1 /*
2 +----------------------------------------------------------------------+
3 | Zend Engine |
4 +----------------------------------------------------------------------+
5 | Copyright (c) Zend Technologies Ltd. (http://www.zend.com) |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 2.00 of the Zend license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.zend.com/license/2_00.txt. |
11 | If you did not receive a copy of the Zend license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@zend.com so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Andi Gutmans <andi@php.net> |
16 | Zeev Suraski <zeev@php.net> |
17 | Dmitry Stogov <dmitry@php.net> |
18 +----------------------------------------------------------------------+
19 */
20
21 #define ZEND_INTENSIVE_DEBUGGING 0
22
23 #include <stdio.h>
24 #include <signal.h>
25
26 #include "zend.h"
27 #include "zend_compile.h"
28 #include "zend_execute.h"
29 #include "zend_API.h"
30 #include "zend_ptr_stack.h"
31 #include "zend_constants.h"
32 #include "zend_extensions.h"
33 #include "zend_ini.h"
34 #include "zend_exceptions.h"
35 #include "zend_interfaces.h"
36 #include "zend_closures.h"
37 #include "zend_generators.h"
38 #include "zend_vm.h"
39 #include "zend_dtrace.h"
40 #include "zend_inheritance.h"
41 #include "zend_type_info.h"
42 #include "zend_smart_str.h"
43 #include "zend_observer.h"
44 #include "zend_system_id.h"
45
46 /* Virtual current working directory support */
47 #include "zend_virtual_cwd.h"
48
49 #ifdef HAVE_GCC_GLOBAL_REGS
50 # if defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(i386)
51 # define ZEND_VM_FP_GLOBAL_REG "%esi"
52 # define ZEND_VM_IP_GLOBAL_REG "%edi"
53 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__x86_64__)
54 # define ZEND_VM_FP_GLOBAL_REG "%r14"
55 # define ZEND_VM_IP_GLOBAL_REG "%r15"
56 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
57 # define ZEND_VM_FP_GLOBAL_REG "r14"
58 # define ZEND_VM_IP_GLOBAL_REG "r15"
59 # elif defined(__IBMC__) && ZEND_GCC_VERSION >= 4002 && defined(__powerpc64__)
60 # define ZEND_VM_FP_GLOBAL_REG "r14"
61 # define ZEND_VM_IP_GLOBAL_REG "r15"
62 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
63 # define ZEND_VM_FP_GLOBAL_REG "x27"
64 # define ZEND_VM_IP_GLOBAL_REG "x28"
65 # endif
66 #endif
67
68 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
69 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
70 register zend_execute_data* volatile execute_data __asm__(ZEND_VM_FP_GLOBAL_REG);
71 # pragma GCC diagnostic warning "-Wvolatile-register-var"
72 #endif
73
74 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
75 # define EXECUTE_DATA_D void
76 # define EXECUTE_DATA_C
77 # define EXECUTE_DATA_DC
78 # define EXECUTE_DATA_CC
79 # define NO_EXECUTE_DATA_CC
80 #else
81 # define EXECUTE_DATA_D zend_execute_data* execute_data
82 # define EXECUTE_DATA_C execute_data
83 # define EXECUTE_DATA_DC , EXECUTE_DATA_D
84 # define EXECUTE_DATA_CC , EXECUTE_DATA_C
85 # define NO_EXECUTE_DATA_CC , NULL
86 #endif
87
88 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
89 # define OPLINE_D void
90 # define OPLINE_C
91 # define OPLINE_DC
92 # define OPLINE_CC
93 #else
94 # define OPLINE_D const zend_op* opline
95 # define OPLINE_C opline
96 # define OPLINE_DC , OPLINE_D
97 # define OPLINE_CC , OPLINE_C
98 #endif
99
100 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
101 # pragma GCC diagnostic ignored "-Wvolatile-register-var"
102 register const zend_op* volatile opline __asm__(ZEND_VM_IP_GLOBAL_REG);
103 # pragma GCC diagnostic warning "-Wvolatile-register-var"
104 #else
105 #endif
106
107 #define _CONST_CODE 0
108 #define _TMP_CODE 1
109 #define _VAR_CODE 2
110 #define _UNUSED_CODE 3
111 #define _CV_CODE 4
112
113 typedef int (ZEND_FASTCALL *incdec_t)(zval *);
114
115 #define get_zval_ptr(op_type, node, type) _get_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
116 #define get_zval_ptr_deref(op_type, node, type) _get_zval_ptr_deref(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
117 #define get_zval_ptr_undef(op_type, node, type) _get_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
118 #define get_op_data_zval_ptr_r(op_type, node) _get_op_data_zval_ptr_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
119 #define get_op_data_zval_ptr_deref_r(op_type, node) _get_op_data_zval_ptr_deref_r(op_type, node EXECUTE_DATA_CC OPLINE_CC)
120 #define get_zval_ptr_ptr(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
121 #define get_zval_ptr_ptr_undef(op_type, node, type) _get_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
122 #define get_obj_zval_ptr(op_type, node, type) _get_obj_zval_ptr(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
123 #define get_obj_zval_ptr_undef(op_type, node, type) _get_obj_zval_ptr_undef(op_type, node, type EXECUTE_DATA_CC OPLINE_CC)
124 #define get_obj_zval_ptr_ptr(op_type, node, type) _get_obj_zval_ptr_ptr(op_type, node, type EXECUTE_DATA_CC)
125
126 #define RETURN_VALUE_USED(opline) ((opline)->result_type != IS_UNUSED)
127
ZEND_FUNCTION(pass)128 static ZEND_FUNCTION(pass)
129 {
130 }
131
132 ZEND_BEGIN_ARG_INFO_EX(zend_pass_function_arg_info, 0, 0, 0)
133 ZEND_END_ARG_INFO()
134
135 ZEND_API const zend_internal_function zend_pass_function = {
136 ZEND_INTERNAL_FUNCTION, /* type */
137 {0, 0, 0}, /* arg_flags */
138 0, /* fn_flags */
139 NULL, /* name */
140 NULL, /* scope */
141 NULL, /* prototype */
142 0, /* num_args */
143 0, /* required_num_args */
144 (zend_internal_arg_info *) zend_pass_function_arg_info + 1, /* arg_info */
145 NULL, /* attributes */
146 ZEND_FN(pass), /* handler */
147 NULL, /* module */
148 {NULL,NULL,NULL,NULL} /* reserved */
149 };
150
151 #define FREE_VAR_PTR_AND_EXTRACT_RESULT_IF_NECESSARY(free_var) do { \
152 zval *__container_to_free = EX_VAR(free_var); \
153 if (UNEXPECTED(Z_REFCOUNTED_P(__container_to_free))) { \
154 zend_refcounted *__ref = Z_COUNTED_P(__container_to_free); \
155 if (UNEXPECTED(!GC_DELREF(__ref))) { \
156 zval *__zv = EX_VAR(opline->result.var); \
157 if (EXPECTED(Z_TYPE_P(__zv) == IS_INDIRECT)) { \
158 ZVAL_COPY(__zv, Z_INDIRECT_P(__zv)); \
159 } \
160 rc_dtor_func(__ref); \
161 } \
162 } \
163 } while (0)
164
165 #define FREE_OP(type, var) \
166 if ((type) & (IS_TMP_VAR|IS_VAR)) { \
167 zval_ptr_dtor_nogc(EX_VAR(var)); \
168 }
169
170 #define FREE_OP_VAR_PTR(type, var) \
171 FREE_OP(type, var)
172
173 #define CV_DEF_OF(i) (EX(func)->op_array.vars[i])
174
175 #define ZEND_VM_STACK_PAGE_SLOTS (16 * 1024) /* should be a power of 2 */
176
177 #define ZEND_VM_STACK_PAGE_SIZE (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))
178
179 #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
180 (((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
181 + ((page_size) - 1)) & ~((page_size) - 1))
182
zend_vm_stack_new_page(size_t size,zend_vm_stack prev)183 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
184 zend_vm_stack page = (zend_vm_stack)emalloc(size);
185
186 page->top = ZEND_VM_STACK_ELEMENTS(page);
187 page->end = (zval*)((char*)page + size);
188 page->prev = prev;
189 return page;
190 }
191
zend_vm_stack_init(void)192 ZEND_API void zend_vm_stack_init(void)
193 {
194 EG(vm_stack_page_size) = ZEND_VM_STACK_PAGE_SIZE;
195 EG(vm_stack) = zend_vm_stack_new_page(ZEND_VM_STACK_PAGE_SIZE, NULL);
196 EG(vm_stack_top) = EG(vm_stack)->top;
197 EG(vm_stack_end) = EG(vm_stack)->end;
198 }
199
zend_vm_stack_init_ex(size_t page_size)200 ZEND_API void zend_vm_stack_init_ex(size_t page_size)
201 {
202 /* page_size must be a power of 2 */
203 ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
204 EG(vm_stack_page_size) = page_size;
205 EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
206 EG(vm_stack_top) = EG(vm_stack)->top;
207 EG(vm_stack_end) = EG(vm_stack)->end;
208 }
209
zend_vm_stack_destroy(void)210 ZEND_API void zend_vm_stack_destroy(void)
211 {
212 zend_vm_stack stack = EG(vm_stack);
213
214 while (stack != NULL) {
215 zend_vm_stack p = stack->prev;
216 efree(stack);
217 stack = p;
218 }
219 }
220
zend_vm_stack_extend(size_t size)221 ZEND_API void* zend_vm_stack_extend(size_t size)
222 {
223 zend_vm_stack stack;
224 void *ptr;
225
226 stack = EG(vm_stack);
227 stack->top = EG(vm_stack_top);
228 EG(vm_stack) = stack = zend_vm_stack_new_page(
229 EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
230 EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
231 stack);
232 ptr = stack->top;
233 EG(vm_stack_top) = (void*)(((char*)ptr) + size);
234 EG(vm_stack_end) = stack->end;
235 return ptr;
236 }
237
zend_get_compiled_variable_value(const zend_execute_data * execute_data,uint32_t var)238 ZEND_API zval* zend_get_compiled_variable_value(const zend_execute_data *execute_data, uint32_t var)
239 {
240 return EX_VAR(var);
241 }
242
_get_zval_ptr_tmp(uint32_t var EXECUTE_DATA_DC)243 static zend_always_inline zval *_get_zval_ptr_tmp(uint32_t var EXECUTE_DATA_DC)
244 {
245 zval *ret = EX_VAR(var);
246
247 ZEND_ASSERT(Z_TYPE_P(ret) != IS_REFERENCE);
248
249 return ret;
250 }
251
_get_zval_ptr_var(uint32_t var EXECUTE_DATA_DC)252 static zend_always_inline zval *_get_zval_ptr_var(uint32_t var EXECUTE_DATA_DC)
253 {
254 zval *ret = EX_VAR(var);
255
256 return ret;
257 }
258
_get_zval_ptr_var_deref(uint32_t var EXECUTE_DATA_DC)259 static zend_always_inline zval *_get_zval_ptr_var_deref(uint32_t var EXECUTE_DATA_DC)
260 {
261 zval *ret = EX_VAR(var);
262
263 ZVAL_DEREF(ret);
264 return ret;
265 }
266
zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)267 static zend_never_inline ZEND_COLD zval* zval_undefined_cv(uint32_t var EXECUTE_DATA_DC)
268 {
269 if (EXPECTED(EG(exception) == NULL)) {
270 zend_string *cv = CV_DEF_OF(EX_VAR_TO_NUM(var));
271 zend_error(E_WARNING, "Undefined variable $%s", ZSTR_VAL(cv));
272 }
273 return &EG(uninitialized_zval);
274 }
275
_zval_undefined_op1(EXECUTE_DATA_D)276 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op1(EXECUTE_DATA_D)
277 {
278 return zval_undefined_cv(EX(opline)->op1.var EXECUTE_DATA_CC);
279 }
280
_zval_undefined_op2(EXECUTE_DATA_D)281 static zend_never_inline ZEND_COLD zval* ZEND_FASTCALL _zval_undefined_op2(EXECUTE_DATA_D)
282 {
283 return zval_undefined_cv(EX(opline)->op2.var EXECUTE_DATA_CC);
284 }
285
286 #define ZVAL_UNDEFINED_OP1() _zval_undefined_op1(EXECUTE_DATA_C)
287 #define ZVAL_UNDEFINED_OP2() _zval_undefined_op2(EXECUTE_DATA_C)
288
_get_zval_cv_lookup(zval * ptr,uint32_t var,int type EXECUTE_DATA_DC)289 static zend_never_inline ZEND_COLD zval *_get_zval_cv_lookup(zval *ptr, uint32_t var, int type EXECUTE_DATA_DC)
290 {
291 switch (type) {
292 case BP_VAR_R:
293 case BP_VAR_UNSET:
294 ptr = zval_undefined_cv(var EXECUTE_DATA_CC);
295 break;
296 case BP_VAR_IS:
297 ptr = &EG(uninitialized_zval);
298 break;
299 case BP_VAR_RW:
300 zval_undefined_cv(var EXECUTE_DATA_CC);
301 /* break missing intentionally */
302 case BP_VAR_W:
303 ZVAL_NULL(ptr);
304 break;
305 }
306 return ptr;
307 }
308
_get_zval_ptr_cv(uint32_t var,int type EXECUTE_DATA_DC)309 static zend_always_inline zval *_get_zval_ptr_cv(uint32_t var, int type EXECUTE_DATA_DC)
310 {
311 zval *ret = EX_VAR(var);
312
313 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
314 if (type == BP_VAR_W) {
315 ZVAL_NULL(ret);
316 } else {
317 return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
318 }
319 }
320 return ret;
321 }
322
_get_zval_ptr_cv_deref(uint32_t var,int type EXECUTE_DATA_DC)323 static zend_always_inline zval *_get_zval_ptr_cv_deref(uint32_t var, int type EXECUTE_DATA_DC)
324 {
325 zval *ret = EX_VAR(var);
326
327 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
328 if (type == BP_VAR_W) {
329 ZVAL_NULL(ret);
330 return ret;
331 } else {
332 return _get_zval_cv_lookup(ret, var, type EXECUTE_DATA_CC);
333 }
334 }
335 ZVAL_DEREF(ret);
336 return ret;
337 }
338
_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)339 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
340 {
341 zval *ret = EX_VAR(var);
342
343 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
344 return zval_undefined_cv(var EXECUTE_DATA_CC);
345 }
346 return ret;
347 }
348
_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)349 static zend_always_inline zval *_get_zval_ptr_cv_deref_BP_VAR_R(uint32_t var EXECUTE_DATA_DC)
350 {
351 zval *ret = EX_VAR(var);
352
353 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
354 return zval_undefined_cv(var EXECUTE_DATA_CC);
355 }
356 ZVAL_DEREF(ret);
357 return ret;
358 }
359
_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)360 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_IS(uint32_t var EXECUTE_DATA_DC)
361 {
362 zval *ret = EX_VAR(var);
363
364 return ret;
365 }
366
_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)367 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_RW(uint32_t var EXECUTE_DATA_DC)
368 {
369 zval *ret = EX_VAR(var);
370
371 if (UNEXPECTED(Z_TYPE_P(ret) == IS_UNDEF)) {
372 zval_undefined_cv(var EXECUTE_DATA_CC);
373 ZVAL_NULL(ret);
374 return ret;
375 }
376 return ret;
377 }
378
_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)379 static zend_always_inline zval *_get_zval_ptr_cv_BP_VAR_W(uint32_t var EXECUTE_DATA_DC)
380 {
381 zval *ret = EX_VAR(var);
382
383 if (Z_TYPE_P(ret) == IS_UNDEF) {
384 ZVAL_NULL(ret);
385 }
386 return ret;
387 }
388
_get_zval_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)389 static zend_always_inline zval *_get_zval_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
390 {
391 if (op_type & (IS_TMP_VAR|IS_VAR)) {
392 if (!ZEND_DEBUG || op_type == IS_VAR) {
393 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
394 } else {
395 ZEND_ASSERT(op_type == IS_TMP_VAR);
396 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
397 }
398 } else {
399 if (op_type == IS_CONST) {
400 return RT_CONSTANT(opline, node);
401 } else if (op_type == IS_CV) {
402 return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
403 } else {
404 return NULL;
405 }
406 }
407 }
408
_get_op_data_zval_ptr_r(int op_type,znode_op node EXECUTE_DATA_DC OPLINE_DC)409 static zend_always_inline zval *_get_op_data_zval_ptr_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
410 {
411 if (op_type & (IS_TMP_VAR|IS_VAR)) {
412 if (!ZEND_DEBUG || op_type == IS_VAR) {
413 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
414 } else {
415 ZEND_ASSERT(op_type == IS_TMP_VAR);
416 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
417 }
418 } else {
419 if (op_type == IS_CONST) {
420 return RT_CONSTANT(opline + 1, node);
421 } else if (op_type == IS_CV) {
422 return _get_zval_ptr_cv_BP_VAR_R(node.var EXECUTE_DATA_CC);
423 } else {
424 return NULL;
425 }
426 }
427 }
428
_get_zval_ptr_deref(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)429 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_zval_ptr_deref(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
430 {
431 if (op_type & (IS_TMP_VAR|IS_VAR)) {
432 if (op_type == IS_TMP_VAR) {
433 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
434 } else {
435 ZEND_ASSERT(op_type == IS_VAR);
436 return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
437 }
438 } else {
439 if (op_type == IS_CONST) {
440 return RT_CONSTANT(opline, node);
441 } else if (op_type == IS_CV) {
442 return _get_zval_ptr_cv_deref(node.var, type EXECUTE_DATA_CC);
443 } else {
444 return NULL;
445 }
446 }
447 }
448
_get_op_data_zval_ptr_deref_r(int op_type,znode_op node EXECUTE_DATA_DC OPLINE_DC)449 static zend_always_inline ZEND_ATTRIBUTE_UNUSED zval *_get_op_data_zval_ptr_deref_r(int op_type, znode_op node EXECUTE_DATA_DC OPLINE_DC)
450 {
451 if (op_type & (IS_TMP_VAR|IS_VAR)) {
452 if (op_type == IS_TMP_VAR) {
453 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
454 } else {
455 ZEND_ASSERT(op_type == IS_VAR);
456 return _get_zval_ptr_var_deref(node.var EXECUTE_DATA_CC);
457 }
458 } else {
459 if (op_type == IS_CONST) {
460 return RT_CONSTANT(opline + 1, node);
461 } else if (op_type == IS_CV) {
462 return _get_zval_ptr_cv_deref_BP_VAR_R(node.var EXECUTE_DATA_CC);
463 } else {
464 return NULL;
465 }
466 }
467 }
468
_get_zval_ptr_undef(int op_type,znode_op node,int type EXECUTE_DATA_DC OPLINE_DC)469 static zend_always_inline zval *_get_zval_ptr_undef(int op_type, znode_op node, int type EXECUTE_DATA_DC OPLINE_DC)
470 {
471 if (op_type & (IS_TMP_VAR|IS_VAR)) {
472 if (!ZEND_DEBUG || op_type == IS_VAR) {
473 return _get_zval_ptr_var(node.var EXECUTE_DATA_CC);
474 } else {
475 ZEND_ASSERT(op_type == IS_TMP_VAR);
476 return _get_zval_ptr_tmp(node.var EXECUTE_DATA_CC);
477 }
478 } else {
479 if (op_type == IS_CONST) {
480 return RT_CONSTANT(opline, node);
481 } else if (op_type == IS_CV) {
482 return EX_VAR(node.var);
483 } else {
484 return NULL;
485 }
486 }
487 }
488
_get_zval_ptr_ptr_var(uint32_t var EXECUTE_DATA_DC)489 static zend_always_inline zval *_get_zval_ptr_ptr_var(uint32_t var EXECUTE_DATA_DC)
490 {
491 zval *ret = EX_VAR(var);
492
493 if (EXPECTED(Z_TYPE_P(ret) == IS_INDIRECT)) {
494 ret = Z_INDIRECT_P(ret);
495 }
496 return ret;
497 }
498
_get_zval_ptr_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC)499 static inline zval *_get_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
500 {
501 if (op_type == IS_CV) {
502 return _get_zval_ptr_cv(node.var, type EXECUTE_DATA_CC);
503 } else /* if (op_type == IS_VAR) */ {
504 ZEND_ASSERT(op_type == IS_VAR);
505 return _get_zval_ptr_ptr_var(node.var EXECUTE_DATA_CC);
506 }
507 }
508
_get_obj_zval_ptr(int op_type,znode_op op,int type EXECUTE_DATA_DC OPLINE_DC)509 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
510 {
511 if (op_type == IS_UNUSED) {
512 return &EX(This);
513 }
514 return get_zval_ptr(op_type, op, type);
515 }
516
_get_obj_zval_ptr_undef(int op_type,znode_op op,int type EXECUTE_DATA_DC OPLINE_DC)517 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_undef(int op_type, znode_op op, int type EXECUTE_DATA_DC OPLINE_DC)
518 {
519 if (op_type == IS_UNUSED) {
520 return &EX(This);
521 }
522 return get_zval_ptr_undef(op_type, op, type);
523 }
524
_get_obj_zval_ptr_ptr(int op_type,znode_op node,int type EXECUTE_DATA_DC)525 static inline ZEND_ATTRIBUTE_UNUSED zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, int type EXECUTE_DATA_DC)
526 {
527 if (op_type == IS_UNUSED) {
528 return &EX(This);
529 }
530 return get_zval_ptr_ptr(op_type, node, type);
531 }
532
zend_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr)533 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
534 {
535 zend_reference *ref;
536
537 if (EXPECTED(!Z_ISREF_P(value_ptr))) {
538 ZVAL_NEW_REF(value_ptr, value_ptr);
539 } else if (UNEXPECTED(variable_ptr == value_ptr)) {
540 return;
541 }
542
543 ref = Z_REF_P(value_ptr);
544 GC_ADDREF(ref);
545 if (Z_REFCOUNTED_P(variable_ptr)) {
546 zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
547
548 if (GC_DELREF(garbage) == 0) {
549 ZVAL_REF(variable_ptr, ref);
550 rc_dtor_func(garbage);
551 return;
552 } else {
553 gc_check_possible_root(garbage);
554 }
555 }
556 ZVAL_REF(variable_ptr, ref);
557 }
558
zend_assign_to_typed_property_reference(zend_property_info * prop_info,zval * prop,zval * value_ptr EXECUTE_DATA_DC)559 static zend_never_inline zval* zend_assign_to_typed_property_reference(zend_property_info *prop_info, zval *prop, zval *value_ptr EXECUTE_DATA_DC)
560 {
561 if (!zend_verify_prop_assignable_by_ref(prop_info, value_ptr, EX_USES_STRICT_TYPES())) {
562 return &EG(uninitialized_zval);
563 }
564 if (Z_ISREF_P(prop)) {
565 ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(prop), prop_info);
566 }
567 zend_assign_to_variable_reference(prop, value_ptr);
