4628 			if (_result) { \
4629 				ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4630 			} else { \
4631 				ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4632 			} \
4633 		} else if (EXPECTED((opline+1)->opcode == ZEND_JMPNZ)) { \
4634 			if (!(_result)) { \
4635 				ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4636 			} else { \
4637 				ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4638 			} \
4639 		} else { \
4640 			break; \
4641 		} \
4642 		ZEND_VM_CONTINUE(); \
4643 	} while (0)
4644 # define ZEND_VM_SMART_BRANCH_JMPZ(_result, _check) do { \
4645 		if ((_check) && UNEXPECTED(EG(exception))) { \
4646 			break; \
4647 		} \
4648 		if (_result) { \
4649 			ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4650 		} else { \
4651 			ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4652 		} \
4653 		ZEND_VM_CONTINUE(); \
4654 	} while (0)
4655 # define ZEND_VM_SMART_BRANCH_JMPNZ(_result, _check) do { \
4656 		if ((_check) && UNEXPECTED(EG(exception))) { \
4657 			break; \
4658 		} \
4659 		if (!(_result)) { \
4660 			ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4661 		} else { \
4662 			ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4663 		} \
4664 		ZEND_VM_CONTINUE(); \
4665 	} while (0)
4666 #define ZEND_VM_SMART_BRANCH_TRUE() do { \
4667 		if (EXPECTED((opline+1)->opcode == ZEND_JMPNZ)) { \
4668 			ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4669 			ZEND_VM_CONTINUE(); \
4670 		} else if (EXPECTED((opline+1)->opcode == ZEND_JMPZ)) { \
4671 			ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4672 			ZEND_VM_CONTINUE(); \
4673 		} \
4674 	} while (0)
4675 #define ZEND_VM_SMART_BRANCH_TRUE_JMPZ() do { \
4676 		ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4677 		ZEND_VM_CONTINUE(); \
4678 	} while (0)
4679 #define ZEND_VM_SMART_BRANCH_TRUE_JMPNZ() do { \
4680 		ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4681 		ZEND_VM_CONTINUE(); \
4682 	} while (0)
4683 #define ZEND_VM_SMART_BRANCH_FALSE() do { \
4684 		if (EXPECTED((opline+1)->opcode == ZEND_JMPNZ)) { \
4685 			ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4686 			ZEND_VM_CONTINUE(); \
4687 		} else if (EXPECTED((opline+1)->opcode == ZEND_JMPZ)) { \
4688 			ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4689 			ZEND_VM_CONTINUE(); \
4690 		} \
4691 	} while (0)
4692 #define ZEND_VM_SMART_BRANCH_FALSE_JMPZ() do { \
4693 		ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4694 		ZEND_VM_CONTINUE(); \
4695 	} while (0)
4696 #define ZEND_VM_SMART_BRANCH_FALSE_JMPNZ() do { \
4697 		ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4698 		ZEND_VM_CONTINUE(); \
4699 	} while (0)
4700 #else
4701 # define ZEND_VM_REPEATABLE_OPCODE
4702 # define ZEND_VM_REPEAT_OPCODE(_opcode)
4703 # define ZEND_VM_SMART_BRANCH(_result, _check)
4704 # define ZEND_VM_SMART_BRANCH_JMPZ(_result, _check)
4705 # define ZEND_VM_SMART_BRANCH_JMPNZ(_result, _check)
4706 # define ZEND_VM_SMART_BRANCH_TRUE()
4707 # define ZEND_VM_SMART_BRANCH_FALSE()
4708 #endif
4709 
4710 #ifdef __GNUC__
4711 # define ZEND_VM_GUARD(name) __asm__("#" #name)
4712 #else
4713 # define ZEND_VM_GUARD(name)
4714 #endif
4715 
4716 #define UNDEF_RESULT() do { \
4717 		if (opline->result_type & (IS_VAR | IS_TMP_VAR)) { \
4718 			ZVAL_UNDEF(EX_VAR(opline->result.var)); \
4719 		} \
4720 	} while (0)
4721 
4722 #include "zend_vm_execute.h"
4723 
zend_set_user_opcode_handler(zend_uchar opcode,user_opcode_handler_t handler)4724 ZEND_API int zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
4725 {
4726 	if (opcode != ZEND_USER_OPCODE) {
4727 		if (handler == NULL) {
4728 			/* restore the original handler */
4729 			zend_user_opcodes[opcode] = opcode;
4730 		} else {
4731 			zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
4732 		}
4733 		zend_user_opcode_handlers[opcode] = handler;
4734 		return SUCCESS;
4735 	}
4736 	return FAILURE;
4737 }
4738 
zend_get_user_opcode_handler(zend_uchar opcode)4739 ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
4740 {
4741 	return zend_user_opcode_handlers[opcode];
4742 }
4743 
zend_get_zval_ptr(const zend_op * opline,int op_type,const znode_op * node,const zend_execute_data * execute_data,zend_free_op * should_free,int type)4744 ZEND_API zval *zend_get_zval_ptr(const zend_op *opline, int op_type, const znode_op *node, const zend_execute_data *execute_data, zend_free_op *should_free, int type)
4745 {
4746 	zval *ret;
4747 
4748 	switch (op_type) {
4749 		case IS_CONST:
4750 			ret = RT_CONSTANT(opline, *node);
4751 			*should_free = NULL;
4752 			break;
4753 		case IS_TMP_VAR:
4754 		case IS_VAR:
4755 			ret = EX_VAR(node->var);
4756 			*should_free = ret;
4757 			break;
4758 		case IS_CV:
4759 			ret = EX_VAR(node->var);
4760 			*should_free = NULL;
4761 			break;
4762 		default:
4763 			ret = NULL;
4764 			*should_free = ret;
4765 			break;
4766 	}
4767 	return ret;
4768 }
4769