568 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(prop), prop_info);
569 return prop;
570 }
571
zend_wrong_assign_to_variable_reference(zval * variable_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)572 static zend_never_inline ZEND_COLD zval *zend_wrong_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
573 {
574 zend_error(E_NOTICE, "Only variables should be assigned by reference");
575 if (UNEXPECTED(EG(exception) != NULL)) {
576 return &EG(uninitialized_zval);
577 }
578
579 /* Use IS_TMP_VAR instead of IS_VAR to avoid ISREF check */
580 Z_TRY_ADDREF_P(value_ptr);
581 return zend_assign_to_variable(variable_ptr, value_ptr, IS_TMP_VAR, EX_USES_STRICT_TYPES());
582 }
583
zend_cannot_pass_by_reference(uint32_t arg_num)584 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_cannot_pass_by_reference(uint32_t arg_num)
585 {
586 const zend_execute_data *execute_data = EG(current_execute_data);
587 zend_string *func_name = get_function_or_method_name(EX(call)->func);
588 const char *param_name = get_function_arg_name(EX(call)->func, arg_num);
589
590 zend_throw_error(NULL, "%s(): Argument #%d%s%s%s cannot be passed by reference",
591 ZSTR_VAL(func_name), arg_num, param_name ? " ($" : "", param_name ? param_name : "", param_name ? ")" : ""
592 );
593
594 zend_string_release(func_name);
595 }
596
zend_throw_auto_init_in_prop_error(zend_property_info * prop,const char * type)597 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_prop_error(zend_property_info *prop, const char *type) {
598 zend_string *type_str = zend_type_to_string(prop->type);
599 zend_type_error(
600 "Cannot auto-initialize an %s inside property %s::$%s of type %s",
601 type,
602 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
603 ZSTR_VAL(type_str)
604 );
605 zend_string_release(type_str);
606 }
607
zend_throw_auto_init_in_ref_error(zend_property_info * prop,const char * type)608 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_ref_error(zend_property_info *prop, const char *type) {
609 zend_string *type_str = zend_type_to_string(prop->type);
610 zend_type_error(
611 "Cannot auto-initialize an %s inside a reference held by property %s::$%s of type %s",
612 type,
613 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
614 ZSTR_VAL(type_str)
615 );
616 zend_string_release(type_str);
617 }
618
zend_throw_access_uninit_prop_by_ref_error(zend_property_info * prop)619 static zend_never_inline ZEND_COLD void zend_throw_access_uninit_prop_by_ref_error(
620 zend_property_info *prop) {
621 zend_throw_error(NULL,
622 "Cannot access uninitialized non-nullable property %s::$%s by reference",
623 ZSTR_VAL(prop->ce->name),
624 zend_get_unmangled_property_name(prop->name));
625 }
626
627 /* this should modify object only if it's empty */
zend_throw_non_object_error(zval * object,zval * property OPLINE_DC EXECUTE_DATA_DC)628 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_throw_non_object_error(zval *object, zval *property OPLINE_DC EXECUTE_DATA_DC)
629 {
630 zend_string *tmp_property_name;
631 zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
632
633 if (opline->opcode == ZEND_PRE_INC_OBJ
634 || opline->opcode == ZEND_PRE_DEC_OBJ
635 || opline->opcode == ZEND_POST_INC_OBJ
636 || opline->opcode == ZEND_POST_DEC_OBJ) {
637 zend_throw_error(NULL,
638 "Attempt to increment/decrement property \"%s\" on %s",
639 ZSTR_VAL(property_name), zend_zval_type_name(object)
640 );
641 } else if (opline->opcode == ZEND_FETCH_OBJ_W
642 || opline->opcode == ZEND_FETCH_OBJ_RW
643 || opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG
644 || opline->opcode == ZEND_ASSIGN_OBJ_REF) {
645 zend_throw_error(NULL,
646 "Attempt to modify property \"%s\" on %s",
647 ZSTR_VAL(property_name), zend_zval_type_name(object)
648 );
649 } else {
650 zend_throw_error(NULL,
651 "Attempt to assign property \"%s\" on %s",
652 ZSTR_VAL(property_name), zend_zval_type_name(object)
653 );
654 }
655 zend_tmp_string_release(tmp_property_name);
656
657 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
658 ZVAL_NULL(EX_VAR(opline->result.var));
659 }
660 }
661
zend_verify_type_error_common(const zend_function * zf,const zend_arg_info * arg_info,zval * value,const char ** fname,const char ** fsep,const char ** fclass,zend_string ** need_msg,const char ** given_kind)662 static ZEND_COLD void zend_verify_type_error_common(
663 const zend_function *zf, const zend_arg_info *arg_info, zval *value,
664 const char **fname, const char **fsep, const char **fclass,
665 zend_string **need_msg, const char **given_kind)
666 {
667 *fname = ZSTR_VAL(zf->common.function_name);
668 if (zf->common.scope) {
669 *fsep = "::";
670 *fclass = ZSTR_VAL(zf->common.scope->name);
671 } else {
672 *fsep = "";
673 *fclass = "";
674 }
675
676 *need_msg = zend_type_to_string_resolved(arg_info->type, zf->common.scope);
677
678 if (value) {
679 *given_kind = zend_zval_type_name(value);
680 } else {
681 *given_kind = "none";
682 }
683 }
684
zend_verify_arg_error(const zend_function * zf,const zend_arg_info * arg_info,int arg_num,zval * value)685 ZEND_API ZEND_COLD void zend_verify_arg_error(
686 const zend_function *zf, const zend_arg_info *arg_info, int arg_num, zval *value)
687 {
688 zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
689 const char *fname, *fsep, *fclass;
690 zend_string *need_msg;
691 const char *given_msg;
692
693 if (EG(exception)) {
694 /* The type verification itself might have already thrown an exception
695 * through a promoted warning. */
696 return;
697 }
698
699 zend_verify_type_error_common(
700 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
701
702 ZEND_ASSERT(zf->common.type == ZEND_USER_FUNCTION
703 && "Arginfo verification is not performed for internal functions");
704 if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
705 zend_argument_type_error(arg_num, "must be of type %s, %s given, called in %s on line %d",
706 ZSTR_VAL(need_msg), given_msg,
707 ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno
708 );
709 } else {
710 zend_argument_type_error(arg_num,
711 "must be of type %s, %s given", ZSTR_VAL(need_msg), given_msg);
712 }
713
714 zend_string_release(need_msg);
715 }
716
zend_verify_weak_scalar_type_hint(uint32_t type_mask,zval * arg)717 static zend_bool zend_verify_weak_scalar_type_hint(uint32_t type_mask, zval *arg)
718 {
719 zend_long lval;
720 double dval;
721 zend_string *str;
722 zend_bool bval;
723
724 /* Type preference order: int -> float -> string -> bool */
725 if (type_mask & MAY_BE_LONG) {
726 /* For an int|float union type and string value,
727 * determine chosen type by is_numeric_string() semantics. */
728 if ((type_mask & MAY_BE_DOUBLE) && Z_TYPE_P(arg) == IS_STRING) {
729 zend_uchar type = is_numeric_str_function(Z_STR_P(arg), &lval, &dval);
730 if (type == IS_LONG) {
731 zend_string_release(Z_STR_P(arg));
732 ZVAL_LONG(arg, lval);
733 return 1;
734 }
735 if (type == IS_DOUBLE) {
736 zend_string_release(Z_STR_P(arg));
737 ZVAL_DOUBLE(arg, dval);
738 return 1;
739 }
740 } else if (zend_parse_arg_long_weak(arg, &lval)) {
741 zval_ptr_dtor(arg);
742 ZVAL_LONG(arg, lval);
743 return 1;
744 }
745 }
746 if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval)) {
747 zval_ptr_dtor(arg);
748 ZVAL_DOUBLE(arg, dval);
749 return 1;
750 }
751 if ((type_mask & MAY_BE_STRING) && zend_parse_arg_str_weak(arg, &str)) {
752 /* on success "arg" is converted to IS_STRING */
753 return 1;
754 }
755 if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval)) {
756 zval_ptr_dtor(arg);
757 ZVAL_BOOL(arg, bval);
758 return 1;
759 }
760 return 0;
761 }
762
763 #if ZEND_DEBUG
can_convert_to_string(zval * zv)764 static bool can_convert_to_string(zval *zv) {
765 /* We don't call cast_object here, because this check must be side-effect free. As this
766 * is only used for a sanity check of arginfo/zpp consistency, it's okay if we accept
767 * more than actually allowed here. */
768 if (Z_TYPE_P(zv) == IS_OBJECT) {
769 return Z_OBJ_HT_P(zv)->cast_object != zend_std_cast_object_tostring
770 || Z_OBJCE_P(zv)->__tostring;
771 }
772 return Z_TYPE_P(zv) <= IS_STRING;
773 }
774
775 /* Used to sanity-check internal arginfo types without performing any actual type conversions. */
zend_verify_weak_scalar_type_hint_no_sideeffect(uint32_t type_mask,zval * arg)776 static zend_bool zend_verify_weak_scalar_type_hint_no_sideeffect(uint32_t type_mask, zval *arg)
777 {
778 zend_long lval;
779 double dval;
780 zend_bool bval;
781
782 if ((type_mask & MAY_BE_LONG) && zend_parse_arg_long_weak(arg, &lval)) {
783 return 1;
784 }
785 if ((type_mask & MAY_BE_DOUBLE) && zend_parse_arg_double_weak(arg, &dval)) {
786 return 1;
787 }
788 if ((type_mask & MAY_BE_STRING) && can_convert_to_string(arg)) {
789 return 1;
790 }
791 if ((type_mask & MAY_BE_BOOL) == MAY_BE_BOOL && zend_parse_arg_bool_weak(arg, &bval)) {
792 return 1;
793 }
794 return 0;
795 }
796 #endif
797
zend_verify_scalar_type_hint(uint32_t type_mask,zval * arg,zend_bool strict,zend_bool is_internal_arg)798 ZEND_API zend_bool zend_verify_scalar_type_hint(uint32_t type_mask, zval *arg, zend_bool strict, zend_bool is_internal_arg)
799 {
800 if (UNEXPECTED(strict)) {
801 /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
802 if (!(type_mask & MAY_BE_DOUBLE) || Z_TYPE_P(arg) != IS_LONG) {
803 return 0;
804 }
805 } else if (UNEXPECTED(Z_TYPE_P(arg) == IS_NULL)) {
806 /* NULL may be accepted only by nullable hints (this is already checked).
807 * As an exception for internal functions, null is allowed for scalar types in weak mode. */
808 return is_internal_arg
809 && (type_mask & (MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING));
810 }
811 #if ZEND_DEBUG
812 if (is_internal_arg) {
813 return zend_verify_weak_scalar_type_hint_no_sideeffect(type_mask, arg);
814 }
815 #endif
816 return zend_verify_weak_scalar_type_hint(type_mask, arg);
817 }
818
zend_verify_property_type_error(zend_property_info * info,zval * property)819 ZEND_COLD zend_never_inline void zend_verify_property_type_error(zend_property_info *info, zval *property)
820 {
821 zend_string *type_str;
822
823 /* we _may_ land here in case reading already errored and runtime cache thus has not been updated (i.e. it contains a valid but unrelated info) */
824 if (EG(exception)) {
825 return;
826 }
827
828 type_str = zend_type_to_string(info->type);
829 zend_type_error("Cannot assign %s to property %s::$%s of type %s",
830 zend_zval_type_name(property),
831 ZSTR_VAL(info->ce->name),
832 zend_get_unmangled_property_name(info->name),
833 ZSTR_VAL(type_str));
834 zend_string_release(type_str);
835 }
836
resolve_single_class_type(zend_string * name,zend_class_entry * self_ce)837 static zend_class_entry *resolve_single_class_type(zend_string *name, zend_class_entry *self_ce) {
838 if (zend_string_equals_literal_ci(name, "self")) {
839 /* We need to explicitly check for this here, to avoid updating the type in the trait and
840 * later using the wrong "self" when the trait is used in a class. */
841 if (UNEXPECTED((self_ce->ce_flags & ZEND_ACC_TRAIT) != 0)) {
842 return NULL;
843 }
844 return self_ce;
845 } else if (zend_string_equals_literal_ci(name, "parent")) {
846 return self_ce->parent;
847 } else {
848 return zend_lookup_class_ex(name, NULL, ZEND_FETCH_CLASS_NO_AUTOLOAD);
849 }
850 }
851
zend_check_and_resolve_property_class_type(zend_property_info * info,zend_class_entry * object_ce)852 static zend_bool zend_check_and_resolve_property_class_type(
853 zend_property_info *info, zend_class_entry *object_ce) {
854 zend_class_entry *ce;
855 if (ZEND_TYPE_HAS_LIST(info->type)) {
856 zend_type *list_type;
857 ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(info->type), list_type) {
858 if (ZEND_TYPE_HAS_NAME(*list_type)) {
859 zend_string *name = ZEND_TYPE_NAME(*list_type);
860 ce = resolve_single_class_type(name, info->ce);
861 if (!ce) {
862 continue;
863 }
864 zend_string_release(name);
865 ZEND_TYPE_SET_CE(*list_type, ce);
866 } else {
867 ce = ZEND_TYPE_CE(*list_type);
868 }
869 if (instanceof_function(object_ce, ce)) {
870 return 1;
871 }
872 } ZEND_TYPE_LIST_FOREACH_END();
873 return 0;
874 } else {
875 if (UNEXPECTED(ZEND_TYPE_HAS_NAME(info->type))) {
876 zend_string *name = ZEND_TYPE_NAME(info->type);
877 ce = resolve_single_class_type(name, info->ce);
878 if (UNEXPECTED(!ce)) {
879 return 0;
880 }
881
882 zend_string_release(name);
883 ZEND_TYPE_SET_CE(info->type, ce);
884 } else {
885 ce = ZEND_TYPE_CE(info->type);
886 }
887 return instanceof_function(object_ce, ce);
888 }
889 }
890
i_zend_check_property_type(zend_property_info * info,zval * property,zend_bool strict)891 static zend_always_inline zend_bool i_zend_check_property_type(zend_property_info *info, zval *property, zend_bool strict)
892 {
893 ZEND_ASSERT(!Z_ISREF_P(property));
894 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(info->type, Z_TYPE_P(property)))) {
895 return 1;
896 }
897
898 if (ZEND_TYPE_HAS_CLASS(info->type) && Z_TYPE_P(property) == IS_OBJECT
899 && zend_check_and_resolve_property_class_type(info, Z_OBJCE_P(property))) {
900 return 1;
901 }
902
903 uint32_t type_mask = ZEND_TYPE_FULL_MASK(info->type);
904 ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC)));
905 if ((type_mask & MAY_BE_ITERABLE) && zend_is_iterable(property)) {
906 return 1;
907 }
908 return zend_verify_scalar_type_hint(type_mask, property, strict, 0);
909 }
910
i_zend_verify_property_type(zend_property_info * info,zval * property,zend_bool strict)911 static zend_always_inline zend_bool i_zend_verify_property_type(zend_property_info *info, zval *property, zend_bool strict)
912 {
913 if (i_zend_check_property_type(info, property, strict)) {
914 return 1;
915 }
916
917 zend_verify_property_type_error(info, property);
918 return 0;
919 }
920
zend_verify_property_type(zend_property_info * info,zval * property,zend_bool strict)921 ZEND_API zend_bool zend_never_inline zend_verify_property_type(zend_property_info *info, zval *property, zend_bool strict) {
922 return i_zend_verify_property_type(info, property, strict);
923 }
924
zend_assign_to_typed_prop(zend_property_info * info,zval * property_val,zval * value EXECUTE_DATA_DC)925 static zend_never_inline zval* zend_assign_to_typed_prop(zend_property_info *info, zval *property_val, zval *value EXECUTE_DATA_DC)
926 {
927 zval tmp;
928
929 ZVAL_DEREF(value);
930 ZVAL_COPY(&tmp, value);
931
932 if (UNEXPECTED(!i_zend_verify_property_type(info, &tmp, EX_USES_STRICT_TYPES()))) {
933 zval_ptr_dtor(&tmp);
934 return &EG(uninitialized_zval);
935 }
936
937 return zend_assign_to_variable(property_val, &tmp, IS_TMP_VAR, EX_USES_STRICT_TYPES());
938 }
939
zend_value_instanceof_static(zval * zv)940 ZEND_API zend_bool zend_value_instanceof_static(zval *zv) {
941 if (Z_TYPE_P(zv) != IS_OBJECT) {
942 return 0;
943 }
944
945 zend_class_entry *called_scope = zend_get_called_scope(EG(current_execute_data));
946 if (!called_scope) {
947 return 0;
948 }
949 return instanceof_function(Z_OBJCE_P(zv), called_scope);
950 }
951
952 /* The cache_slot may only be NULL in debug builds, where arginfo verification of
953 * internal functions is enabled. Avoid unnecessary checks in release builds. */
954 #if ZEND_DEBUG
955 # define HAVE_CACHE_SLOT (cache_slot != NULL)
956 #else
957 # define HAVE_CACHE_SLOT 1
958 #endif
959
zend_check_type_slow(zend_type type,zval * arg,zend_reference * ref,void ** cache_slot,zend_class_entry * scope,zend_bool is_return_type,zend_bool is_internal)960 static zend_always_inline zend_bool zend_check_type_slow(
961 zend_type type, zval *arg, zend_reference *ref, void **cache_slot, zend_class_entry *scope,
962 zend_bool is_return_type, zend_bool is_internal)
963 {
964 uint32_t type_mask;
965 if (ZEND_TYPE_HAS_CLASS(type) && Z_TYPE_P(arg) == IS_OBJECT) {
966 zend_class_entry *ce;
967 if (ZEND_TYPE_HAS_LIST(type)) {
968 zend_type *list_type;
969 ZEND_TYPE_LIST_FOREACH(ZEND_TYPE_LIST(type), list_type) {
970 if (HAVE_CACHE_SLOT && *cache_slot) {
971 ce = *cache_slot;
972 } else {
973 ce = zend_fetch_class(ZEND_TYPE_NAME(*list_type),
974 (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
975 if (!ce) {
976 if (HAVE_CACHE_SLOT) {
977 cache_slot++;
978 }
979 continue;
980 }
981 if (HAVE_CACHE_SLOT) {
982 *cache_slot = ce;
983 }
984 }
985 if (instanceof_function(Z_OBJCE_P(arg), ce)) {
986 return 1;
987 }
988 if (HAVE_CACHE_SLOT) {
989 cache_slot++;
990 }
991 } ZEND_TYPE_LIST_FOREACH_END();
992 } else {
993 if (EXPECTED(HAVE_CACHE_SLOT && *cache_slot)) {
994 ce = (zend_class_entry *) *cache_slot;
995 } else {
996 ce = zend_fetch_class(ZEND_TYPE_NAME(type), (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
997 if (UNEXPECTED(!ce)) {
998 goto builtin_types;
999 }
1000 if (HAVE_CACHE_SLOT) {
1001 *cache_slot = (void *) ce;
1002 }
1003 }
1004 if (instanceof_function(Z_OBJCE_P(arg), ce)) {
1005 return 1;
1006 }
1007 }
1008 }
1009
1010 builtin_types:
1011 type_mask = ZEND_TYPE_FULL_MASK(type);
1012 if ((type_mask & MAY_BE_CALLABLE) && zend_is_callable(arg, 0, NULL)) {
1013 return 1;
1014 }
1015 if ((type_mask & MAY_BE_ITERABLE) && zend_is_iterable(arg)) {
1016 return 1;
1017 }
1018 if ((type_mask & MAY_BE_STATIC) && zend_value_instanceof_static(arg)) {
1019 return 1;
1020 }
1021 if (ref && ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1022 /* We cannot have conversions for typed refs. */
1023 return 0;
1024 }
1025 if (is_internal && is_return_type) {
1026 /* For internal returns, the type has to match exactly, because we're not
1027 * going to check it for non-debug builds, and there will be no chance to
1028 * apply coercions. */
1029 return 0;
1030 }
1031
1032 return zend_verify_scalar_type_hint(type_mask, arg,
1033 is_return_type ? ZEND_RET_USES_STRICT_TYPES() : ZEND_ARG_USES_STRICT_TYPES(),
1034 is_internal);
1035
1036 /* Special handling for IS_VOID is not necessary (for return types),
1037 * because this case is already checked at compile-time. */
1038 }
1039
zend_check_type(zend_type type,zval * arg,void ** cache_slot,zend_class_entry * scope,zend_bool is_return_type,zend_bool is_internal)1040 static zend_always_inline zend_bool zend_check_type(
1041 zend_type type, zval *arg, void **cache_slot, zend_class_entry *scope,
1042 zend_bool is_return_type, zend_bool is_internal)
1043 {
1044 zend_reference *ref = NULL;
1045 ZEND_ASSERT(ZEND_TYPE_IS_SET(type));
1046
1047 if (UNEXPECTED(Z_ISREF_P(arg))) {
1048 ref = Z_REF_P(arg);
1049 arg = Z_REFVAL_P(arg);
1050 }
1051
1052 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(type, Z_TYPE_P(arg)))) {
1053 return 1;
1054 }
1055
1056 return zend_check_type_slow(type, arg, ref, cache_slot, scope, is_return_type, is_internal);
1057 }
1058
zend_verify_recv_arg_type(zend_function * zf,uint32_t arg_num,zval * arg,void ** cache_slot)1059 static zend_always_inline bool zend_verify_recv_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, void **cache_slot)
1060 {
1061 zend_arg_info *cur_arg_info;
1062
1063 ZEND_ASSERT(arg_num <= zf->common.num_args);
1064 cur_arg_info = &zf->common.arg_info[arg_num-1];
1065
1066 if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1067 && UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
1068 zend_verify_arg_error(zf, cur_arg_info, arg_num, arg);
1069 return 0;
1070 }
1071
1072 return 1;
1073 }
1074
zend_verify_variadic_arg_type(zend_function * zf,zend_arg_info * arg_info,uint32_t arg_num,zval * arg,void ** cache_slot)1075 static zend_always_inline bool zend_verify_variadic_arg_type(
1076 zend_function *zf, zend_arg_info *arg_info, uint32_t arg_num, zval *arg, void **cache_slot)
1077 {
1078 ZEND_ASSERT(ZEND_TYPE_IS_SET(arg_info->type));
1079 if (UNEXPECTED(!zend_check_type(arg_info->type, arg, cache_slot, zf->common.scope, 0, 0))) {
1080 zend_verify_arg_error(zf, arg_info, arg_num, arg);
1081 return 0;
1082 }
1083
1084 return 1;
1085 }
1086
zend_verify_internal_arg_types(zend_function * fbc,zend_execute_data * call)1087 static zend_never_inline ZEND_ATTRIBUTE_UNUSED bool zend_verify_internal_arg_types(zend_function *fbc, zend_execute_data *call)
1088 {
1089 uint32_t i;
1090 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
1091 zval *arg = ZEND_CALL_ARG(call, 1);
1092
1093 for (i = 0; i < num_args; ++i) {
1094 zend_arg_info *cur_arg_info;
1095 if (EXPECTED(i < fbc->common.num_args)) {
1096 cur_arg_info = &fbc->common.arg_info[i];
1097 } else if (UNEXPECTED(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1098 cur_arg_info = &fbc->common.arg_info[fbc->common.num_args];
1099 } else {
1100 break;
1101 }
1102
1103 if (ZEND_TYPE_IS_SET(cur_arg_info->type)
1104 && UNEXPECTED(!zend_check_type(cur_arg_info->type, arg, /* cache_slot */ NULL, fbc->common.scope, 0, /* is_internal */ 1))) {
1105 return 0;
1106 }
1107 arg++;
1108 }
1109 return 1;
1110 }
1111
1112 #if ZEND_DEBUG
1113 /* Determine whether an internal call should throw, because the passed arguments violate
1114 * an arginfo constraint. This is only checked in debug builds. In release builds, we
1115 * trust that arginfo matches what is enforced by zend_parse_parameters. */
zend_internal_call_should_throw(zend_function * fbc,zend_execute_data * call)1116 static zend_always_inline zend_bool zend_internal_call_should_throw(zend_function *fbc, zend_execute_data *call)
1117 {
1118 if (fbc->internal_function.handler == ZEND_FN(pass)) {
1119 /* Be lenient about the special pass function. */
1120 return 0;
1121 }
1122
1123 if (fbc->common.required_num_args > ZEND_CALL_NUM_ARGS(call)) {
1124 /* Required argument not passed. */
1125 return 1;
1126 }
1127
1128 if (fbc->common.num_args < ZEND_CALL_NUM_ARGS(call)
1129 && !(fbc->common.fn_flags & ZEND_ACC_VARIADIC)) {
1130 /* Too many arguments passed. For internal functions (unlike userland functions),
1131 * this should always throw. */
1132 return 1;
1133 }
1134
1135 if ((fbc->common.fn_flags & ZEND_ACC_HAS_TYPE_HINTS) &&
1136 !zend_verify_internal_arg_types(fbc, call)) {
1137 return 1;
1138 }
1139
1140 return 0;
1141 }
1142
zend_internal_call_arginfo_violation(zend_function * fbc)1143 static ZEND_COLD void zend_internal_call_arginfo_violation(zend_function *fbc)
1144 {
1145 zend_error(E_ERROR, "Arginfo / zpp mismatch during call of %s%s%s()",
1146 fbc->common.scope ? ZSTR_VAL(fbc->common.scope->name) : "",
1147 fbc->common.scope ? "::" : "",
1148 ZSTR_VAL(fbc->common.function_name));
1149 }
1150 #endif
1151
zend_missing_arg_error(zend_execute_data * execute_data)1152 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *execute_data)
1153 {
1154 zend_execute_data *ptr = EX(prev_execute_data);
1155
1156 if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
1157 zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
1158 EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1159 EX(func)->common.scope ? "::" : "",
1160 ZSTR_VAL(EX(func)->common.function_name),
1161 EX_NUM_ARGS(),
1162 ZSTR_VAL(ptr->func->op_array.filename),
1163 ptr->opline->lineno,
1164 EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1165 EX(func)->common.required_num_args);
1166 } else {
1167 zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
1168 EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
1169 EX(func)->common.scope ? "::" : "",
1170 ZSTR_VAL(EX(func)->common.function_name),
1171 EX_NUM_ARGS(),
1172 EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
1173 EX(func)->common.required_num_args);
1174 }
1175 }
1176
zend_verify_return_error(const zend_function * zf,zval * value)1177 ZEND_API ZEND_COLD void zend_verify_return_error(const zend_function *zf, zval *value)
1178 {
1179 const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1180 const char *fname, *fsep, *fclass;
1181 zend_string *need_msg;
1182 const char *given_msg;
1183
1184 zend_verify_type_error_common(
1185 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1186
1187 zend_type_error("%s%s%s(): Return value must be of type %s, %s returned",
1188 fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1189
1190 zend_string_release(need_msg);
1191 }
1192
1193 #if ZEND_DEBUG
zend_verify_internal_return_error(const zend_function * zf,zval * value)1194 static ZEND_COLD void zend_verify_internal_return_error(const zend_function *zf, zval *value)
1195 {
1196 const zend_arg_info *arg_info = &zf->common.arg_info[-1];
1197 const char *fname, *fsep, *fclass;
1198 zend_string *need_msg;
1199 const char *given_msg;
1200
1201 zend_verify_type_error_common(
1202 zf, arg_info, value, &fname, &fsep, &fclass, &need_msg, &given_msg);
1203
1204 zend_error_noreturn(E_CORE_ERROR, "%s%s%s(): Return value must be of type %s, %s returned",
1205 fclass, fsep, fname, ZSTR_VAL(need_msg), given_msg);
1206 }
1207
zend_verify_void_return_error(const zend_function * zf,const char * returned_msg,const char * returned_kind)1208 static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, const char *returned_msg, const char *returned_kind)
1209 {
1210 const char *fname = ZSTR_VAL(zf->common.function_name);
1211 const char *fsep;
1212 const char *fclass;
1213
1214 if (zf->common.scope) {
1215 fsep = "::";
1216 fclass = ZSTR_VAL(zf->common.scope->name);
1217 } else {
1218 fsep = "";
1219 fclass = "";
1220 }
1221
1222 zend_type_error("%s%s%s() must not return a value, %s%s returned",
1223 fclass, fsep, fname, returned_msg, returned_kind);
1224 }
1225
zend_verify_internal_return_type(zend_function * zf,zval * ret)1226 static bool zend_verify_internal_return_type(zend_function *zf, zval *ret)
1227 {
1228 zend_internal_arg_info *ret_info = zf->internal_function.arg_info - 1;
1229 if (ZEND_TYPE_FULL_MASK(ret_info->type) & MAY_BE_VOID) {
1230 if (UNEXPECTED(Z_TYPE_P(ret) != IS_NULL)) {
1231 zend_verify_void_return_error(zf, zend_zval_type_name(ret), "");
1232 return 0;
1233 }
1234 return 1;
1235 }
1236
1237 if (UNEXPECTED(!zend_check_type(ret_info->type, ret, /* cache_slot */ NULL, NULL, 1, /* is_internal */ 1))) {
1238 zend_verify_internal_return_error(zf, ret);
1239 return 0;
1240 }
1241
1242 return 1;
1243 }
1244 #endif
1245
zend_verify_missing_return_type(const zend_function * zf)1246 static ZEND_COLD void zend_verify_missing_return_type(const zend_function *zf)
1247 {
1248 /* VERIFY_RETURN_TYPE is not emitted for "void" functions, so this is always an error. */
1249 zend_verify_return_error(zf, NULL);
1250 }
1251
zend_use_object_as_array(void)1252 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_object_as_array(void)
1253 {
1254 zend_throw_error(NULL, "Cannot use object as array");
1255 }
1256
zend_illegal_offset(void)1257 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_offset(void)
1258 {
1259 zend_type_error("Illegal offset type");
1260 }
1261
zend_illegal_string_offset(const zval * offset)1262 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_illegal_string_offset(const zval *offset)
1263 {
1264 zend_type_error("Cannot access offset of type %s on string", zend_zval_type_name(offset));
1265 }
1266
zend_assign_to_object_dim(zend_object * obj,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1267 static zend_never_inline void zend_assign_to_object_dim(zend_object *obj, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1268 {
1269 obj->handlers->write_dimension(obj, dim, value);
1270
1271 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1272 ZVAL_COPY(EX_VAR(opline->result.var), value);
1273 }
1274 }
1275
zend_binary_op(zval * ret,zval * op1,zval * op2 OPLINE_DC)1276 static zend_always_inline int zend_binary_op(zval *ret, zval *op1, zval *op2 OPLINE_DC)
1277 {
1278 static const binary_op_type zend_binary_ops[] = {
1279 add_function,
1280 sub_function,
1281 mul_function,
1282 div_function,
1283 mod_function,
1284 shift_left_function,
1285 shift_right_function,
1286 concat_function,
1287 bitwise_or_function,
1288 bitwise_and_function,
1289 bitwise_xor_function,
1290 pow_function
1291 };
1292 /* size_t cast makes GCC to better optimize 64-bit PIC code */
1293 size_t opcode = (size_t)opline->extended_value;
1294
1295 return zend_binary_ops[opcode - ZEND_ADD](ret, op1, op2);
1296 }
1297
zend_binary_assign_op_obj_dim(zend_object * obj,zval * property OPLINE_DC EXECUTE_DATA_DC)1298 static zend_never_inline void zend_binary_assign_op_obj_dim(zend_object *obj, zval *property OPLINE_DC EXECUTE_DATA_DC)
1299 {
1300 zval *value;
1301 zval *z;
1302 zval rv, res;
1303
1304 value = get_op_data_zval_ptr_r((opline+1)->op1_type, (opline+1)->op1);
1305 if ((z = obj->handlers->read_dimension(obj, property, BP_VAR_R, &rv)) != NULL) {
1306
1307 if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1308 obj->handlers->write_dimension(obj, property, &res);
1309 }
1310 if (z == &rv) {
1311 zval_ptr_dtor(&rv);
1312 }
1313 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1314 ZVAL_COPY(EX_VAR(opline->result.var), &res);
1315 }
1316 zval_ptr_dtor(&res);
1317 } else {
1318 zend_use_object_as_array();
1319 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1320 ZVAL_NULL(EX_VAR(opline->result.var));
1321 }
1322 }
1323 FREE_OP((opline+1)->op1_type, (opline+1)->op1.var);
1324 }
1325
zend_binary_assign_op_typed_ref(zend_reference * ref,zval * value OPLINE_DC EXECUTE_DATA_DC)1326 static zend_never_inline void zend_binary_assign_op_typed_ref(zend_reference *ref, zval *value OPLINE_DC EXECUTE_DATA_DC)
1327 {
1328 zval z_copy;
1329
1330 /* Make sure that in-place concatenation is used if the LHS is a string. */
1331 if (opline->extended_value == ZEND_CONCAT && Z_TYPE(ref->val) == IS_STRING) {
1332 concat_function(&ref->val, &ref->val, value);
1333 ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
1334 return;
1335 }
1336
1337 zend_binary_op(&z_copy, &ref->val, value OPLINE_CC);
1338 if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, EX_USES_STRICT_TYPES()))) {
1339 zval_ptr_dtor(&ref->val);
1340 ZVAL_COPY_VALUE(&ref->val, &z_copy);
1341 } else {
1342 zval_ptr_dtor(&z_copy);
1343 }
1344 }
1345
zend_binary_assign_op_typed_prop(zend_property_info * prop_info,zval * zptr,zval * value OPLINE_DC EXECUTE_DATA_DC)1346 static zend_never_inline void zend_binary_assign_op_typed_prop(zend_property_info *prop_info, zval *zptr, zval *value OPLINE_DC EXECUTE_DATA_DC)
1347 {
1348 zval z_copy;
1349
1350 /* Make sure that in-place concatenation is used if the LHS is a string. */
1351 if (opline->extended_value == ZEND_CONCAT && Z_TYPE_P(zptr) == IS_STRING) {
1352 concat_function(zptr, zptr, value);
1353 ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
1354 return;
1355 }
1356
1357 zend_binary_op(&z_copy, zptr, value OPLINE_CC);
1358 if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
1359 zval_ptr_dtor(zptr);
1360 ZVAL_COPY_VALUE(zptr, &z_copy);
1361 } else {
1362 zval_ptr_dtor(&z_copy);
1363 }
1364 }
1365
zend_check_string_offset(zval * dim,int type EXECUTE_DATA_DC)1366 static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type EXECUTE_DATA_DC)
1367 {
1368 zend_long offset;
1369
1370 try_again:
1371 switch(Z_TYPE_P(dim)) {
1372 case IS_LONG:
1373 return Z_LVAL_P(dim);
1374 case IS_STRING:
1375 {
1376 bool trailing_data = false;
1377 /* For BC reasons we allow errors so that we can warn on leading numeric string */
1378 if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset, NULL,
1379 /* allow errors */ true, NULL, &trailing_data)) {
1380 if (UNEXPECTED(trailing_data) && type != BP_VAR_UNSET) {
1381 zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
1382 }
1383 return offset;
1384 }
1385 zend_illegal_string_offset(dim);
1386 return 0;
1387 }
1388 case IS_UNDEF:
1389 ZVAL_UNDEFINED_OP2();
1390 case IS_DOUBLE:
1391 case IS_NULL:
1392 case IS_FALSE:
1393 case IS_TRUE:
1394 zend_error(E_WARNING, "String offset cast occurred");
1395 break;
1396 case IS_REFERENCE:
1397 dim = Z_REFVAL_P(dim);
1398 goto try_again;
1399 default:
1400 zend_illegal_string_offset(dim);
1401 return 0;
1402 }
1403
1404 return zval_get_long_func(dim);
1405 }
1406
zend_wrong_string_offset(EXECUTE_DATA_D)1407 static zend_never_inline ZEND_COLD void zend_wrong_string_offset(EXECUTE_DATA_D)
1408 {
1409 const char *msg = NULL;
1410 const zend_op *opline = EX(opline);
1411 uint32_t var;
1412
1413 if (UNEXPECTED(EG(exception) != NULL)) {
1414 return;
1415 }
1416
1417 switch (opline->opcode) {
1418 case ZEND_ASSIGN_OP:
1419 case ZEND_ASSIGN_DIM_OP:
1420 case ZEND_ASSIGN_OBJ_OP:
1421 case ZEND_ASSIGN_STATIC_PROP_OP:
1422 msg = "Cannot use assign-op operators with string offsets";
1423 break;
1424 case ZEND_FETCH_DIM_W:
1425 case ZEND_FETCH_DIM_RW:
1426 case ZEND_FETCH_DIM_FUNC_ARG:
1427 case ZEND_FETCH_DIM_UNSET:
1428 case ZEND_FETCH_LIST_W:
1429 /* TODO: Encode the "reason" into opline->extended_value??? */
1430 var = opline->result.var;
1431 opline++;
1432 ZEND_ASSERT(opline < execute_data->func->op_array.opcodes +
1433 execute_data->func->op_array.last);
1434 if (opline->op1_type == IS_VAR && opline->op1.var == var) {
1435 switch (opline->opcode) {
1436 case ZEND_FETCH_OBJ_W:
1437 case ZEND_FETCH_OBJ_RW:
1438 case ZEND_FETCH_OBJ_FUNC_ARG:
1439 case ZEND_FETCH_OBJ_UNSET:
1440 case ZEND_ASSIGN_OBJ:
1441 case ZEND_ASSIGN_OBJ_OP:
1442 case ZEND_ASSIGN_OBJ_REF:
1443 msg = "Cannot use string offset as an object";
1444 break;
1445 case ZEND_FETCH_DIM_W:
1446 case ZEND_FETCH_DIM_RW:
1447 case ZEND_FETCH_DIM_FUNC_ARG:
1448 case ZEND_FETCH_DIM_UNSET:
1449 case ZEND_FETCH_LIST_W:
1450 case ZEND_ASSIGN_DIM:
1451 case ZEND_ASSIGN_DIM_OP:
1452 msg = "Cannot use string offset as an array";
1453 break;
1454 case ZEND_ASSIGN_STATIC_PROP_OP:
1455 case ZEND_ASSIGN_OP:
1456 msg = "Cannot use assign-op operators with string offsets";
1457 break;
1458 case ZEND_PRE_INC_OBJ:
1459 case ZEND_PRE_DEC_OBJ:
1460 case ZEND_POST_INC_OBJ:
1461 case ZEND_POST_DEC_OBJ:
1462 case ZEND_PRE_INC:
1463 case ZEND_PRE_DEC:
1464 case ZEND_POST_INC:
1465 case ZEND_POST_DEC:
1466 msg = "Cannot increment/decrement string offsets";
1467 break;
1468 case ZEND_ASSIGN_REF:
1469 case ZEND_ADD_ARRAY_ELEMENT:
1470 case ZEND_INIT_ARRAY:
1471 case ZEND_MAKE_REF:
1472 msg = "Cannot create references to/from string offsets";
1473 break;
1474 case ZEND_RETURN_BY_REF:
1475 case ZEND_VERIFY_RETURN_TYPE:
1476 msg = "Cannot return string offsets by reference";
1477 break;
1478 case ZEND_UNSET_DIM:
1479 case ZEND_UNSET_OBJ:
1480 msg = "Cannot unset string offsets";
1481 break;
1482 case ZEND_YIELD:
1483 msg = "Cannot yield string offsets by reference";
1484 break;
1485 case ZEND_SEND_REF:
1486 case ZEND_SEND_VAR_EX:
1487 case ZEND_SEND_FUNC_ARG:
1488 msg = "Only variables can be passed by reference";
1489 break;
1490 case ZEND_FE_RESET_RW:
1491 msg = "Cannot iterate on string offsets by reference";
1492 break;
1493 EMPTY_SWITCH_DEFAULT_CASE();
1494 }
1495 break;
1496 }
1497 if (opline->op2_type == IS_VAR && opline->op2.var == var) {
1498 ZEND_ASSERT(opline->opcode == ZEND_ASSIGN_REF);
1499 msg = "Cannot create references to/from string offsets";
1500 break;
1501 }
1502 break;
1503 EMPTY_SWITCH_DEFAULT_CASE();
1504 }
1505 ZEND_ASSERT(msg != NULL);
1506 zend_throw_error(NULL, "%s", msg);
1507 }
1508
zend_wrong_property_read(zval * object,zval * property)1509 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_property_read(zval *object, zval *property)
1510 {
1511 zend_string *tmp_property_name;
1512 zend_string *property_name = zval_get_tmp_string(property, &tmp_property_name);
1513 zend_error(E_WARNING, "Attempt to read property \"%s\" on %s", ZSTR_VAL(property_name), zend_zval_type_name(object));
1514 zend_tmp_string_release(tmp_property_name);
1515 }
1516
zend_deprecated_function(const zend_function * fbc)1517 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_deprecated_function(const zend_function *fbc)
1518 {
1519 if (fbc->common.scope) {
1520 zend_error(E_DEPRECATED, "Method %s::%s() is deprecated",
1521 ZSTR_VAL(fbc->common.scope->name),
1522 ZSTR_VAL(fbc->common.function_name)
1523 );
1524 } else {
1525 zend_error(E_DEPRECATED, "Function %s() is deprecated", ZSTR_VAL(fbc->common.function_name));
1526 }
1527 }
1528
zend_assign_to_string_offset(zval * str,zval * dim,zval * value OPLINE_DC EXECUTE_DATA_DC)1529 static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim, zval *value OPLINE_DC EXECUTE_DATA_DC)
1530 {
1531 zend_uchar c;
1532 size_t string_len;
1533 zend_long offset;
1534 zend_string *s;
1535
1536 /* separate string */
1537 if (Z_REFCOUNTED_P(str) && Z_REFCOUNT_P(str) == 1) {
1538 s = Z_STR_P(str);
1539 } else {
1540 s = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
1541 ZSTR_H(s) = ZSTR_H(Z_STR_P(str));
1542 if (Z_REFCOUNTED_P(str)) {
1543 GC_DELREF(Z_STR_P(str));
1544 }
1545 ZVAL_NEW_STR(str, s);
1546 }
1547
1548 if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
1549 offset = Z_LVAL_P(dim);
1550 } else {
1551 /* The string may be destroyed while throwing the notice.
1552 * Temporarily increase the refcount to detect this situation. */
1553 GC_ADDREF(s);
1554 offset = zend_check_string_offset(dim, BP_VAR_W EXECUTE_DATA_CC);
1555 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1556 zend_string_efree(s);
1557 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1558 ZVAL_NULL(EX_VAR(opline->result.var));
1559 }
1560 return;
1561 }
1562 /* Illegal offset assignment */
1563 if (UNEXPECTED(EG(exception) != NULL)) {
1564 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1565 ZVAL_UNDEF(EX_VAR(opline->result.var));
1566 }
1567 return;
1568 }
1569 }
1570
1571 if (UNEXPECTED(offset < -(zend_long)ZSTR_LEN(s))) {
1572 /* Error on negative offset */
1573 zend_error(E_WARNING, "Illegal string offset " ZEND_LONG_FMT, offset);
1574 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1575 ZVAL_NULL(EX_VAR(opline->result.var));
1576 }
1577 return;
1578 }
1579
1580 if (offset < 0) { /* Handle negative offset */
1581 offset += (zend_long)ZSTR_LEN(s);
1582 }
1583
1584 if (UNEXPECTED(Z_TYPE_P(value) != IS_STRING)) {
1585 zend_string *tmp;
1586
1587 /* The string may be destroyed while throwing the notice.
1588 * Temporarily increase the refcount to detect this situation. */
1589 GC_ADDREF(s);
1590 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1591 zval_undefined_cv((opline+1)->op1.var EXECUTE_DATA_CC);
1592 }
1593 /* Convert to string, just the time to pick the 1st byte */
1594 tmp = zval_try_get_string_func(value);
1595 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1596 zend_string_efree(s);
1597 if (tmp) {
1598 zend_string_release_ex(tmp, 0);
1599 }
1600 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1601 ZVAL_NULL(EX_VAR(opline->result.var));
1602 }
1603 return;
1604 }
1605 if (UNEXPECTED(!tmp)) {
1606 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1607 ZVAL_UNDEF(EX_VAR(opline->result.var));
1608 }
1609 return;
1610 }
1611
1612 string_len = ZSTR_LEN(tmp);
1613 c = (zend_uchar)ZSTR_VAL(tmp)[0];
1614 zend_string_release_ex(tmp, 0);
1615 } else {
1616 string_len = Z_STRLEN_P(value);
1617 c = (zend_uchar)Z_STRVAL_P(value)[0];
1618 }
1619
1620 if (UNEXPECTED(string_len != 1)) {
1621 if (string_len == 0) {
1622 /* Error on empty input string */
1623 zend_throw_error(NULL, "Cannot assign an empty string to a string offset");
1624 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1625 ZVAL_NULL(EX_VAR(opline->result.var));
1626 }
1627 return;
1628 }
1629
1630 /* The string may be destroyed while throwing the notice.
1631 * Temporarily increase the refcount to detect this situation. */
1632 GC_ADDREF(s);
1633 zend_error(E_WARNING, "Only the first byte will be assigned to the string offset");
1634 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1635 zend_string_efree(s);
1636 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1637 ZVAL_NULL(EX_VAR(opline->result.var));
1638 }
1639 return;
1640 }
1641 /* Illegal offset assignment */
1642 if (UNEXPECTED(EG(exception) != NULL)) {
1643 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1644 ZVAL_UNDEF(EX_VAR(opline->result.var));
1645 }
1646 return;
1647 }
1648 }
1649
1650 if ((size_t)offset >= ZSTR_LEN(s)) {
1651 /* Extend string if needed */
1652 zend_long old_len = ZSTR_LEN(s);
1653 ZVAL_NEW_STR(str, zend_string_extend(s, (size_t)offset + 1, 0));
1654 memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
1655 Z_STRVAL_P(str)[offset+1] = 0;
1656 } else {
1657 zend_string_forget_hash_val(Z_STR_P(str));
1658 }
1659
1660 Z_STRVAL_P(str)[offset] = c;
1661
1662 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1663 /* Return the new character */
1664 ZVAL_CHAR(EX_VAR(opline->result.var), c);
1665 }
1666 }
1667
zend_get_prop_not_accepting_double(zend_reference * ref)1668 static zend_property_info *zend_get_prop_not_accepting_double(zend_reference *ref)
1669 {
1670 zend_property_info *prop;
1671 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
1672 if (!(ZEND_TYPE_FULL_MASK(prop->type) & MAY_BE_DOUBLE)) {
1673 return prop;
1674 }
1675 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
1676 return NULL;
1677 }
1678
zend_throw_incdec_ref_error(zend_reference * ref,zend_property_info * error_prop OPLINE_DC)1679 static ZEND_COLD zend_long zend_throw_incdec_ref_error(
1680 zend_reference *ref, zend_property_info *error_prop OPLINE_DC)
1681 {
1682 zend_string *type_str = zend_type_to_string(error_prop->type);
1683 if (ZEND_IS_INCREMENT(opline->opcode)) {
1684 zend_type_error(
1685 "Cannot increment a reference held by property %s::$%s of type %s past its maximal value",
1686 ZSTR_VAL(error_prop->ce->name),
1687 zend_get_unmangled_property_name(error_prop->name),
1688 ZSTR_VAL(type_str));
1689 zend_string_release(type_str);
1690 return ZEND_LONG_MAX;
1691 } else {
1692 zend_type_error(
1693 "Cannot decrement a reference held by property %s::$%s of type %s past its minimal value",
1694 ZSTR_VAL(error_prop->ce->name),
1695 zend_get_unmangled_property_name(error_prop->name),
1696 ZSTR_VAL(type_str));
1697 zend_string_release(type_str);
1698 return ZEND_LONG_MIN;
1699 }
1700 }
1701
zend_throw_incdec_prop_error(zend_property_info * prop OPLINE_DC)1702 static ZEND_COLD zend_long zend_throw_incdec_prop_error(zend_property_info *prop OPLINE_DC) {
1703 zend_string *type_str = zend_type_to_string(prop->type);
1704 if (ZEND_IS_INCREMENT(opline->opcode)) {
1705 zend_type_error("Cannot increment property %s::$%s of type %s past its maximal value",
1706 ZSTR_VAL(prop->ce->name),
1707 zend_get_unmangled_property_name(prop->name),
1708 ZSTR_VAL(type_str));
1709 zend_string_release(type_str);
1710 return ZEND_LONG_MAX;
1711 } else {
1712 zend_type_error("Cannot decrement property %s::$%s of type %s past its minimal value",
1713 ZSTR_VAL(prop->ce->name),
1714 zend_get_unmangled_property_name(prop->name),
1715 ZSTR_VAL(type_str));
1716 zend_string_release(type_str);
1717 return ZEND_LONG_MIN;
1718 }
1719 }
1720
zend_incdec_typed_ref(zend_reference * ref,zval * copy OPLINE_DC EXECUTE_DATA_DC)1721 static void zend_incdec_typed_ref(zend_reference *ref, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1722 {
1723 zval tmp;
1724 zval *var_ptr = &ref->val;
1725
1726 if (!copy) {
1727 copy = &tmp;
1728 }
1729
1730 ZVAL_COPY(copy, var_ptr);
1731
1732 if (ZEND_IS_INCREMENT(opline->opcode)) {
1733 increment_function(var_ptr);
1734 } else {
1735 decrement_function(var_ptr);
1736 }
1737
1738 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1739 zend_property_info *error_prop = zend_get_prop_not_accepting_double(ref);
1740 if (UNEXPECTED(error_prop)) {
1741 zend_long val = zend_throw_incdec_ref_error(ref, error_prop OPLINE_CC);
1742 ZVAL_LONG(var_ptr, val);
1743 }
1744 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, EX_USES_STRICT_TYPES()))) {
1745 zval_ptr_dtor(var_ptr);
1746 ZVAL_COPY_VALUE(var_ptr, copy);
1747 ZVAL_UNDEF(copy);
1748 } else if (copy == &tmp) {
1749 zval_ptr_dtor(&tmp);
1750 }
1751 }
1752
zend_incdec_typed_prop(zend_property_info * prop_info,zval * var_ptr,zval * copy OPLINE_DC EXECUTE_DATA_DC)1753 static void zend_incdec_typed_prop(zend_property_info *prop_info, zval *var_ptr, zval *copy OPLINE_DC EXECUTE_DATA_DC)
1754 {
1755 zval tmp;
1756
1757 if (!copy) {
1758 copy = &tmp;
1759 }
1760
1761 ZVAL_COPY(copy, var_ptr);
1762
1763 if (ZEND_IS_INCREMENT(opline->opcode)) {
1764 increment_function(var_ptr);
1765 } else {
1766 decrement_function(var_ptr);
1767 }
1768
1769 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(copy) == IS_LONG) {
1770 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
1771 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1772 ZVAL_LONG(var_ptr, val);
1773 }
1774 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
1775 zval_ptr_dtor(var_ptr);
1776 ZVAL_COPY_VALUE(var_ptr, copy);
1777 ZVAL_UNDEF(copy);
1778 } else if (copy == &tmp) {
1779 zval_ptr_dtor(&tmp);
1780 }
1781 }
1782
zend_pre_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)1783 static void zend_pre_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
1784 {
1785 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
1786 if (ZEND_IS_INCREMENT(opline->opcode)) {
1787 fast_long_increment_function(prop);
1788 } else {
1789 fast_long_decrement_function(prop);
1790 }
1791 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)
1792 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
1793 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1794 ZVAL_LONG(prop, val);
1795 }
1796 } else {
1797 do {
1798 if (Z_ISREF_P(prop)) {
1799 zend_reference *ref = Z_REF_P(prop);
1800 prop = Z_REFVAL_P(prop);
1801 if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
1802 zend_incdec_typed_ref(ref, NULL OPLINE_CC EXECUTE_DATA_CC);
1803 break;
1804 }
1805 }
1806
1807 if (UNEXPECTED(prop_info)) {
1808 zend_incdec_typed_prop(prop_info, prop, NULL OPLINE_CC EXECUTE_DATA_CC);
1809 } else if (ZEND_IS_INCREMENT(opline->opcode)) {
1810 increment_function(prop);
1811 } else {
1812 decrement_function(prop);
1813 }
1814 } while (0);
1815 }
1816 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1817 ZVAL_COPY(EX_VAR(opline->result.var), prop);
1818 }
1819 }
1820
zend_post_incdec_property_zval(zval * prop,zend_property_info * prop_info OPLINE_DC EXECUTE_DATA_DC)1821 static void zend_post_incdec_property_zval(zval *prop, zend_property_info *prop_info OPLINE_DC EXECUTE_DATA_DC)
1822 {
1823 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
1824 ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(prop));
1825 if (ZEND_IS_INCREMENT(opline->opcode)) {
1826 fast_long_increment_function(prop);
1827 } else {
1828 fast_long_decrement_function(prop);
1829 }
1830 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && UNEXPECTED(prop_info)
1831 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
1832 zend_long val = zend_throw_incdec_prop_error(prop_info OPLINE_CC);
1833 ZVAL_LONG(prop, val);
1834 }
1835 } else {
1836 if (Z_ISREF_P(prop)) {
1837 zend_reference *ref = Z_REF_P(prop);
1838 prop = Z_REFVAL_P(prop);
1839 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
1840 zend_incdec_typed_ref(ref, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
1841 return;
1842 }
1843 }
1844
1845 if (UNEXPECTED(prop_info)) {
1846 zend_incdec_typed_prop(prop_info, prop, EX_VAR(opline->result.var) OPLINE_CC EXECUTE_DATA_CC);
1847 } else {
1848 ZVAL_COPY(EX_VAR(opline->result.var), prop);
1849 if (ZEND_IS_INCREMENT(opline->opcode)) {
1850 increment_function(prop);
1851 } else {
1852 decrement_function(prop);
1853 }
1854 }
1855 }
1856 }
1857
zend_post_incdec_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)1858 static zend_never_inline void zend_post_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
1859 {
1860 zval rv;
1861 zval *z;
1862 zval z_copy;
1863
1864 GC_ADDREF(object);
1865 z =object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
1866 if (UNEXPECTED(EG(exception))) {
1867 OBJ_RELEASE(object);
1868 ZVAL_UNDEF(EX_VAR(opline->result.var));
1869 return;
1870 }
1871
1872 ZVAL_COPY_DEREF(&z_copy, z);
1873 ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
1874 if (ZEND_IS_INCREMENT(opline->opcode)) {
1875 increment_function(&z_copy);
1876 } else {
1877 decrement_function(&z_copy);
1878 }
1879 object->handlers->write_property(object, name, &z_copy, cache_slot);
1880 OBJ_RELEASE(object);
1881 zval_ptr_dtor(&z_copy);
1882 zval_ptr_dtor(z);
1883 }
1884
zend_pre_incdec_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot OPLINE_DC EXECUTE_DATA_DC)1885 static zend_never_inline void zend_pre_incdec_overloaded_property(zend_object *object, zend_string *name, void **cache_slot OPLINE_DC EXECUTE_DATA_DC)
1886 {
1887 zval rv;
1888 zval *z;
1889 zval z_copy;
1890
1891 GC_ADDREF(object);
1892 z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
1893 if (UNEXPECTED(EG(exception))) {
1894 OBJ_RELEASE(object);
1895 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1896 ZVAL_NULL(EX_VAR(opline->result.var));
1897 }
1898 return;
1899 }
1900
1901 ZVAL_COPY_DEREF(&z_copy, z);
1902 if (ZEND_IS_INCREMENT(opline->opcode)) {
1903 increment_function(&z_copy);
1904 } else {
1905 decrement_function(&z_copy);
1906 }
1907 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1908 ZVAL_COPY(EX_VAR(opline->result.var), &z_copy);
1909 }
1910 object->handlers->write_property(object, name, &z_copy, cache_slot);
1911 OBJ_RELEASE(object);
1912 zval_ptr_dtor(&z_copy);
1913 zval_ptr_dtor(z);
1914 }
1915
zend_assign_op_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot,zval * value OPLINE_DC EXECUTE_DATA_DC)1916 static zend_never_inline void zend_assign_op_overloaded_property(zend_object *object, zend_string *name, void **cache_slot, zval *value OPLINE_DC EXECUTE_DATA_DC)
1917 {
1918 zval *z;
1919 zval rv, res;
1920
1921 GC_ADDREF(object);
1922 z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
1923 if (UNEXPECTED(EG(exception))) {
1924 OBJ_RELEASE(object);
1925 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1926 ZVAL_UNDEF(EX_VAR(opline->result.var));
1927 }
1928 return;
1929 }
1930 if (zend_binary_op(&res, z, value OPLINE_CC) == SUCCESS) {
1931 object->handlers->write_property(object, name, &res, cache_slot);
1932 }
1933 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
1934 ZVAL_COPY(EX_VAR(opline->result.var), &res);
1935 }
1936 zval_ptr_dtor(z);
1937 zval_ptr_dtor(&res);
1938 OBJ_RELEASE(object);
1939 }
1940
1941 /* Utility Functions for Extensions */
zend_extension_statement_handler(const zend_extension * extension,zend_execute_data * frame)1942 static void zend_extension_statement_handler(const zend_extension *extension, zend_execute_data *frame)
1943 {
1944 if (extension->statement_handler) {
1945 extension->statement_handler(frame);
1946 }
1947 }
1948
1949
zend_extension_fcall_begin_handler(const zend_extension * extension,zend_execute_data * frame)1950 static void zend_extension_fcall_begin_handler(const zend_extension *extension, zend_execute_data *frame)
1951 {
1952 if (extension->fcall_begin_handler) {
1953 extension->fcall_begin_handler(frame);
1954 }
1955 }
1956
1957
zend_extension_fcall_end_handler(const zend_extension * extension,zend_execute_data * frame)1958 static void zend_extension_fcall_end_handler(const zend_extension *extension, zend_execute_data *frame)
1959 {
1960 if (extension->fcall_end_handler) {
1961 extension->fcall_end_handler(frame);
1962 }
1963 }
1964
1965
zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)1966 static zend_always_inline HashTable *zend_get_target_symbol_table(int fetch_type EXECUTE_DATA_DC)
1967 {
1968 HashTable *ht;
1969
1970 if (EXPECTED(fetch_type & (ZEND_FETCH_GLOBAL_LOCK | ZEND_FETCH_GLOBAL))) {
1971 ht = &EG(symbol_table);
1972 } else {
1973 ZEND_ASSERT(fetch_type & ZEND_FETCH_LOCAL);
1974 if (!(EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE)) {
1975 zend_rebuild_symbol_table();
1976 }
1977 ht = EX(symbol_table);
1978 }
1979 return ht;
1980 }
1981
zend_undefined_offset(zend_long lval)1982 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_offset(zend_long lval)
1983 {
1984 zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, lval);
1985 }
1986
zend_undefined_index(const zend_string * offset)1987 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_index(const zend_string *offset)
1988 {
1989 zend_error(E_WARNING, "Undefined array key \"%s\"", ZSTR_VAL(offset));
1990 }
1991
zend_undefined_offset_write(HashTable * ht,zend_long lval)1992 ZEND_API ZEND_COLD zend_result ZEND_FASTCALL zend_undefined_offset_write(HashTable *ht, zend_long lval)
1993 {
1994 /* The array may be destroyed while throwing the notice.
1995 * Temporarily increase the refcount to detect this situation. */
1996 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
1997 GC_ADDREF(ht);
1998 }
1999 zend_undefined_offset(lval);
2000 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2001 zend_array_destroy(ht);
2002 return FAILURE;
2003 }
2004 if (EG(exception)) {
2005 return FAILURE;
2006 }
2007 return SUCCESS;
2008 }
2009
zend_undefined_index_write(HashTable * ht,zend_string * offset)2010 ZEND_API ZEND_COLD zend_result ZEND_FASTCALL zend_undefined_index_write(HashTable *ht, zend_string *offset)
2011 {
2012 /* The array may be destroyed while throwing the notice.
2013 * Temporarily increase the refcount to detect this situation. */
2014 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2015 GC_ADDREF(ht);
2016 }
2017 zend_undefined_index(offset);
2018 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2019 zend_array_destroy(ht);
2020 return FAILURE;
2021 }
2022 if (EG(exception)) {
2023 return FAILURE;
2024 }
2025 return SUCCESS;
2026 }
2027
zend_undefined_method(const zend_class_entry * ce,const zend_string * method)2028 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
2029 {
2030 zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
2031 }
2032
zend_invalid_method_call(zval * object,zval * function_name)2033 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_invalid_method_call(zval *object, zval *function_name)
2034 {
2035 zend_throw_error(NULL, "Call to a member function %s() on %s",
2036 Z_STRVAL_P(function_name), zend_zval_type_name(object));
2037 }
2038
zend_non_static_method_call(const zend_function * fbc)2039 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_non_static_method_call(const zend_function *fbc)
2040 {
2041 zend_throw_error(
2042 zend_ce_error,
2043 "Non-static method %s::%s() cannot be called statically",
2044 ZSTR_VAL(fbc->common.scope->name), ZSTR_VAL(fbc->common.function_name));
2045 }
2046
zend_param_must_be_ref(const zend_function * func,uint32_t arg_num)2047 ZEND_COLD void ZEND_FASTCALL zend_param_must_be_ref(const zend_function *func, uint32_t arg_num)
2048 {
2049 const char *arg_name = get_function_arg_name(func, arg_num);
2050
2051 zend_error(E_WARNING, "%s%s%s(): Argument #%d%s%s%s must be passed by reference, value given",
2052 func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
2053 func->common.scope ? "::" : "",
2054 ZSTR_VAL(func->common.function_name),
2055 arg_num,
2056 arg_name ? " ($" : "",
2057 arg_name ? arg_name : "",
2058 arg_name ? ")" : ""
2059 );
2060 }
2061
zend_use_scalar_as_array(void)2062 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_scalar_as_array(void)
2063 {
2064 zend_throw_error(NULL, "Cannot use a scalar value as an array");
2065 }
2066
zend_cannot_add_element(void)2067 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_cannot_add_element(void)
2068 {
2069 zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
2070 }
2071
zend_use_resource_as_offset(const zval * dim)2072 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_resource_as_offset(const zval *dim)
2073 {
2074 zend_error(E_WARNING, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(dim), Z_RES_HANDLE_P(dim));
2075 }
2076
zend_use_new_element_for_string(void)2077 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_use_new_element_for_string(void)
2078 {
2079 zend_throw_error(NULL, "[] operator not supported for strings");
2080 }
2081
zend_binary_assign_op_dim_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2082 static ZEND_COLD void zend_binary_assign_op_dim_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2083 {
2084 if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2085 if (opline->op2_type == IS_UNUSED) {
2086 zend_use_new_element_for_string();
2087 } else {
2088 zend_check_string_offset(dim, BP_VAR_RW EXECUTE_DATA_CC);
2089 zend_wrong_string_offset(EXECUTE_DATA_C);
2090 }
2091 } else {
2092 zend_use_scalar_as_array();
2093 }
2094 }
2095
slow_index_convert(HashTable * ht,const zval * dim,zend_value * value EXECUTE_DATA_DC)2096 static zend_never_inline zend_uchar slow_index_convert(HashTable *ht, const zval *dim, zend_value *value EXECUTE_DATA_DC)
2097 {
2098 switch (Z_TYPE_P(dim)) {
2099 case IS_UNDEF: {
2100 /* The array may be destroyed while throwing the notice.
2101 * Temporarily increase the refcount to detect this situation. */
2102 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
2103 GC_ADDREF(ht);
2104 }
2105 ZVAL_UNDEFINED_OP2();
2106 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
2107 zend_array_destroy(ht);
2108 return IS_NULL;
2109 }
2110 if (EG(exception)) {
2111 return IS_NULL;
2112 }
2113 /* break missing intentionally */
2114 }
2115 case IS_NULL:
2116 value->str = ZSTR_EMPTY_ALLOC();
2117 return IS_STRING;
2118 case IS_DOUBLE:
2119 value->lval = zend_dval_to_lval(Z_DVAL_P(dim));
2120 return IS_LONG;
2121 case IS_RESOURCE:
2122 zend_use_resource_as_offset(dim);
2123 value->lval = Z_RES_HANDLE_P(dim);
2124 return IS_LONG;
2125 case IS_FALSE:
2126 value->lval = 0;
2127 return IS_LONG;
2128 case IS_TRUE:
2129 value->lval = 1;
2130 return IS_LONG;
2131 default:
2132 zend_illegal_offset();
2133 return IS_NULL;
2134 }
2135 }
2136
zend_fetch_dimension_address_inner(HashTable * ht,const zval * dim,int dim_type,int type EXECUTE_DATA_DC)2137 static zend_always_inline zval *zend_fetch_dimension_address_inner(HashTable *ht, const zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2138 {
2139 zval *retval = NULL;
2140 zend_string *offset_key;
2141 zend_ulong hval;
2142
2143 try_again:
2144 if (EXPECTED(Z_TYPE_P(dim) == IS_LONG)) {
2145 hval = Z_LVAL_P(dim);
2146 num_index:
2147 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
2148 return retval;
2149 num_undef:
2150 switch (type) {
2151 case BP_VAR_R:
2152 zend_undefined_offset(hval);
2153 /* break missing intentionally */
2154 case BP_VAR_UNSET:
2155 case BP_VAR_IS:
2156 retval = &EG(uninitialized_zval);
2157 break;
2158 case BP_VAR_RW:
2159 if (UNEXPECTED(zend_undefined_offset_write(ht, hval) == FAILURE)) {
2160 return NULL;
2161 }
2162 /* break missing intentionally */
2163 case BP_VAR_W:
2164 retval = zend_hash_index_add_new(ht, hval, &EG(uninitialized_zval));
2165 break;
2166 }
2167 } else if (EXPECTED(Z_TYPE_P(dim) == IS_STRING)) {
2168 offset_key = Z_STR_P(dim);
2169 if (ZEND_CONST_COND(dim_type != IS_CONST, 1)) {
2170 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
2171 goto num_index;
2172 }
2173 }
2174 str_index:
2175 retval = zend_hash_find_ex(ht, offset_key, ZEND_CONST_COND(dim_type == IS_CONST, 0));
2176 if (retval) {
2177 /* support for $GLOBALS[...] */
2178 if (UNEXPECTED(Z_TYPE_P(retval) == IS_INDIRECT)) {
2179 retval = Z_INDIRECT_P(retval);
2180 if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
2181 switch (type) {
2182 case BP_VAR_R:
2183 zend_undefined_index(offset_key);
2184 /* break missing intentionally */
2185 case BP_VAR_UNSET:
2186 case BP_VAR_IS:
2187 retval = &EG(uninitialized_zval);
2188 break;
2189 case BP_VAR_RW:
2190 if (UNEXPECTED(zend_undefined_index_write(ht, offset_key))) {
2191 return NULL;
2192 }
2193 /* break missing intentionally */
2194 case BP_VAR_W:
2195 ZVAL_NULL(retval);
2196 break;
2197 }
2198 }
2199 }
2200 } else {
2201 switch (type) {
2202 case BP_VAR_R:
2203 zend_undefined_index(offset_key);
2204 /* break missing intentionally */
2205 case BP_VAR_UNSET:
2206 case BP_VAR_IS:
2207 retval = &EG(uninitialized_zval);
2208 break;
2209 case BP_VAR_RW:
2210 /* Key may be released while throwing the undefined index warning. */
2211 zend_string_addref(offset_key);
2212 if (UNEXPECTED(zend_undefined_index_write(ht, offset_key) == FAILURE)) {
2213 zend_string_release(offset_key);
2214 return NULL;
2215 }
2216 retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
2217 zend_string_release(offset_key);
2218 break;
2219 case BP_VAR_W:
2220 retval = zend_hash_add_new(ht, offset_key, &EG(uninitialized_zval));
2221 break;
2222 }
2223 }
2224 } else if (EXPECTED(Z_TYPE_P(dim) == IS_REFERENCE)) {
2225 dim = Z_REFVAL_P(dim);
2226 goto try_again;
2227 } else {
2228 zend_value val;
2229 zend_uchar t = slow_index_convert(ht, dim, &val EXECUTE_DATA_CC);
2230
2231 if (t == IS_STRING) {
2232 offset_key = val.str;
2233 goto str_index;
2234 } else if (t == IS_LONG) {
2235 hval = val.lval;
2236 goto num_index;
2237 } else {
2238 retval = (type == BP_VAR_W || type == BP_VAR_RW) ?
2239 NULL : &EG(uninitialized_zval);
2240 }
2241 }
2242 return retval;
2243 }
2244
zend_fetch_dimension_address_inner_W(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2245 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2246 {
2247 return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_W EXECUTE_DATA_CC);
2248 }
2249
zend_fetch_dimension_address_inner_W_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2250 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_W_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2251 {
2252 return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_W EXECUTE_DATA_CC);
2253 }
2254
zend_fetch_dimension_address_inner_RW(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2255 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2256 {
2257 return zend_fetch_dimension_address_inner(ht, dim, IS_TMP_VAR, BP_VAR_RW EXECUTE_DATA_CC);
2258 }
2259
zend_fetch_dimension_address_inner_RW_CONST(HashTable * ht,const zval * dim EXECUTE_DATA_DC)2260 static zend_never_inline zval* ZEND_FASTCALL zend_fetch_dimension_address_inner_RW_CONST(HashTable *ht, const zval *dim EXECUTE_DATA_DC)
2261 {
2262 return zend_fetch_dimension_address_inner(ht, dim, IS_CONST, BP_VAR_RW EXECUTE_DATA_CC);
2263 }
2264
zend_fetch_dimension_address(zval * result,zval * container,zval * dim,int dim_type,int type EXECUTE_DATA_DC)2265 static zend_always_inline void zend_fetch_dimension_address(zval *result, zval *container, zval *dim, int dim_type, int type EXECUTE_DATA_DC)
2266 {
2267 zval *retval;
2268
2269 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2270 try_array:
2271 SEPARATE_ARRAY(container);
2272 fetch_from_array:
2273 if (dim == NULL) {
2274 retval = zend_hash_next_index_insert(Z_ARRVAL_P(container), &EG(uninitialized_zval));
2275 if (UNEXPECTED(retval == NULL)) {
2276 zend_cannot_add_element();
2277 ZVAL_UNDEF(result);
2278 return;
2279 }
2280 } else {
2281 retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2282 if (UNEXPECTED(!retval)) {
2283 /* This may fail without throwing if the array was modified while throwing an
2284 * undefined index error. */
2285 ZVAL_NULL(result);
2286 return;
2287 }
2288 }
2289 ZVAL_INDIRECT(result, retval);
2290 return;
2291 } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2292 zend_reference *ref = Z_REF_P(container);
2293 container = Z_REFVAL_P(container);
2294 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2295 goto try_array;
2296 } else if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2297 if (type != BP_VAR_UNSET) {
2298 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
2299 if (UNEXPECTED(!zend_verify_ref_array_assignable(ref))) {
2300 ZVAL_UNDEF(result);
2301 return;
2302 }
2303 }
2304 array_init(container);
2305 goto fetch_from_array;
2306 } else {
2307 goto return_null;
2308 }
2309 }
2310 }
2311 if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2312 if (dim == NULL) {
2313 zend_use_new_element_for_string();
2314 } else {
2315 zend_check_string_offset(dim, type EXECUTE_DATA_CC);
2316 zend_wrong_string_offset(EXECUTE_DATA_C);
2317 }
2318 ZVAL_UNDEF(result);
2319 } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2320 zend_object *obj = Z_OBJ_P(container);
2321 GC_ADDREF(obj);
2322 if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2323 dim = ZVAL_UNDEFINED_OP2();
2324 } else if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2325 dim++;
2326 }
2327 retval = obj->handlers->read_dimension(obj, dim, type, result);
2328
2329 if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
2330 zend_class_entry *ce = obj->ce;
2331
2332 ZVAL_NULL(result);
2333 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2334 } else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
2335 if (!Z_ISREF_P(retval)) {
2336 if (result != retval) {
2337 ZVAL_COPY(result, retval);
2338 retval = result;
2339 }
2340 if (Z_TYPE_P(retval) != IS_OBJECT) {
2341 zend_class_entry *ce = obj->ce;
2342 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
2343 }
2344 } else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) {
2345 ZVAL_UNREF(retval);
2346 }
2347 if (result != retval) {
2348 ZVAL_INDIRECT(result, retval);
2349 }
2350 } else {
2351 ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception");
2352 ZVAL_UNDEF(result);
2353 }
2354 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
2355 zend_objects_store_del(obj);
2356 }
2357 } else {
2358 if (EXPECTED(Z_TYPE_P(container) <= IS_FALSE)) {
2359 if (type != BP_VAR_W && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2360 ZVAL_UNDEFINED_OP1();
2361 }
2362 if (type != BP_VAR_UNSET) {
2363 array_init(container);
2364 goto fetch_from_array;
2365 } else {
2366 return_null:
2367 /* for read-mode only */
2368 if (ZEND_CONST_COND(dim_type == IS_CV, dim != NULL) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2369 ZVAL_UNDEFINED_OP2();
2370 }
2371 ZVAL_NULL(result);
2372 }
2373 } else {
2374 if (type == BP_VAR_UNSET) {
2375 zend_throw_error(NULL, "Cannot unset offset in a non-array variable");
2376 ZVAL_UNDEF(result);
2377 } else {
2378 zend_use_scalar_as_array();
2379 ZVAL_UNDEF(result);
2380 }
2381 }
2382 }
2383 }
2384
zend_fetch_dimension_address_W(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2385 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_W(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2386 {
2387 zval *result = EX_VAR(opline->result.var);
2388 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_W EXECUTE_DATA_CC);
2389 }
2390
zend_fetch_dimension_address_RW(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2391 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_RW(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2392 {
2393 zval *result = EX_VAR(opline->result.var);
2394 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_RW EXECUTE_DATA_CC);
2395 }
2396
zend_fetch_dimension_address_UNSET(zval * container_ptr,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2397 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_UNSET(zval *container_ptr, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2398 {
2399 zval *result = EX_VAR(opline->result.var);
2400 zend_fetch_dimension_address(result, container_ptr, dim, dim_type, BP_VAR_UNSET EXECUTE_DATA_CC);
2401 }
2402
zend_fetch_dimension_address_read(zval * result,zval * container,zval * dim,int dim_type,int type,bool is_list,int slow EXECUTE_DATA_DC)2403 static zend_always_inline void zend_fetch_dimension_address_read(zval *result, zval *container, zval *dim, int dim_type, int type, bool is_list, int slow EXECUTE_DATA_DC)
2404 {
2405 zval *retval;
2406
2407 if (!slow) {
2408 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2409 try_array:
2410 retval = zend_fetch_dimension_address_inner(Z_ARRVAL_P(container), dim, dim_type, type EXECUTE_DATA_CC);
2411 ZVAL_COPY_DEREF(result, retval);
2412 return;
2413 } else if (EXPECTED(Z_TYPE_P(container) == IS_REFERENCE)) {
2414 container = Z_REFVAL_P(container);
2415 if (EXPECTED(Z_TYPE_P(container) == IS_ARRAY)) {
2416 goto try_array;
2417 }
2418 }
2419 }
2420 if (!is_list && EXPECTED(Z_TYPE_P(container) == IS_STRING)) {
2421 zend_string *str = Z_STR_P(container);
2422 zend_long offset;
2423
2424 try_string_offset:
2425 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
2426 switch (Z_TYPE_P(dim)) {
2427 case IS_STRING:
2428 {
2429 bool trailing_data = false;
2430 /* For BC reasons we allow errors so that we can warn on leading numeric string */
2431 if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset,
2432 NULL, /* allow errors */ true, NULL, &trailing_data)) {
2433 if (UNEXPECTED(trailing_data)) {
2434 zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
2435 }
2436 goto out;
2437 }
2438 if (type == BP_VAR_IS) {
2439 ZVAL_NULL(result);
2440 return;
2441 }
2442 zend_illegal_string_offset(dim);
2443 ZVAL_NULL(result);
2444 return;
2445 }
2446 case IS_UNDEF:
2447 /* The string may be destroyed while throwing the notice.
2448 * Temporarily increase the refcount to detect this situation. */
2449 if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
2450 GC_ADDREF(str);
2451 }
2452 ZVAL_UNDEFINED_OP2();
2453 if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
2454 zend_string_efree(str);
2455 ZVAL_NULL(result);
2456 return;
2457 }
2458 case IS_DOUBLE:
2459 case IS_NULL:
2460 case IS_FALSE:
2461 case IS_TRUE:
2462 if (type != BP_VAR_IS) {
2463 /* The string may be destroyed while throwing the notice.
2464 * Temporarily increase the refcount to detect this situation. */
2465 if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
2466 GC_ADDREF(str);
2467 }
2468 zend_error(E_WARNING, "String offset cast occurred");
2469 if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
2470 zend_string_efree(str);
2471 ZVAL_NULL(result);
2472 return;
2473 }
2474 }
2475 break;
2476 case IS_REFERENCE:
2477 dim = Z_REFVAL_P(dim);
2478 goto try_string_offset;
2479 default:
2480 zend_illegal_string_offset(dim);
2481 ZVAL_NULL(result);
2482 return;
2483 }
2484
2485 offset = zval_get_long_func(dim);
2486 } else {
2487 offset = Z_LVAL_P(dim);
2488 }
2489 out:
2490
2491 if (UNEXPECTED(ZSTR_LEN(str) < ((offset < 0) ? -(size_t)offset : ((size_t)offset + 1)))) {
2492 if (type != BP_VAR_IS) {
2493 zend_error(E_WARNING, "Uninitialized string offset " ZEND_LONG_FMT, offset);
2494 ZVAL_EMPTY_STRING(result);
2495 } else {
2496 ZVAL_NULL(result);
2497 }
2498 } else {
2499 zend_uchar c;
2500 zend_long real_offset;
2501
2502 real_offset = (UNEXPECTED(offset < 0)) /* Handle negative offset */
2503 ? (zend_long)ZSTR_LEN(str) + offset : offset;
2504 c = (zend_uchar)ZSTR_VAL(str)[real_offset];
2505
2506 ZVAL_CHAR(result, c);
2507 }
2508 } else if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2509 zend_object *obj = Z_OBJ_P(container);
2510
2511 GC_ADDREF(obj);
2512 if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2513 dim = ZVAL_UNDEFINED_OP2();
2514 }
2515 if (dim_type == IS_CONST && Z_EXTRA_P(dim) == ZEND_EXTRA_VALUE) {
2516 dim++;
2517 }
2518 retval = obj->handlers->read_dimension(obj, dim, type, result);
2519
2520 ZEND_ASSERT(result != NULL);
2521 if (retval) {
2522 if (result != retval) {
2523 ZVAL_COPY_DEREF(result, retval);
2524 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
2525 zend_unwrap_reference(result);
2526 }
2527 } else {
2528 ZVAL_NULL(result);
2529 }
2530 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
2531 zend_objects_store_del(obj);
2532 }
2533 } else {
2534 if (type != BP_VAR_IS && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2535 container = ZVAL_UNDEFINED_OP1();
2536 }
2537 if (ZEND_CONST_COND(dim_type == IS_CV, 1) && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
2538 ZVAL_UNDEFINED_OP2();
2539 }
2540 if (!is_list && type != BP_VAR_IS) {
2541 zend_error(E_WARNING, "Trying to access array offset on value of type %s",
2542 zend_zval_type_name(container));
2543 }
2544 ZVAL_NULL(result);
2545 }
2546 }
2547
zend_fetch_dimension_address_read_R(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2548 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_R(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2549 {
2550 zval *result = EX_VAR(opline->result.var);
2551 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 0, 0 EXECUTE_DATA_CC);
2552 }
2553
zend_fetch_dimension_address_read_R_slow(zval * container,zval * dim OPLINE_DC EXECUTE_DATA_DC)2554 static zend_never_inline void zend_fetch_dimension_address_read_R_slow(zval *container, zval *dim OPLINE_DC EXECUTE_DATA_DC)
2555 {
2556 zval *result = EX_VAR(opline->result.var);
2557 zend_fetch_dimension_address_read(result, container, dim, IS_CV, BP_VAR_R, 0, 1 EXECUTE_DATA_CC);
2558 }
2559
zend_fetch_dimension_address_read_IS(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2560 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_read_IS(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2561 {
2562 zval *result = EX_VAR(opline->result.var);
2563 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_IS, 0, 0 EXECUTE_DATA_CC);
2564 }
2565
zend_fetch_dimension_address_LIST_r(zval * container,zval * dim,int dim_type OPLINE_DC EXECUTE_DATA_DC)2566 static zend_never_inline void ZEND_FASTCALL zend_fetch_dimension_address_LIST_r(zval *container, zval *dim, int dim_type OPLINE_DC EXECUTE_DATA_DC)
2567 {
2568 zval *result = EX_VAR(opline->result.var);
2569 zend_fetch_dimension_address_read(result, container, dim, dim_type, BP_VAR_R, 1, 0 EXECUTE_DATA_CC);
2570 }
2571
zend_fetch_dimension_const(zval * result,zval * container,zval * dim,int type)2572 ZEND_API void zend_fetch_dimension_const(zval *result, zval *container, zval *dim, int type)
2573 {
2574 zend_fetch_dimension_address_read(result, container, dim, IS_TMP_VAR, type, 0, 0 NO_EXECUTE_DATA_CC);
2575 }
2576
zend_find_array_dim_slow(HashTable * ht,zval * offset EXECUTE_DATA_DC)2577 static zend_never_inline zval* ZEND_FASTCALL zend_find_array_dim_slow(HashTable *ht, zval *offset EXECUTE_DATA_DC)
2578 {
2579 zend_ulong hval;
2580
2581 if (Z_TYPE_P(offset) == IS_DOUBLE) {
2582 hval = zend_dval_to_lval(Z_DVAL_P(offset));
2583 num_idx:
2584 return zend_hash_index_find(ht, hval);
2585 } else if (Z_TYPE_P(offset) == IS_NULL) {
2586 str_idx:
2587 return zend_hash_find_ex_ind(ht, ZSTR_EMPTY_ALLOC(), 1);
2588 } else if (Z_TYPE_P(offset) == IS_FALSE) {
2589 hval = 0;
2590 goto num_idx;
2591 } else if (Z_TYPE_P(offset) == IS_TRUE) {
2592 hval = 1;
2593 goto num_idx;
2594 } else if (Z_TYPE_P(offset) == IS_RESOURCE) {
2595 zend_use_resource_as_offset(offset);
2596 hval = Z_RES_HANDLE_P(offset);
2597 goto num_idx;
2598 } else if (/*OP2_TYPE == IS_CV &&*/ Z_TYPE_P(offset) == IS_UNDEF) {
2599 ZVAL_UNDEFINED_OP2();
2600 goto str_idx;
2601 } else {
2602 zend_type_error("Illegal offset type in isset or empty");
2603 return NULL;
2604 }
2605 }
2606
zend_isset_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2607 static zend_never_inline bool ZEND_FASTCALL zend_isset_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2608 {
2609 if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2610 offset = ZVAL_UNDEFINED_OP2();
2611 }
2612
2613 if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2614 return Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 0);
2615 } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2616 zend_long lval;
2617
2618 if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2619 lval = Z_LVAL_P(offset);
2620 str_offset:
2621 if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2622 lval += (zend_long)Z_STRLEN_P(container);
2623 }
2624 if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2625 return 1;
2626 } else {
2627 return 0;
2628 }
2629 } else {
2630 /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2631 ZVAL_DEREF(offset);
2632 /*}*/
2633 if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
2634 || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
2635 && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
2636 lval = zval_get_long(offset);
2637 goto str_offset;
2638 }
2639 return 0;
2640 }
2641 } else {
2642 return 0;
2643 }
2644 }
2645
zend_isempty_dim_slow(zval * container,zval * offset EXECUTE_DATA_DC)2646 static zend_never_inline bool ZEND_FASTCALL zend_isempty_dim_slow(zval *container, zval *offset EXECUTE_DATA_DC)
2647 {
2648 if (/*OP2_TYPE == IS_CV &&*/ UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
2649 offset = ZVAL_UNDEFINED_OP2();
2650 }
2651
2652 if (/*OP1_TYPE != IS_CONST &&*/ EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
2653 return !Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 1);
2654 } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
2655 zend_long lval;
2656
2657 if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
2658 lval = Z_LVAL_P(offset);
2659 str_offset:
2660 if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
2661 lval += (zend_long)Z_STRLEN_P(container);
2662 }
2663 if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
2664 return (Z_STRVAL_P(container)[lval] == '0');
2665 } else {
2666 return 1;
2667 }
2668 } else {
2669 /*if (OP2_TYPE & (IS_CV|IS_VAR)) {*/
2670 ZVAL_DEREF(offset);
2671 /*}*/
2672 if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
2673 || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
2674 && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, 0))) {
2675 lval = zval_get_long(offset);
2676 goto str_offset;
2677 }
2678 return 1;
2679 }
2680 } else {
2681 return 1;
2682 }
2683 }
2684
zend_array_key_exists_fast(HashTable * ht,zval * key OPLINE_DC EXECUTE_DATA_DC)2685 static zend_never_inline zend_bool ZEND_FASTCALL zend_array_key_exists_fast(HashTable *ht, zval *key OPLINE_DC EXECUTE_DATA_DC)
2686 {
2687 zend_string *str;
2688 zend_ulong hval;
2689
2690 try_again:
2691 if (EXPECTED(Z_TYPE_P(key) == IS_STRING)) {
2692 str = Z_STR_P(key);
2693 if (ZEND_HANDLE_NUMERIC(str, hval)) {
2694 goto num_key;
2695 }
2696 str_key:
2697 return zend_hash_find_ind(ht, str) != NULL;
2698 } else if (EXPECTED(Z_TYPE_P(key) == IS_LONG)) {
2699 hval = Z_LVAL_P(key);
2700 num_key:
2701 return zend_hash_index_find(ht, hval) != NULL;
2702 } else if (EXPECTED(Z_ISREF_P(key))) {
2703 key = Z_REFVAL_P(key);
2704 goto try_again;
2705 } else if (Z_TYPE_P(key) == IS_DOUBLE) {
2706 hval = zend_dval_to_lval(Z_DVAL_P(key));
2707 goto num_key;
2708 } else if (Z_TYPE_P(key) == IS_FALSE) {
2709 hval = 0;
2710 goto num_key;
2711 } else if (Z_TYPE_P(key) == IS_TRUE) {
2712 hval = 1;
2713 goto num_key;
2714 } else if (Z_TYPE_P(key) == IS_RESOURCE) {
2715 zend_use_resource_as_offset(key);
2716 hval = Z_RES_HANDLE_P(key);
2717 goto num_key;
2718 } else if (Z_TYPE_P(key) <= IS_NULL) {
2719 if (UNEXPECTED(Z_TYPE_P(key) == IS_UNDEF)) {
2720 ZVAL_UNDEFINED_OP1();
2721 }
2722 str = ZSTR_EMPTY_ALLOC();
2723 goto str_key;
2724 } else {
2725 zend_illegal_offset();
2726 return 0;
2727 }
2728 }
2729
zend_array_key_exists_error(zval * subject,zval * key OPLINE_DC EXECUTE_DATA_DC)2730 static ZEND_COLD void ZEND_FASTCALL zend_array_key_exists_error(
2731 zval *subject, zval *key OPLINE_DC EXECUTE_DATA_DC)
2732 {
2733 if (Z_TYPE_P(key) == IS_UNDEF) {
2734 ZVAL_UNDEFINED_OP1();
2735 }
2736 if (Z_TYPE_P(subject) == IS_UNDEF) {
2737 ZVAL_UNDEFINED_OP2();
2738 }
2739 if (!EG(exception)) {
2740 zend_type_error("array_key_exists(): Argument #2 ($array) must be of type array, %s given",
2741 zend_zval_type_name(subject));
2742 }
2743 }
2744
promotes_to_array(zval * val)2745 static zend_always_inline zend_bool promotes_to_array(zval *val) {
2746 return Z_TYPE_P(val) <= IS_FALSE
2747 || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE);
2748 }
2749
check_type_array_assignable(zend_type type)2750 static zend_always_inline zend_bool check_type_array_assignable(zend_type type) {
2751 if (!ZEND_TYPE_IS_SET(type)) {
2752 return 1;
2753 }
2754 return (ZEND_TYPE_FULL_MASK(type) & (MAY_BE_ITERABLE|MAY_BE_ARRAY)) != 0;
2755 }
2756
2757 /* Checks whether an array can be assigned to the reference. Throws error if not assignable. */
zend_verify_ref_array_assignable(zend_reference * ref)2758 ZEND_API zend_bool zend_verify_ref_array_assignable(zend_reference *ref) {
2759 zend_property_info *prop;
2760 ZEND_ASSERT(ZEND_REF_HAS_TYPE_SOURCES(ref));
2761 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
2762 if (!check_type_array_assignable(prop->type)) {
2763 zend_throw_auto_init_in_ref_error(prop, "array");
2764 return 0;
2765 }
2766 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
2767 return 1;
2768 }
2769
zend_object_fetch_property_type_info(zend_object * obj,zval * slot)2770 static zend_property_info *zend_object_fetch_property_type_info(
2771 zend_object *obj, zval *slot)
2772 {
2773 if (EXPECTED(!ZEND_CLASS_HAS_TYPE_HINTS(obj->ce))) {
2774 return NULL;
2775 }
2776
2777 /* Not a declared property */
2778 if (UNEXPECTED(slot < obj->properties_table ||
2779 slot >= obj->properties_table + obj->ce->default_properties_count)) {
2780 return NULL;
2781 }
2782
2783 return zend_get_typed_property_info_for_slot(obj, slot);
2784 }
2785
zend_handle_fetch_obj_flags(zval * result,zval * ptr,zend_object * obj,zend_property_info * prop_info,uint32_t flags)2786 static zend_never_inline zend_bool zend_handle_fetch_obj_flags(
2787 zval *result, zval *ptr, zend_object *obj, zend_property_info *prop_info, uint32_t flags)
2788 {
2789 switch (flags) {
2790 case ZEND_FETCH_DIM_WRITE:
2791 if (promotes_to_array(ptr)) {
2792 if (!prop_info) {
2793 prop_info = zend_object_fetch_property_type_info(obj, ptr);
2794 if (!prop_info) {
2795 break;
2796 }
2797 }
2798 if (!check_type_array_assignable(prop_info->type)) {
2799 zend_throw_auto_init_in_prop_error(prop_info, "array");
2800 if (result) ZVAL_ERROR(result);
2801 return 0;
2802 }
2803 }
2804 break;
2805 case ZEND_FETCH_REF:
2806 if (Z_TYPE_P(ptr) != IS_REFERENCE) {
2807 if (!prop_info) {
2808 prop_info = zend_object_fetch_property_type_info(obj, ptr);
2809 if (!prop_info) {
2810 break;
2811 }
2812 }
2813 if (Z_TYPE_P(ptr) == IS_UNDEF) {
2814 if (!ZEND_TYPE_ALLOW_NULL(prop_info->type)) {
2815 zend_throw_access_uninit_prop_by_ref_error(prop_info);
2816 if (result) ZVAL_ERROR(result);
2817 return 0;
2818 }
2819 ZVAL_NULL(ptr);
2820 }
2821
2822 ZVAL_NEW_REF(ptr, ptr);
2823 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(ptr), prop_info);
2824 }
2825 break;
2826 EMPTY_SWITCH_DEFAULT_CASE()
2827 }
2828 return 1;
2829 }
2830
zend_fetch_property_address(zval * result,zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,void ** cache_slot,int type,uint32_t flags,zend_bool init_undef OPLINE_DC EXECUTE_DATA_DC)2831 static zend_always_inline void zend_fetch_property_address(zval *result, zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, void **cache_slot, int type, uint32_t flags, zend_bool init_undef OPLINE_DC EXECUTE_DATA_DC)
2832 {
2833 zval *ptr;
2834 zend_object *zobj;
2835 zend_string *name, *tmp_name;
2836
2837 if (container_op_type != IS_UNUSED && UNEXPECTED(Z_TYPE_P(container) != IS_OBJECT)) {
2838 do {
2839 if (Z_ISREF_P(container) && Z_TYPE_P(Z_REFVAL_P(container)) == IS_OBJECT) {
2840 container = Z_REFVAL_P(container);
2841 break;
2842 }
2843
2844 if (container_op_type == IS_CV
2845 && type != BP_VAR_W
2846 && UNEXPECTED(Z_TYPE_P(container) == IS_UNDEF)) {
2847 ZVAL_UNDEFINED_OP1();
2848 }
2849
2850 /* this should modify object only if it's empty */
2851 if (type == BP_VAR_UNSET) {
2852 ZVAL_NULL(result);
2853 return;
2854 }
2855
2856 zend_throw_non_object_error(container, prop_ptr OPLINE_CC EXECUTE_DATA_CC);
2857 ZVAL_ERROR(result);
2858 return;
2859 } while (0);
2860 }
2861
2862 zobj = Z_OBJ_P(container);
2863 if (prop_op_type == IS_CONST &&
2864 EXPECTED(zobj->ce == CACHED_PTR_EX(cache_slot))) {
2865 uintptr_t prop_offset = (uintptr_t)CACHED_PTR_EX(cache_slot + 1);
2866
2867 if (EXPECTED(IS_VALID_PROPERTY_OFFSET(prop_offset))) {
2868 ptr = OBJ_PROP(zobj, prop_offset);
2869 if (EXPECTED(Z_TYPE_P(ptr) != IS_UNDEF)) {
2870 ZVAL_INDIRECT(result, ptr);
2871 if (flags) {
2872 zend_property_info *prop_info = CACHED_PTR_EX(cache_slot + 2);
2873 if (prop_info) {
2874 zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags);
2875 }
2876 }
2877 return;
2878 }
2879 } else if (EXPECTED(zobj->properties != NULL)) {
2880 if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)) {
2881 if (EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
2882 GC_DELREF(zobj->properties);
2883 }
2884 zobj->properties = zend_array_dup(zobj->properties);
2885 }
2886 ptr = zend_hash_find_ex(zobj->properties, Z_STR_P(prop_ptr), 1);
2887 if (EXPECTED(ptr)) {
2888 ZVAL_INDIRECT(result, ptr);
2889 return;
2890 }
2891 }
2892 }
2893
2894 if (prop_op_type == IS_CONST) {
2895 name = Z_STR_P(prop_ptr);
2896 } else {
2897 name = zval_get_tmp_string(prop_ptr, &tmp_name);
2898 }
2899 ptr = zobj->handlers->get_property_ptr_ptr(zobj, name, type, cache_slot);
2900 if (NULL == ptr) {
2901 ptr = zobj->handlers->read_property(zobj, name, type, cache_slot, result);
2902 if (ptr == result) {
2903 if (UNEXPECTED(Z_ISREF_P(ptr) && Z_REFCOUNT_P(ptr) == 1)) {
2904 ZVAL_UNREF(ptr);
2905 }
2906 goto end;
2907 }
2908 if (UNEXPECTED(EG(exception))) {
2909 ZVAL_ERROR(result);
2910 goto end;
2911 }
2912 } else if (UNEXPECTED(Z_ISERROR_P(ptr))) {
2913 ZVAL_ERROR(result);
2914 goto end;
2915 }
2916
2917 ZVAL_INDIRECT(result, ptr);
2918 if (flags) {
2919 zend_property_info *prop_info;
2920
2921 if (prop_op_type == IS_CONST) {
2922 prop_info = CACHED_PTR_EX(cache_slot + 2);
2923 if (prop_info) {
2924 if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, NULL, prop_info, flags))) {
2925 goto end;
2926 }
2927 }
2928 } else {
2929 if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, ptr, Z_OBJ_P(container), NULL, flags))) {
2930 goto end;
2931 }
2932 }
2933 }
2934 if (init_undef && UNEXPECTED(Z_TYPE_P(ptr) == IS_UNDEF)) {
2935 ZVAL_NULL(ptr);
2936 }
2937
2938 end:
2939 if (prop_op_type != IS_CONST) {
2940 zend_tmp_string_release(tmp_name);
2941 }
2942 }
2943
zend_assign_to_property_reference(zval * container,uint32_t container_op_type,zval * prop_ptr,uint32_t prop_op_type,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2944 static zend_always_inline void zend_assign_to_property_reference(zval *container, uint32_t container_op_type, zval *prop_ptr, uint32_t prop_op_type, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2945 {
2946 zval variable, *variable_ptr = &variable;
2947 void **cache_addr = (prop_op_type == IS_CONST) ? CACHE_ADDR(opline->extended_value & ~ZEND_RETURNS_FUNCTION) : NULL;
2948
2949 zend_fetch_property_address(variable_ptr, container, container_op_type, prop_ptr, prop_op_type,
2950 cache_addr, BP_VAR_W, 0, 0 OPLINE_CC EXECUTE_DATA_CC);
2951
2952 if (EXPECTED(Z_TYPE_P(variable_ptr) == IS_INDIRECT)) {
2953 variable_ptr = Z_INDIRECT_P(variable_ptr);
2954 if (/*OP_DATA_TYPE == IS_VAR &&*/
2955 (opline->extended_value & ZEND_RETURNS_FUNCTION) &&
2956 UNEXPECTED(!Z_ISREF_P(value_ptr))) {
2957
2958 variable_ptr = zend_wrong_assign_to_variable_reference(
2959 variable_ptr, value_ptr OPLINE_CC EXECUTE_DATA_CC);
2960 } else {
2961 zend_property_info *prop_info = NULL;
2962
2963 if (prop_op_type == IS_CONST) {
2964 prop_info = (zend_property_info *) CACHED_PTR_EX(cache_addr + 2);
2965 } else {
2966 ZVAL_DEREF(container);
2967 prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(container), variable_ptr);
2968 }
2969
2970 if (UNEXPECTED(prop_info)) {
2971 variable_ptr = zend_assign_to_typed_property_reference(prop_info, variable_ptr, value_ptr EXECUTE_DATA_CC);
2972 } else {
2973 zend_assign_to_variable_reference(variable_ptr, value_ptr);
2974 }
2975 }
2976 } else if (Z_ISERROR_P(variable_ptr)) {
2977 variable_ptr = &EG(uninitialized_zval);
2978 } else {
2979 zend_throw_error(NULL, "Cannot assign by reference to overloaded object");
2980 zval_ptr_dtor(&variable);
2981 variable_ptr = &EG(uninitialized_zval);
2982 }
2983
2984 if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2985 ZVAL_COPY(EX_VAR(opline->result.var), variable_ptr);
2986 }
2987 }
2988
zend_assign_to_property_reference_this_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2989 static zend_never_inline void zend_assign_to_property_reference_this_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2990 {
2991 zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_CONST, value_ptr
2992 OPLINE_CC EXECUTE_DATA_CC);
2993 }
2994
zend_assign_to_property_reference_var_const(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)2995 static zend_never_inline void zend_assign_to_property_reference_var_const(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
2996 {
2997 zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_CONST, value_ptr
2998 OPLINE_CC EXECUTE_DATA_CC);
2999 }
3000
zend_assign_to_property_reference_this_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3001 static zend_never_inline void zend_assign_to_property_reference_this_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3002 {
3003 zend_assign_to_property_reference(container, IS_UNUSED, prop_ptr, IS_VAR, value_ptr
3004 OPLINE_CC EXECUTE_DATA_CC);
3005 }
3006
zend_assign_to_property_reference_var_var(zval * container,zval * prop_ptr,zval * value_ptr OPLINE_DC EXECUTE_DATA_DC)3007 static zend_never_inline void zend_assign_to_property_reference_var_var(zval *container, zval *prop_ptr, zval *value_ptr OPLINE_DC EXECUTE_DATA_DC)
3008 {
3009 zend_assign_to_property_reference(container, IS_VAR, prop_ptr, IS_VAR, value_ptr
3010 OPLINE_CC EXECUTE_DATA_CC);
3011 }
3012
zend_fetch_static_property_address_ex(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type OPLINE_DC EXECUTE_DATA_DC)3013 static zend_never_inline zend_result zend_fetch_static_property_address_ex(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type OPLINE_DC EXECUTE_DATA_DC) {
3014 zend_string *name;
3015 zend_class_entry *ce;
3016 zend_property_info *property_info;
3017
3018 zend_uchar op1_type = opline->op1_type, op2_type = opline->op2_type;
3019
3020 if (EXPECTED(op2_type == IS_CONST)) {
3021 zval *class_name = RT_CONSTANT(opline, opline->op2);
3022
3023 ZEND_ASSERT(op1_type != IS_CONST || CACHED_PTR(cache_slot) == NULL);
3024
3025 if (EXPECTED((ce = CACHED_PTR(cache_slot)) == NULL)) {
3026 ce = zend_fetch_class_by_name(Z_STR_P(class_name), Z_STR_P(class_name + 1), ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
3027 if (UNEXPECTED(ce == NULL)) {
3028 FREE_OP(op1_type, opline->op1.var);
3029 return FAILURE;
3030 }
3031 if (UNEXPECTED(op1_type != IS_CONST)) {
3032 CACHE_PTR(cache_slot, ce);
3033 }
3034 }
3035 } else {
3036 if (EXPECTED(op2_type == IS_UNUSED)) {
3037 ce = zend_fetch_class(NULL, opline->op2.num);
3038 if (UNEXPECTED(ce == NULL)) {
3039 FREE_OP(op1_type, opline->op1.var);
3040 return FAILURE;
3041 }
3042 } else {
3043 ce = Z_CE_P(EX_VAR(opline->op2.var));
3044 }
3045 if (EXPECTED(op1_type == IS_CONST) && EXPECTED(CACHED_PTR(cache_slot) == ce)) {
3046 *retval = CACHED_PTR(cache_slot + sizeof(void *));
3047 *prop_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3048 return SUCCESS;
3049 }
3050 }
3051
3052 if (EXPECTED(op1_type == IS_CONST)) {
3053 name = Z_STR_P(RT_CONSTANT(opline, opline->op1));
3054 *retval = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3055 } else {
3056 zend_string *tmp_name;
3057 zval *varname = get_zval_ptr_undef(opline->op1_type, opline->op1, BP_VAR_R);
3058 if (EXPECTED(Z_TYPE_P(varname) == IS_STRING)) {
3059 name = Z_STR_P(varname);
3060 tmp_name = NULL;
3061 } else {
3062 if (op1_type == IS_CV && UNEXPECTED(Z_TYPE_P(varname) == IS_UNDEF)) {
3063 zval_undefined_cv(opline->op1.var EXECUTE_DATA_CC);
3064 }
3065 name = zval_get_tmp_string(varname, &tmp_name);
3066 }
3067 *retval = zend_std_get_static_property_with_info(ce, name, fetch_type, &property_info);
3068
3069 if (UNEXPECTED(op1_type != IS_CONST)) {
3070 zend_tmp_string_release(tmp_name);
3071
3072 FREE_OP(op1_type, opline->op1.var);
3073 }
3074 }
3075
3076 if (UNEXPECTED(*retval == NULL)) {
3077 return FAILURE;
3078 }
3079
3080 *prop_info = property_info;
3081
3082 if (EXPECTED(op1_type == IS_CONST)) {
3083 CACHE_POLYMORPHIC_PTR(cache_slot, ce, *retval);
3084 CACHE_PTR(cache_slot + sizeof(void *) * 2, property_info);
3085 }
3086
3087 return SUCCESS;
3088 }
3089
3090
zend_fetch_static_property_address(zval ** retval,zend_property_info ** prop_info,uint32_t cache_slot,int fetch_type,int flags OPLINE_DC EXECUTE_DATA_DC)3091 static zend_always_inline zend_result zend_fetch_static_property_address(zval **retval, zend_property_info **prop_info, uint32_t cache_slot, int fetch_type, int flags OPLINE_DC EXECUTE_DATA_DC) {
3092 zend_property_info *property_info;
3093
3094 if (opline->op1_type == IS_CONST && (opline->op2_type == IS_CONST || (opline->op2_type == IS_UNUSED && (opline->op2.num == ZEND_FETCH_CLASS_SELF || opline->op2.num == ZEND_FETCH_CLASS_PARENT))) && EXPECTED(CACHED_PTR(cache_slot) != NULL)) {
3095 *retval = CACHED_PTR(cache_slot + sizeof(void *));
3096 property_info = CACHED_PTR(cache_slot + sizeof(void *) * 2);
3097
3098 if ((fetch_type == BP_VAR_R || fetch_type == BP_VAR_RW)
3099 && UNEXPECTED(Z_TYPE_P(*retval) == IS_UNDEF)
3100 && UNEXPECTED(ZEND_TYPE_IS_SET(property_info->type))) {
3101 zend_throw_error(NULL, "Typed static property %s::$%s must not be accessed before initialization",
3102 ZSTR_VAL(property_info->ce->name),
3103 zend_get_unmangled_property_name(property_info->name));
3104 return FAILURE;
3105 }
3106 } else {
3107 zend_result success;
3108 success = zend_fetch_static_property_address_ex(retval, &property_info, cache_slot, fetch_type OPLINE_CC EXECUTE_DATA_CC);
3109 if (UNEXPECTED(success != SUCCESS)) {
3110 return FAILURE;
3111 }
3112 }
3113
3114 if (flags && ZEND_TYPE_IS_SET(property_info->type)) {
3115 zend_handle_fetch_obj_flags(NULL, *retval, NULL, property_info, flags);
3116 }
3117
3118 if (prop_info) {
3119 *prop_info = property_info;
3120 }
3121
3122 return SUCCESS;
3123 }
3124
zend_throw_ref_type_error_type(zend_property_info * prop1,zend_property_info * prop2,zval * zv)3125 ZEND_API ZEND_COLD void zend_throw_ref_type_error_type(zend_property_info *prop1, zend_property_info *prop2, zval *zv) {
3126 zend_string *type1_str = zend_type_to_string(prop1->type);
3127 zend_string *type2_str = zend_type_to_string(prop2->type);
3128 zend_type_error("Reference with value of type %s held by property %s::$%s of type %s is not compatible with property %s::$%s of type %s",
3129 zend_zval_type_name(zv),
3130 ZSTR_VAL(prop1->ce->name),
3131 zend_get_unmangled_property_name(prop1->name),
3132 ZSTR_VAL(type1_str),
3133 ZSTR_VAL(prop2->ce->name),
3134 zend_get_unmangled_property_name(prop2->name),
3135 ZSTR_VAL(type2_str)
3136 );
3137 zend_string_release(type1_str);
3138 zend_string_release(type2_str);
3139 }
3140
zend_throw_ref_type_error_zval(zend_property_info * prop,zval * zv)3141 ZEND_API ZEND_COLD void zend_throw_ref_type_error_zval(zend_property_info *prop, zval *zv) {
3142 zend_string *type_str = zend_type_to_string(prop->type);
3143 zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s",
3144 zend_zval_type_name(zv),
3145 ZSTR_VAL(prop->ce->name),
3146 zend_get_unmangled_property_name(prop->name),
3147 ZSTR_VAL(type_str)
3148 );
3149 zend_string_release(type_str);
3150 }
3151
zend_throw_conflicting_coercion_error(zend_property_info * prop1,zend_property_info * prop2,zval * zv)3152 ZEND_API ZEND_COLD void zend_throw_conflicting_coercion_error(zend_property_info *prop1, zend_property_info *prop2, zval *zv) {
3153 zend_string *type1_str = zend_type_to_string(prop1->type);
3154 zend_string *type2_str = zend_type_to_string(prop2->type);
3155 zend_type_error("Cannot assign %s to reference held by property %s::$%s of type %s and property %s::$%s of type %s, as this would result in an inconsistent type conversion",
3156 zend_zval_type_name(zv),
3157 ZSTR_VAL(prop1->ce->name),
3158 zend_get_unmangled_property_name(prop1->name),
3159 ZSTR_VAL(type1_str),
3160 ZSTR_VAL(prop2->ce->name),
3161 zend_get_unmangled_property_name(prop2->name),
3162 ZSTR_VAL(type2_str)
3163 );
3164 zend_string_release(type1_str);
3165 zend_string_release(type2_str);
3166 }
3167
3168 /* 1: valid, 0: invalid, -1: may be valid after type coercion */
i_zend_verify_type_assignable_zval(zend_property_info * info,zval * zv,zend_bool strict)3169 static zend_always_inline int i_zend_verify_type_assignable_zval(
3170 zend_property_info *info, zval *zv, zend_bool strict) {
3171 zend_type type = info->type;
3172 uint32_t type_mask;
3173 zend_uchar zv_type = Z_TYPE_P(zv);
3174
3175 if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(type, zv_type))) {
3176 return 1;
3177 }
3178
3179 if (ZEND_TYPE_HAS_CLASS(type) && zv_type == IS_OBJECT
3180 && zend_check_and_resolve_property_class_type(info, Z_OBJCE_P(zv))) {
3181 return 1;
3182 }
3183
3184 type_mask = ZEND_TYPE_FULL_MASK(type);
3185 ZEND_ASSERT(!(type_mask & (MAY_BE_CALLABLE|MAY_BE_STATIC)));
3186 if (type_mask & MAY_BE_ITERABLE) {
3187 return zend_is_iterable(zv);
3188 }
3189
3190 /* SSTH Exception: IS_LONG may be accepted as IS_DOUBLE (converted) */
3191 if (strict) {
3192 if ((type_mask & MAY_BE_DOUBLE) && zv_type == IS_LONG) {
3193 return -1;
3194 }
3195 return 0;
3196 }
3197
3198 /* NULL may be accepted only by nullable hints (this is already checked) */
3199 if (zv_type == IS_NULL) {
3200 return 0;
3201 }
3202
3203 /* Does not contain any type to which a coercion is possible */
3204 if (!(type_mask & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING))
3205 && (type_mask & MAY_BE_BOOL) != MAY_BE_BOOL) {
3206 return 0;
3207 }
3208
3209 /* Coercion may be necessary, check separately */
3210 return -1;
3211 }
3212
zend_verify_ref_assignable_zval(zend_reference * ref,zval * zv,zend_bool strict)3213 ZEND_API zend_bool ZEND_FASTCALL zend_verify_ref_assignable_zval(zend_reference *ref, zval *zv, zend_bool strict)
3214 {
3215 zend_property_info *prop;
3216
3217 /* The value must satisfy each property type, and coerce to the same value for each property
3218 * type. Remember the first coerced type and value we've seen for this purpose. */
3219 zend_property_info *first_prop = NULL;
3220 zval coerced_value;
3221 ZVAL_UNDEF(&coerced_value);
3222
3223 ZEND_ASSERT(Z_TYPE_P(zv) != IS_REFERENCE);
3224 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
3225 int result = i_zend_verify_type_assignable_zval(prop, zv, strict);
3226 if (result == 0) {
3227 type_error:
3228 zend_throw_ref_type_error_zval(prop, zv);
3229 zval_ptr_dtor(&coerced_value);
3230 return 0;
3231 }
3232
3233 if (result < 0) {
3234 if (!first_prop) {
3235 first_prop = prop;
3236 ZVAL_COPY(&coerced_value, zv);
3237 if (!zend_verify_weak_scalar_type_hint(
3238 ZEND_TYPE_FULL_MASK(prop->type), &coerced_value)) {
3239 goto type_error;
3240 }
3241 } else if (Z_ISUNDEF(coerced_value)) {
3242 /* A previous property did not require coercion, but this one does,
3243 * so they are incompatible. */
3244 goto conflicting_coercion_error;
3245 } else {
3246 zval tmp;
3247 ZVAL_COPY(&tmp, zv);
3248 if (!zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop->type), &tmp)) {
3249 zval_ptr_dtor(&tmp);
3250 goto type_error;
3251 }
3252 if (!zend_is_identical(&coerced_value, &tmp)) {
3253 zval_ptr_dtor(&tmp);
3254 goto conflicting_coercion_error;
3255 }
3256 zval_ptr_dtor(&tmp);
3257 }
3258 } else {
3259 if (!first_prop) {
3260 first_prop = prop;
3261 } else if (!Z_ISUNDEF(coerced_value)) {
3262 /* A previous property required coercion, but this one doesn't,
3263 * so they are incompatible. */
3264 conflicting_coercion_error:
3265 zend_throw_conflicting_coercion_error(first_prop, prop, zv);
3266 zval_ptr_dtor(&coerced_value);
3267 return 0;
3268 }
3269 }
3270 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
3271
3272 if (!Z_ISUNDEF(coerced_value)) {
3273 zval_ptr_dtor(zv);
3274 ZVAL_COPY_VALUE(zv, &coerced_value);
3275 }
3276
3277 return 1;
3278 }
3279
i_zval_ptr_dtor_noref(zval * zval_ptr)3280 static zend_always_inline void i_zval_ptr_dtor_noref(zval *zval_ptr) {
3281 if (Z_REFCOUNTED_P(zval_ptr)) {
3282 zend_refcounted *ref = Z_COUNTED_P(zval_ptr);
3283 ZEND_ASSERT(Z_TYPE_P(zval_ptr) != IS_REFERENCE);
3284 if (!GC_DELREF(ref)) {
3285 rc_dtor_func(ref);
3286 } else if (UNEXPECTED(GC_MAY_LEAK(ref))) {
3287 gc_possible_root(ref);
3288 }
3289 }
3290 }
3291
zend_assign_to_typed_ref(zval * variable_ptr,zval * orig_value,zend_uchar value_type,zend_bool strict)3292 ZEND_API zval* zend_assign_to_typed_ref(zval *variable_ptr, zval *orig_value, zend_uchar value_type, zend_bool strict)
3293 {
3294 zend_bool ret;
3295 zval value;
3296 zend_refcounted *ref = NULL;
3297
3298 if (Z_ISREF_P(orig_value)) {
3299 ref = Z_COUNTED_P(orig_value);
3300 orig_value = Z_REFVAL_P(orig_value);
3301 }
3302
3303 ZVAL_COPY(&value, orig_value);
3304 ret = zend_verify_ref_assignable_zval(Z_REF_P(variable_ptr), &value, strict);
3305 variable_ptr = Z_REFVAL_P(variable_ptr);
3306 if (EXPECTED(ret)) {
3307 i_zval_ptr_dtor_noref(variable_ptr);
3308 ZVAL_COPY_VALUE(variable_ptr, &value);
3309 } else {
3310 zval_ptr_dtor_nogc(&value);
3311 }
3312 if (value_type & (IS_VAR|IS_TMP_VAR)) {
3313 if (UNEXPECTED(ref)) {
3314 if (UNEXPECTED(GC_DELREF(ref) == 0)) {
3315 zval_ptr_dtor(orig_value);
3316 efree_size(ref, sizeof(zend_reference));
3317 }
3318 } else {
3319 i_zval_ptr_dtor_noref(orig_value);
3320 }
3321 }
3322 return variable_ptr;
3323 }
3324
zend_verify_prop_assignable_by_ref(zend_property_info * prop_info,zval * orig_val,zend_bool strict)3325 ZEND_API zend_bool ZEND_FASTCALL zend_verify_prop_assignable_by_ref(zend_property_info *prop_info, zval *orig_val, zend_bool strict) {
3326 zval *val = orig_val;
3327 if (Z_ISREF_P(val) && ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(val))) {
3328 int result;
3329
3330 val = Z_REFVAL_P(val);
3331 result = i_zend_verify_type_assignable_zval(prop_info, val, strict);
3332 if (result > 0) {
3333 return 1;
3334 }
3335
3336 if (result < 0) {
3337 /* This is definitely an error, but we still need to determined why: Either because
3338 * the value is simply illegal for the type, or because or a conflicting coercion. */
3339 zval tmp;
3340 ZVAL_COPY(&tmp, val);
3341 if (zend_verify_weak_scalar_type_hint(ZEND_TYPE_FULL_MASK(prop_info->type), &tmp)) {
3342 zend_property_info *ref_prop = ZEND_REF_FIRST_SOURCE(Z_REF_P(orig_val));
3343 zend_throw_ref_type_error_type(ref_prop, prop_info, val);
3344 zval_ptr_dtor(&tmp);
3345 return 0;
3346 }
3347 zval_ptr_dtor(&tmp);
3348 }
3349 } else {
3350 ZVAL_DEREF(val);
3351 if (i_zend_check_property_type(prop_info, val, strict)) {
3352 return 1;
3353 }
3354 }
3355
3356 zend_verify_property_type_error(prop_info, val);
3357 return 0;
3358 }
3359
zend_ref_add_type_source(zend_property_info_source_list * source_list,zend_property_info * prop)3360 ZEND_API void ZEND_FASTCALL zend_ref_add_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
3361 {
3362 zend_property_info_list *list;
3363 if (source_list->ptr == NULL) {
3364 source_list->ptr = prop;
3365 return;
3366 }
3367
3368 list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3369 if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3370 list = emalloc(sizeof(zend_property_info_list) + (4 - 1) * sizeof(zend_property_info *));
3371 list->ptr[0] = source_list->ptr;
3372 list->num_allocated = 4;
3373 list->num = 1;
3374 } else if (list->num_allocated == list->num) {
3375 list->num_allocated = list->num * 2;
3376 list = erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *));
3377 }
3378
3379 list->ptr[list->num++] = prop;
3380 source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(list);
3381 }
3382
zend_ref_del_type_source(zend_property_info_source_list * source_list,zend_property_info * prop)3383 ZEND_API void ZEND_FASTCALL zend_ref_del_type_source(zend_property_info_source_list *source_list, zend_property_info *prop)
3384 {
3385 zend_property_info_list *list = ZEND_PROPERTY_INFO_SOURCE_TO_LIST(source_list->list);
3386 zend_property_info **ptr, **end;
3387
3388 ZEND_ASSERT(prop);
3389 if (!ZEND_PROPERTY_INFO_SOURCE_IS_LIST(source_list->list)) {
3390 ZEND_ASSERT(source_list->ptr == prop);
3391 source_list->ptr = NULL;
3392 return;
3393 }
3394
3395 if (list->num == 1) {
3396 ZEND_ASSERT(*list->ptr == prop);
3397 efree(list);
3398 source_list->ptr = NULL;
3399 return;
3400 }
3401
3402 /* Checking against end here to get a more graceful failure mode if we missed adding a type
3403 * source at some point. */
3404 ptr = list->ptr;
3405 end = ptr + list->num;
3406 while (ptr < end && *ptr != prop) {
3407 ptr++;
3408 }
3409 ZEND_ASSERT(*ptr == prop);
3410
3411 /* Copy the last list element into the deleted slot. */
3412 *ptr = list->ptr[--list->num];
3413
3414 if (list->num >= 4 && list->num * 4 == list->num_allocated) {
3415 list->num_allocated = list->num * 2;
3416 source_list->list = ZEND_PROPERTY_INFO_SOURCE_FROM_LIST(erealloc(list, sizeof(zend_property_info_list) + (list->num_allocated - 1) * sizeof(zend_property_info *)));
3417 }
3418 }
3419
zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)3420 static zend_never_inline void zend_fetch_this_var(int type OPLINE_DC EXECUTE_DATA_DC)
3421 {
3422 zval *result = EX_VAR(opline->result.var);
3423
3424 switch (type) {
3425 case BP_VAR_R:
3426 if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3427 ZVAL_OBJ(result, Z_OBJ(EX(This)));
3428 Z_ADDREF_P(result);
3429 } else {
3430 ZVAL_NULL(result);
3431 zend_error(E_WARNING, "Undefined variable $this");
3432 }
3433 break;
3434 case BP_VAR_IS:
3435 if (EXPECTED(Z_TYPE(EX(This)) == IS_OBJECT)) {
3436 ZVAL_OBJ(result, Z_OBJ(EX(This)));
3437 Z_ADDREF_P(result);
3438 } else {
3439 ZVAL_NULL(result);
3440 }
3441 break;
3442 case BP_VAR_RW:
3443 case BP_VAR_W:
3444 ZVAL_UNDEF(result);
3445 zend_throw_error(NULL, "Cannot re-assign $this");
3446 break;
3447 case BP_VAR_UNSET:
3448 ZVAL_UNDEF(result);
3449 zend_throw_error(NULL, "Cannot unset $this");
3450 break;
3451 EMPTY_SWITCH_DEFAULT_CASE()
3452 }
3453 }
3454
zend_wrong_clone_call(zend_function * clone,zend_class_entry * scope)3455 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_wrong_clone_call(zend_function *clone, zend_class_entry *scope)
3456 {
3457 zend_throw_error(NULL, "Call to %s %s::__clone() from %s%s",
3458 zend_visibility_string(clone->common.fn_flags), ZSTR_VAL(clone->common.scope->name),
3459 scope ? "scope " : "global scope",
3460 scope ? ZSTR_VAL(scope->name) : ""
3461 );
3462 }
3463
3464 #if ZEND_INTENSIVE_DEBUGGING
3465
3466 #define CHECK_SYMBOL_TABLES() \
3467 zend_hash_apply(&EG(symbol_table), zend_check_symbol); \
3468 if (&EG(symbol_table)!=EX(symbol_table)) { \
3469 zend_hash_apply(EX(symbol_table), zend_check_symbol); \
3470 }
3471
zend_check_symbol(zval * pz)3472 static void zend_check_symbol(zval *pz)
3473 {
3474 if (Z_TYPE_P(pz) == IS_INDIRECT) {
3475 pz = Z_INDIRECT_P(pz);
3476 }
3477 if (Z_TYPE_P(pz) > 10) {
3478 fprintf(stderr, "Warning! %x has invalid type!\n", *pz);
3479 /* See http://support.microsoft.com/kb/190351 */
3480 #ifdef ZEND_WIN32
3481 fflush(stderr);
3482 #endif
3483 } else if (Z_TYPE_P(pz) == IS_ARRAY) {
3484 zend_hash_apply(Z_ARRVAL_P(pz), zend_check_symbol);
3485 } else if (Z_TYPE_P(pz) == IS_OBJECT) {
3486 /* OBJ-TBI - doesn't support new object model! */
3487 zend_hash_apply(Z_OBJPROP_P(pz), zend_check_symbol);
3488 }
3489 }
3490
3491
3492 #else
3493 #define CHECK_SYMBOL_TABLES()
3494 #endif
3495
execute_internal(zend_execute_data * execute_data,zval * return_value)3496 ZEND_API void execute_internal(zend_execute_data *execute_data, zval *return_value)
3497 {
3498 execute_data->func->internal_function.handler(execute_data, return_value);
3499 }
3500
zend_clean_and_cache_symbol_table(zend_array * symbol_table)3501 ZEND_API void zend_clean_and_cache_symbol_table(zend_array *symbol_table) /* {{{ */
3502 {
3503 /* Clean before putting into the cache, since clean could call dtors,
3504 * which could use the cached hash. Also do this before the check for
3505 * available cache slots, as those may be used by a dtor as well. */
3506 zend_symtable_clean(symbol_table);
3507 if (EG(symtable_cache_ptr) >= EG(symtable_cache_limit)) {
3508 zend_array_destroy(symbol_table);
3509 } else {
3510 *(EG(symtable_cache_ptr)++) = symbol_table;
3511 }
3512 }
3513 /* }}} */
3514
i_free_compiled_variables(zend_execute_data * execute_data)3515 static zend_always_inline void i_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3516 {
3517 zval *cv = EX_VAR_NUM(0);
3518 int count = EX(func)->op_array.last_var;
3519 while (EXPECTED(count != 0)) {
3520 i_zval_ptr_dtor(cv);
3521 cv++;
3522 count--;
3523 }
3524 }
3525 /* }}} */
3526
zend_free_compiled_variables(zend_execute_data * execute_data)3527 ZEND_API void zend_free_compiled_variables(zend_execute_data *execute_data) /* {{{ */
3528 {
3529 i_free_compiled_variables(execute_data);
3530 }
3531 /* }}} */
3532
3533 #define ZEND_VM_INTERRUPT_CHECK() do { \
3534 if (UNEXPECTED(EG(vm_interrupt))) { \
3535 ZEND_VM_INTERRUPT(); \
3536 } \
3537 } while (0)
3538
3539 #define ZEND_VM_LOOP_INTERRUPT_CHECK() do { \
3540 if (UNEXPECTED(EG(vm_interrupt))) { \
3541 ZEND_VM_LOOP_INTERRUPT(); \
3542 } \
3543 } while (0)
3544
3545 /*
3546 * Stack Frame Layout (the whole stack frame is allocated at once)
3547 * ==================
3548 *
3549 * +========================================+
3550 * EG(current_execute_data) -> | zend_execute_data |
3551 * +----------------------------------------+
3552 * EX_VAR_NUM(0) --------> | VAR[0] = ARG[1] |
3553 * | ... |
3554 * | VAR[op_array->num_args-1] = ARG[N] |
3555 * | ... |
3556 * | VAR[op_array->last_var-1] |
3557 * | VAR[op_array->last_var] = TMP[0] |
3558 * | ... |
3559 * | VAR[op_array->last_var+op_array->T-1] |
3560 * | ARG[N+1] (extra_args) |
3561 * | ... |
3562 * +----------------------------------------+
3563 */
3564
3565 /* zend_copy_extra_args is used when the actually passed number of arguments
3566 * (EX_NUM_ARGS) is greater than what the function defined (op_array->num_args).
3567 *
3568 * The extra arguments will be copied into the call frame after all the compiled variables.
3569 *
3570 * If there are extra arguments copied, a flag "ZEND_CALL_FREE_EXTRA_ARGS" will be set
3571 * on the zend_execute_data, and when the executor leaves the function, the
3572 * args will be freed in zend_leave_helper.
3573 */
zend_copy_extra_args(EXECUTE_DATA_D)3574 static zend_never_inline void zend_copy_extra_args(EXECUTE_DATA_D)
3575 {
3576 zend_op_array *op_array = &EX(func)->op_array;
3577 uint32_t first_extra_arg = op_array->num_args;
3578 uint32_t num_args = EX_NUM_ARGS();
3579 zval *src;
3580 size_t delta;
3581 uint32_t count;
3582 uint32_t type_flags = 0;
3583
3584 if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
3585 /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
3586 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3587 opline += first_extra_arg;
3588 #else
3589 EX(opline) += first_extra_arg;
3590 #endif
3591
3592 }
3593
3594 /* move extra args into separate array after all CV and TMP vars */
3595 src = EX_VAR_NUM(num_args - 1);
3596 delta = op_array->last_var + op_array->T - first_extra_arg;
3597 count = num_args - first_extra_arg;
3598 if (EXPECTED(delta != 0)) {
3599 delta *= sizeof(zval);
3600 do {
3601 type_flags |= Z_TYPE_INFO_P(src);
3602 ZVAL_COPY_VALUE((zval*)(((char*)src) + delta), src);
3603 ZVAL_UNDEF(src);
3604 src--;
3605 } while (--count);
3606 if (Z_TYPE_INFO_REFCOUNTED(type_flags)) {
3607 ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3608 }
3609 } else {
3610 do {
3611 if (Z_REFCOUNTED_P(src)) {
3612 ZEND_ADD_CALL_FLAG(execute_data, ZEND_CALL_FREE_EXTRA_ARGS);
3613 break;
3614 }
3615 src--;
3616 } while (--count);
3617 }
3618 }
3619
zend_init_cvs(uint32_t first,uint32_t last EXECUTE_DATA_DC)3620 static zend_always_inline void zend_init_cvs(uint32_t first, uint32_t last EXECUTE_DATA_DC)
3621 {
3622 if (EXPECTED(first < last)) {
3623 uint32_t count = last - first;
3624 zval *var = EX_VAR_NUM(first);
3625
3626 do {
3627 ZVAL_UNDEF(var);
3628 var++;
3629 } while (--count);
3630 }
3631 }
3632
i_init_func_execute_data(zend_op_array * op_array,zval * return_value,zend_bool may_be_trampoline EXECUTE_DATA_DC)3633 static zend_always_inline void i_init_func_execute_data(zend_op_array *op_array, zval *return_value, zend_bool may_be_trampoline EXECUTE_DATA_DC) /* {{{ */
3634 {
3635 uint32_t first_extra_arg, num_args;
3636 ZEND_ASSERT(EX(func) == (zend_function*)op_array);
3637
3638 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3639 opline = op_array->opcodes;
3640 #else
3641 EX(opline) = op_array->opcodes;
3642 #endif
3643 EX(call) = NULL;
3644 EX(return_value) = return_value;
3645
3646 /* Handle arguments */
3647 first_extra_arg = op_array->num_args;
3648 num_args = EX_NUM_ARGS();
3649 if (UNEXPECTED(num_args > first_extra_arg)) {
3650 if (!may_be_trampoline || EXPECTED(!(op_array->fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE))) {
3651 zend_copy_extra_args(EXECUTE_DATA_C);
3652 }
3653 } else if (EXPECTED((op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) == 0)) {
3654 /* Skip useless ZEND_RECV and ZEND_RECV_INIT opcodes */
3655 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3656 opline += num_args;
3657 #else
3658 EX(opline) += num_args;
3659 #endif
3660 }
3661
3662 /* Initialize CV variables (skip arguments) */
3663 zend_init_cvs(num_args, op_array->last_var EXECUTE_DATA_CC);
3664
3665 EX(run_time_cache) = RUN_TIME_CACHE(op_array);
3666
3667 EG(current_execute_data) = execute_data;
3668 }
3669 /* }}} */
3670
init_func_run_time_cache_i(zend_op_array * op_array)3671 static zend_always_inline void init_func_run_time_cache_i(zend_op_array *op_array) /* {{{ */
3672 {
3673 void **run_time_cache;
3674
3675 ZEND_ASSERT(RUN_TIME_CACHE(op_array) == NULL);
3676 run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
3677 memset(run_time_cache, 0, op_array->cache_size);
3678 ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
3679 }
3680 /* }}} */
3681
init_func_run_time_cache(zend_op_array * op_array)3682 static zend_never_inline void ZEND_FASTCALL init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
3683 {
3684 init_func_run_time_cache_i(op_array);
3685 }
3686 /* }}} */
3687
zend_fetch_function(zend_string * name)3688 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function(zend_string *name) /* {{{ */
3689 {
3690 zval *zv = zend_hash_find(EG(function_table), name);
3691
3692 if (EXPECTED(zv != NULL)) {
3693 zend_function *fbc = Z_FUNC_P(zv);
3694
3695 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
3696 init_func_run_time_cache_i(&fbc->op_array);
3697 }
3698 return fbc;
3699 }
3700 return NULL;
3701 } /* }}} */
3702
zend_fetch_function_str(const char * name,size_t len)3703 ZEND_API zend_function * ZEND_FASTCALL zend_fetch_function_str(const char *name, size_t len) /* {{{ */
3704 {
3705 zval *zv = zend_hash_str_find(EG(function_table), name, len);
3706
3707 if (EXPECTED(zv != NULL)) {
3708 zend_function *fbc = Z_FUNC_P(zv);
3709
3710 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
3711 init_func_run_time_cache_i(&fbc->op_array);
3712 }
3713 return fbc;
3714 }
3715 return NULL;
3716 } /* }}} */
3717
zend_init_func_run_time_cache(zend_op_array * op_array)3718 ZEND_API void ZEND_FASTCALL zend_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
3719 {
3720 if (!RUN_TIME_CACHE(op_array)) {
3721 init_func_run_time_cache_i(op_array);
3722 }
3723 } /* }}} */
3724
i_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3725 static zend_always_inline void i_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3726 {
3727 ZEND_ASSERT(EX(func) == (zend_function*)op_array);
3728
3729 EX(opline) = op_array->opcodes;
3730 EX(call) = NULL;
3731 EX(return_value) = return_value;
3732
3733 zend_attach_symbol_table(execute_data);
3734
3735 if (!ZEND_MAP_PTR(op_array->run_time_cache)) {
3736 void *ptr;
3737
3738 ZEND_ASSERT(op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE);
3739 ptr = emalloc(op_array->cache_size + sizeof(void*));
3740 ZEND_MAP_PTR_INIT(op_array->run_time_cache, ptr);
3741 ptr = (char*)ptr + sizeof(void*);
3742 ZEND_MAP_PTR_SET(op_array->run_time_cache, ptr);
3743 memset(ptr, 0, op_array->cache_size);
3744 }
3745 EX(run_time_cache) = RUN_TIME_CACHE(op_array);
3746
3747 EG(current_execute_data) = execute_data;
3748 }
3749 /* }}} */
3750
zend_init_func_execute_data(zend_execute_data * ex,zend_op_array * op_array,zval * return_value)3751 ZEND_API void zend_init_func_execute_data(zend_execute_data *ex, zend_op_array *op_array, zval *return_value) /* {{{ */
3752 {
3753 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3754 zend_execute_data *orig_execute_data = execute_data;
3755 #endif
3756 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3757 const zend_op *orig_opline = opline;
3758 #endif
3759 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3760 execute_data = ex;
3761 #else
3762 zend_execute_data *execute_data = ex;
3763 #endif
3764
3765 EX(prev_execute_data) = EG(current_execute_data);
3766 if (!RUN_TIME_CACHE(op_array)) {
3767 init_func_run_time_cache(op_array);
3768 }
3769 i_init_func_execute_data(op_array, return_value, 1 EXECUTE_DATA_CC);
3770
3771 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3772 EX(opline) = opline;
3773 opline = orig_opline;
3774 #endif
3775 #if defined(ZEND_VM_FP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
3776 execute_data = orig_execute_data;
3777 #endif
3778 }
3779 /* }}} */
3780
zend_init_code_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3781 ZEND_API void zend_init_code_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3782 {
3783 EX(prev_execute_data) = EG(current_execute_data);
3784 i_init_code_execute_data(execute_data, op_array, return_value);
3785 }
3786 /* }}} */
3787
zend_init_execute_data(zend_execute_data * execute_data,zend_op_array * op_array,zval * return_value)3788 ZEND_API void zend_init_execute_data(zend_execute_data *execute_data, zend_op_array *op_array, zval *return_value) /* {{{ */
3789 {
3790 if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
3791 zend_init_code_execute_data(execute_data, op_array, return_value);
3792 } else {
3793 zend_init_func_execute_data(execute_data, op_array, return_value);
3794 }
3795 }
3796 /* }}} */
3797
zend_vm_stack_copy_call_frame(zend_execute_data * call,uint32_t passed_args,uint32_t additional_args)3798 zend_execute_data *zend_vm_stack_copy_call_frame(zend_execute_data *call, uint32_t passed_args, uint32_t additional_args) /* {{{ */
3799 {
3800 zend_execute_data *new_call;
3801 int used_stack = (EG(vm_stack_top) - (zval*)call) + additional_args;
3802
3803 /* copy call frame into new stack segment */
3804 new_call = zend_vm_stack_extend(used_stack * sizeof(zval));
3805 *new_call = *call;
3806 ZEND_ADD_CALL_FLAG(new_call, ZEND_CALL_ALLOCATED);
3807
3808 if (passed_args) {
3809 zval *src = ZEND_CALL_ARG(call, 1);
3810 zval *dst = ZEND_CALL_ARG(new_call, 1);
3811 do {
3812 ZVAL_COPY_VALUE(dst, src);
3813 passed_args--;
3814 src++;
3815 dst++;
3816 } while (passed_args);
3817 }
3818
3819 /* delete old call_frame from previous stack segment */
3820 EG(vm_stack)->prev->top = (zval*)call;
3821
3822 /* delete previous stack segment if it became empty */
3823 if (UNEXPECTED(EG(vm_stack)->prev->top == ZEND_VM_STACK_ELEMENTS(EG(vm_stack)->prev))) {
3824 zend_vm_stack r = EG(vm_stack)->prev;
3825
3826 EG(vm_stack)->prev = r->prev;
3827 efree(r);
3828 }
3829
3830 return new_call;
3831 }
3832 /* }}} */
3833
zend_get_running_generator(EXECUTE_DATA_D)3834 static zend_always_inline zend_generator *zend_get_running_generator(EXECUTE_DATA_D) /* {{{ */
3835 {
3836 /* The generator object is stored in EX(return_value) */
3837 zend_generator *generator = (zend_generator *) EX(return_value);
3838 /* However control may currently be delegated to another generator.
3839 * That's the one we're interested in. */
3840 return generator;
3841 }
3842 /* }}} */
3843
zend_unfinished_calls_gc(zend_execute_data * execute_data,zend_execute_data * call,uint32_t op_num,zend_get_gc_buffer * buf)3844 ZEND_API void zend_unfinished_calls_gc(zend_execute_data *execute_data, zend_execute_data *call, uint32_t op_num, zend_get_gc_buffer *buf) /* {{{ */
3845 {
3846 zend_op *opline = EX(func)->op_array.opcodes + op_num;
3847 int level;
3848 int do_exit;
3849 uint32_t num_args;
3850
3851 if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
3852 opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
3853 opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
3854 opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
3855 opline->opcode == ZEND_INIT_USER_CALL ||
3856 opline->opcode == ZEND_INIT_METHOD_CALL ||
3857 opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
3858 opline->opcode == ZEND_NEW)) {
3859 ZEND_ASSERT(op_num);
3860 opline--;
3861 }
3862
3863 do {
3864 /* find the number of actually passed arguments */
3865 level = 0;
3866 do_exit = 0;
3867 num_args = ZEND_CALL_NUM_ARGS(call);
3868 do {
3869 switch (opline->opcode) {
3870 case ZEND_DO_FCALL:
3871 case ZEND_DO_ICALL:
3872 case ZEND_DO_UCALL:
3873 case ZEND_DO_FCALL_BY_NAME:
3874 level++;
3875 break;
3876 case ZEND_INIT_FCALL:
3877 case ZEND_INIT_FCALL_BY_NAME:
3878 case ZEND_INIT_NS_FCALL_BY_NAME:
3879 case ZEND_INIT_DYNAMIC_CALL:
3880 case ZEND_INIT_USER_CALL:
3881 case ZEND_INIT_METHOD_CALL:
3882 case ZEND_INIT_STATIC_METHOD_CALL:
3883 case ZEND_NEW:
3884 if (level == 0) {
3885 num_args = 0;
3886 do_exit = 1;
3887 }
3888 level--;
3889 break;
3890 case ZEND_SEND_VAL:
3891 case ZEND_SEND_VAL_EX:
3892 case ZEND_SEND_VAR:
3893 case ZEND_SEND_VAR_EX:
3894 case ZEND_SEND_FUNC_ARG:
3895 case ZEND_SEND_REF:
3896 case ZEND_SEND_VAR_NO_REF:
3897 case ZEND_SEND_VAR_NO_REF_EX:
3898 case ZEND_SEND_USER:
3899 if (level == 0) {
3900 /* For named args, the number of arguments is up to date. */
3901 if (opline->op2_type != IS_CONST) {
3902 num_args = opline->op2.num;
3903 }
3904 do_exit = 1;
3905 }
3906 break;
3907 case ZEND_SEND_ARRAY:
3908 case ZEND_SEND_UNPACK:
3909 case ZEND_CHECK_UNDEF_ARGS:
3910 if (level == 0) {
3911 do_exit = 1;
3912 }
3913 break;
3914 }
3915 if (!do_exit) {
3916 opline--;
3917 }
3918 } while (!do_exit);
3919 if (call->prev_execute_data) {
3920 /* skip current call region */
3921 level = 0;
3922 do_exit = 0;
3923 do {
3924 switch (opline->opcode) {
3925 case ZEND_DO_FCALL:
3926 case ZEND_DO_ICALL:
3927 case ZEND_DO_UCALL:
3928 case ZEND_DO_FCALL_BY_NAME:
3929 level++;
3930 break;
3931 case ZEND_INIT_FCALL:
3932 case ZEND_INIT_FCALL_BY_NAME:
3933 case ZEND_INIT_NS_FCALL_BY_NAME:
3934 case ZEND_INIT_DYNAMIC_CALL:
3935 case ZEND_INIT_USER_CALL:
3936 case ZEND_INIT_METHOD_CALL:
3937 case ZEND_INIT_STATIC_METHOD_CALL:
3938 case ZEND_NEW:
3939 if (level == 0) {
3940 do_exit = 1;
3941 }
3942 level--;
3943 break;
3944 }
3945 opline--;
3946 } while (!do_exit);
3947 }
3948
3949 if (EXPECTED(num_args > 0)) {
3950 zval *p = ZEND_CALL_ARG(call, 1);
3951 do {
3952 zend_get_gc_buffer_add_zval(buf, p);
3953 p++;
3954 } while (--num_args);
3955 }
3956 if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
3957 zend_get_gc_buffer_add_obj(buf, Z_OBJ(call->This));
3958 }
3959 if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
3960 zval *val;
3961 ZEND_HASH_FOREACH_VAL(call->extra_named_params, val) {
3962 zend_get_gc_buffer_add_zval(buf, val);
3963 } ZEND_HASH_FOREACH_END();
3964 }
3965 if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
3966 zend_get_gc_buffer_add_obj(buf, ZEND_CLOSURE_OBJECT(call->func));
3967 }
3968
3969 call = call->prev_execute_data;
3970 } while (call);
3971 }
3972 /* }}} */
3973
cleanup_unfinished_calls(zend_execute_data * execute_data,uint32_t op_num)3974 static void cleanup_unfinished_calls(zend_execute_data *execute_data, uint32_t op_num) /* {{{ */
3975 {
3976 if (UNEXPECTED(EX(call))) {
3977 zend_execute_data *call = EX(call);
3978 zend_op *opline = EX(func)->op_array.opcodes + op_num;
3979 int level;
3980 int do_exit;
3981
3982 if (UNEXPECTED(opline->opcode == ZEND_INIT_FCALL ||
3983 opline->opcode == ZEND_INIT_FCALL_BY_NAME ||
3984 opline->opcode == ZEND_INIT_NS_FCALL_BY_NAME ||
3985 opline->opcode == ZEND_INIT_DYNAMIC_CALL ||
3986 opline->opcode == ZEND_INIT_USER_CALL ||
3987 opline->opcode == ZEND_INIT_METHOD_CALL ||
3988 opline->opcode == ZEND_INIT_STATIC_METHOD_CALL ||
3989 opline->opcode == ZEND_NEW)) {
3990 ZEND_ASSERT(op_num);
3991 opline--;
3992 }
3993
3994 do {
3995 /* If the exception was thrown during a function call there might be
3996 * arguments pushed to the stack that have to be dtor'ed. */
3997
3998 /* find the number of actually passed arguments */
3999 level = 0;
4000 do_exit = 0;
4001 do {
4002 switch (opline->opcode) {
4003 case ZEND_DO_FCALL:
4004 case ZEND_DO_ICALL:
4005 case ZEND_DO_UCALL:
4006 case ZEND_DO_FCALL_BY_NAME:
4007 level++;
4008 break;
4009 case ZEND_INIT_FCALL:
4010 case ZEND_INIT_FCALL_BY_NAME:
4011 case ZEND_INIT_NS_FCALL_BY_NAME:
4012 case ZEND_INIT_DYNAMIC_CALL:
4013 case ZEND_INIT_USER_CALL:
4014 case ZEND_INIT_METHOD_CALL:
4015 case ZEND_INIT_STATIC_METHOD_CALL:
4016 case ZEND_NEW:
4017 if (level == 0) {
4018 ZEND_CALL_NUM_ARGS(call) = 0;
4019 do_exit = 1;
4020 }
4021 level--;
4022 break;
4023 case ZEND_SEND_VAL:
4024 case ZEND_SEND_VAL_EX:
4025 case ZEND_SEND_VAR:
4026 case ZEND_SEND_VAR_EX:
4027 case ZEND_SEND_FUNC_ARG:
4028 case ZEND_SEND_REF:
4029 case ZEND_SEND_VAR_NO_REF:
4030 case ZEND_SEND_VAR_NO_REF_EX:
4031 case ZEND_SEND_USER:
4032 if (level == 0) {
4033 /* For named args, the number of arguments is up to date. */
4034 if (opline->op2_type != IS_CONST) {
4035 ZEND_CALL_NUM_ARGS(call) = opline->op2.num;
4036 }
4037 do_exit = 1;
4038 }
4039 break;
4040 case ZEND_SEND_ARRAY:
4041 case ZEND_SEND_UNPACK:
4042 case ZEND_CHECK_UNDEF_ARGS:
4043 if (level == 0) {
4044 do_exit = 1;
4045 }
4046 break;
4047 }
4048 if (!do_exit) {
4049 opline--;
4050 }
4051 } while (!do_exit);
4052 if (call->prev_execute_data) {
4053 /* skip current call region */
4054 level = 0;
4055 do_exit = 0;
4056 do {
4057 switch (opline->opcode) {
4058 case ZEND_DO_FCALL:
4059 case ZEND_DO_ICALL:
4060 case ZEND_DO_UCALL:
4061 case ZEND_DO_FCALL_BY_NAME:
4062 level++;
4063 break;
4064 case ZEND_INIT_FCALL:
4065 case ZEND_INIT_FCALL_BY_NAME:
4066 case ZEND_INIT_NS_FCALL_BY_NAME:
4067 case ZEND_INIT_DYNAMIC_CALL:
4068 case ZEND_INIT_USER_CALL:
4069 case ZEND_INIT_METHOD_CALL:
4070 case ZEND_INIT_STATIC_METHOD_CALL:
4071 case ZEND_NEW:
4072 if (level == 0) {
4073 do_exit = 1;
4074 }
4075 level--;
4076 break;
4077 }
4078 opline--;
4079 } while (!do_exit);
4080 }
4081
4082 zend_vm_stack_free_args(EX(call));
4083
4084 if (ZEND_CALL_INFO(call) & ZEND_CALL_RELEASE_THIS) {
4085 OBJ_RELEASE(Z_OBJ(call->This));
4086 }
4087 if (ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS) {
4088 zend_free_extra_named_params(call->extra_named_params);
4089 }
4090 if (call->func->common.fn_flags & ZEND_ACC_CLOSURE) {
4091 zend_object_release(ZEND_CLOSURE_OBJECT(call->func));
4092 } else if (call->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4093 zend_string_release_ex(call->func->common.function_name, 0);
4094 zend_free_trampoline(call->func);
4095 }
4096
4097 EX(call) = call->prev_execute_data;
4098 zend_vm_stack_free_call_frame(call);
4099 call = EX(call);
4100 } while (call);
4101 }
4102 }
4103 /* }}} */
4104
find_live_range(const zend_op_array * op_array,uint32_t op_num,uint32_t var_num)4105 static const zend_live_range *find_live_range(const zend_op_array *op_array, uint32_t op_num, uint32_t var_num) /* {{{ */
4106 {
4107 int i;
4108 for (i = 0; i < op_array->last_live_range; i++) {
4109 const zend_live_range *range = &op_array->live_range[i];
4110 if (op_num >= range->start && op_num < range->end
4111 && var_num == (range->var & ~ZEND_LIVE_MASK)) {
4112 return range;
4113 }
4114 }
4115 return NULL;
4116 }
4117 /* }}} */
4118
cleanup_live_vars(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)4119 static void cleanup_live_vars(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) /* {{{ */
4120 {
4121 int i;
4122
4123 for (i = 0; i < EX(func)->op_array.last_live_range; i++) {
4124 const zend_live_range *range = &EX(func)->op_array.live_range[i];
4125 if (range->start > op_num) {
4126 /* further blocks will not be relevant... */
4127 break;
4128 } else if (op_num < range->end) {
4129 if (!catch_op_num || catch_op_num >= range->end) {
4130 uint32_t kind = range->var & ZEND_LIVE_MASK;
4131 uint32_t var_num = range->var & ~ZEND_LIVE_MASK;
4132 zval *var = EX_VAR(var_num);
4133
4134 if (kind == ZEND_LIVE_TMPVAR) {
4135 zval_ptr_dtor_nogc(var);
4136 } else if (kind == ZEND_LIVE_NEW) {
4137 zend_object *obj;
4138 ZEND_ASSERT(Z_TYPE_P(var) == IS_OBJECT);
4139 obj = Z_OBJ_P(var);
4140 zend_object_store_ctor_failed(obj);
4141 OBJ_RELEASE(obj);
4142 } else if (kind == ZEND_LIVE_LOOP) {
4143 if (Z_TYPE_P(var) != IS_ARRAY && Z_FE_ITER_P(var) != (uint32_t)-1) {
4144 zend_hash_iterator_del(Z_FE_ITER_P(var));
4145 }
4146 zval_ptr_dtor_nogc(var);
4147 } else if (kind == ZEND_LIVE_ROPE) {
4148 zend_string **rope = (zend_string **)var;
4149 zend_op *last = EX(func)->op_array.opcodes + op_num;
4150 while ((last->opcode != ZEND_ROPE_ADD && last->opcode != ZEND_ROPE_INIT)
4151 || last->result.var != var_num) {
4152 ZEND_ASSERT(last >= EX(func)->op_array.opcodes);
4153 last--;
4154 }
4155 if (last->opcode == ZEND_ROPE_INIT) {
4156 zend_string_release_ex(*rope, 0);
4157 } else {
4158 int j = last->extended_value;
4159 do {
4160 zend_string_release_ex(rope[j], 0);
4161 } while (j--);
4162 }
4163 } else if (kind == ZEND_LIVE_SILENCE) {
4164 /* restore previous error_reporting value */
4165 if (E_HAS_ONLY_FATAL_ERRORS(EG(error_reporting))
4166 && !E_HAS_ONLY_FATAL_ERRORS(Z_LVAL_P(var))) {
4167 EG(error_reporting) = Z_LVAL_P(var);
4168 }
4169 }
4170 }
4171 }
4172 }
4173 }
4174 /* }}} */
4175
zend_cleanup_unfinished_execution(zend_execute_data * execute_data,uint32_t op_num,uint32_t catch_op_num)4176 ZEND_API void zend_cleanup_unfinished_execution(zend_execute_data *execute_data, uint32_t op_num, uint32_t catch_op_num) {
4177 cleanup_unfinished_calls(execute_data, op_num);
4178 cleanup_live_vars(execute_data, op_num, catch_op_num);
4179 }
4180
4181 #if ZEND_VM_SPEC
zend_swap_operands(zend_op * op)4182 static void zend_swap_operands(zend_op *op) /* {{{ */
4183 {
4184 znode_op tmp;
4185 zend_uchar tmp_type;
4186
4187 tmp = op->op1;
4188 tmp_type = op->op1_type;
4189 op->op1 = op->op2;
4190 op->op1_type = op->op2_type;
4191 op->op2 = tmp;
4192 op->op2_type = tmp_type;
4193 }
4194 /* }}} */
4195 #endif
4196
zend_init_dynamic_call_string(zend_string * function,uint32_t num_args)4197 static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_string *function, uint32_t num_args) /* {{{ */
4198 {
4199 zend_function *fbc;
4200 zval *func;
4201 zend_class_entry *called_scope;
4202 zend_string *lcname;
4203 const char *colon;
4204
4205 if ((colon = zend_memrchr(ZSTR_VAL(function), ':', ZSTR_LEN(function))) != NULL &&
4206 colon > ZSTR_VAL(function) &&
4207 *(colon-1) == ':'
4208 ) {
4209 zend_string *mname;
4210 size_t cname_length = colon - ZSTR_VAL(function) - 1;
4211 size_t mname_length = ZSTR_LEN(function) - cname_length - (sizeof("::") - 1);
4212
4213 lcname = zend_string_init(ZSTR_VAL(function), cname_length, 0);
4214
4215 called_scope = zend_fetch_class_by_name(lcname, NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4216 if (UNEXPECTED(called_scope == NULL)) {
4217 zend_string_release_ex(lcname, 0);
4218 return NULL;
4219 }
4220
4221 mname = zend_string_init(ZSTR_VAL(function) + (cname_length + sizeof("::") - 1), mname_length, 0);
4222
4223 if (called_scope->get_static_method) {
4224 fbc = called_scope->get_static_method(called_scope, mname);
4225 } else {
4226 fbc = zend_std_get_static_method(called_scope, mname, NULL);
4227 }
4228 if (UNEXPECTED(fbc == NULL)) {
4229 if (EXPECTED(!EG(exception))) {
4230 zend_undefined_method(called_scope, mname);
4231 }
4232 zend_string_release_ex(lcname, 0);
4233 zend_string_release_ex(mname, 0);
4234 return NULL;
4235 }
4236
4237 zend_string_release_ex(lcname, 0);
4238 zend_string_release_ex(mname, 0);
4239
4240 if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
4241 zend_non_static_method_call(fbc);
4242 if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4243 zend_string_release_ex(fbc->common.function_name, 0);
4244 zend_free_trampoline(fbc);
4245 }
4246 return NULL;
4247 }
4248 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4249 init_func_run_time_cache(&fbc->op_array);
4250 }
4251 } else {
4252 if (ZSTR_VAL(function)[0] == '\\') {
4253 lcname = zend_string_alloc(ZSTR_LEN(function) - 1, 0);
4254 zend_str_tolower_copy(ZSTR_VAL(lcname), ZSTR_VAL(function) + 1, ZSTR_LEN(function) - 1);
4255 } else {
4256 lcname = zend_string_tolower(function);
4257 }
4258 if (UNEXPECTED((func = zend_hash_find(EG(function_table), lcname)) == NULL)) {
4259 zend_throw_error(NULL, "Call to undefined function %s()", ZSTR_VAL(function));
4260 zend_string_release_ex(lcname, 0);
4261 return NULL;
4262 }
4263 zend_string_release_ex(lcname, 0);
4264
4265 fbc = Z_FUNC_P(func);
4266 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4267 init_func_run_time_cache(&fbc->op_array);
4268 }
4269 called_scope = NULL;
4270 }
4271
4272 return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC,
4273 fbc, num_args, called_scope);
4274 }
4275 /* }}} */
4276
zend_init_dynamic_call_object(zend_object * function,uint32_t num_args)4277 static zend_never_inline zend_execute_data *zend_init_dynamic_call_object(zend_object *function, uint32_t num_args) /* {{{ */
4278 {
4279 zend_function *fbc;
4280 void *object_or_called_scope;
4281 zend_class_entry *called_scope;
4282 zend_object *object;
4283 uint32_t call_info;
4284
4285 if (EXPECTED(function->handlers->get_closure) &&
4286 EXPECTED(function->handlers->get_closure(function, &called_scope, &fbc, &object, 0) == SUCCESS)) {
4287
4288 object_or_called_scope = called_scope;
4289 if (EXPECTED(fbc->common.fn_flags & ZEND_ACC_CLOSURE)) {
4290 /* Delay closure destruction until its invocation */
4291 GC_ADDREF(ZEND_CLOSURE_OBJECT(fbc));
4292 ZEND_ASSERT(ZEND_ACC_FAKE_CLOSURE == ZEND_CALL_FAKE_CLOSURE);
4293 call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC | ZEND_CALL_CLOSURE |
4294 (fbc->common.fn_flags & ZEND_ACC_FAKE_CLOSURE);
4295 if (object) {
4296 call_info |= ZEND_CALL_HAS_THIS;
4297 object_or_called_scope = object;
4298 }
4299 } else {
4300 call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4301 if (object) {
4302 call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4303 GC_ADDREF(object); /* For $this pointer */
4304 object_or_called_scope = object;
4305 }
4306 }
4307 } else {
4308 zend_throw_error(NULL, "Object of type %s is not callable", ZSTR_VAL(function->ce->name));
4309 return NULL;
4310 }
4311
4312 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4313 init_func_run_time_cache(&fbc->op_array);
4314 }
4315
4316 return zend_vm_stack_push_call_frame(call_info,
4317 fbc, num_args, object_or_called_scope);
4318 }
4319 /* }}} */
4320
zend_init_dynamic_call_array(zend_array * function,uint32_t num_args)4321 static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_array *function, uint32_t num_args) /* {{{ */
4322 {
4323 zend_function *fbc;
4324 void *object_or_called_scope;
4325 uint32_t call_info = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_DYNAMIC;
4326
4327 if (zend_hash_num_elements(function) == 2) {
4328 zval *obj;
4329 zval *method;
4330 obj = zend_hash_index_find(function, 0);
4331 method = zend_hash_index_find(function, 1);
4332
4333 if (UNEXPECTED(!obj) || UNEXPECTED(!method)) {
4334 zend_throw_error(NULL, "Array callback has to contain indices 0 and 1");
4335 return NULL;
4336 }
4337
4338 ZVAL_DEREF(obj);
4339 if (UNEXPECTED(Z_TYPE_P(obj) != IS_STRING) && UNEXPECTED(Z_TYPE_P(obj) != IS_OBJECT)) {
4340 zend_throw_error(NULL, "First array member is not a valid class name or object");
4341 return NULL;
4342 }
4343
4344 ZVAL_DEREF(method);
4345 if (UNEXPECTED(Z_TYPE_P(method) != IS_STRING)) {
4346 zend_throw_error(NULL, "Second array member is not a valid method");
4347 return NULL;
4348 }
4349
4350 if (Z_TYPE_P(obj) == IS_STRING) {
4351 zend_class_entry *called_scope = zend_fetch_class_by_name(Z_STR_P(obj), NULL, ZEND_FETCH_CLASS_DEFAULT | ZEND_FETCH_CLASS_EXCEPTION);
4352
4353 if (UNEXPECTED(called_scope == NULL)) {
4354 return NULL;
4355 }
4356
4357 if (called_scope->get_static_method) {
4358 fbc = called_scope->get_static_method(called_scope, Z_STR_P(method));
4359 } else {
4360 fbc = zend_std_get_static_method(called_scope, Z_STR_P(method), NULL);
4361 }
4362 if (UNEXPECTED(fbc == NULL)) {
4363 if (EXPECTED(!EG(exception))) {
4364 zend_undefined_method(called_scope, Z_STR_P(method));
4365 }
4366 return NULL;
4367 }
4368 if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
4369 zend_non_static_method_call(fbc);
4370 if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
4371 zend_string_release_ex(fbc->common.function_name, 0);
4372 zend_free_trampoline(fbc);
4373 }
4374 return NULL;
4375 }
4376 object_or_called_scope = called_scope;
4377 } else {
4378 zend_object *object = Z_OBJ_P(obj);
4379
4380 fbc = Z_OBJ_HT_P(obj)->get_method(&object, Z_STR_P(method), NULL);
4381 if (UNEXPECTED(fbc == NULL)) {
4382 if (EXPECTED(!EG(exception))) {
4383 zend_undefined_method(object->ce, Z_STR_P(method));
4384 }
4385 return NULL;
4386 }
4387
4388 if ((fbc->common.fn_flags & ZEND_ACC_STATIC) != 0) {
4389 object_or_called_scope = object->ce;
4390 } else {
4391 call_info |= ZEND_CALL_RELEASE_THIS | ZEND_CALL_HAS_THIS;
4392 GC_ADDREF(object); /* For $this pointer */
4393 object_or_called_scope = object;
4394 }
4395 }
4396 } else {
4397 zend_throw_error(NULL, "Array callback must have exactly two elements");
4398 return NULL;
4399 }
4400
4401 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
4402 init_func_run_time_cache(&fbc->op_array);
4403 }
4404
4405 return zend_vm_stack_push_call_frame(call_info,
4406 fbc, num_args, object_or_called_scope);
4407 }
4408 /* }}} */
4409
4410 #define ZEND_FAKE_OP_ARRAY ((zend_op_array*)(zend_intptr_t)-1)
4411
zend_include_or_eval(zval * inc_filename,int type)4412 static zend_never_inline zend_op_array* ZEND_FASTCALL zend_include_or_eval(zval *inc_filename, int type) /* {{{ */
4413 {
4414 zend_op_array *new_op_array = NULL;
4415 zval tmp_inc_filename;
4416
4417 ZVAL_UNDEF(&tmp_inc_filename);
4418 if (Z_TYPE_P(inc_filename) != IS_STRING) {
4419 zend_string *tmp = zval_try_get_string_func(inc_filename);
4420
4421 if (UNEXPECTED(!tmp)) {
4422 return NULL;
4423 }
4424 ZVAL_STR(&tmp_inc_filename, tmp);
4425 inc_filename = &tmp_inc_filename;
4426 }
4427
4428 switch (type) {
4429 case ZEND_INCLUDE_ONCE:
4430 case ZEND_REQUIRE_ONCE: {
4431 zend_file_handle file_handle;
4432 zend_string *resolved_path;
4433
4434 resolved_path = zend_resolve_path(Z_STRVAL_P(inc_filename), Z_STRLEN_P(inc_filename));
4435 if (EXPECTED(resolved_path)) {
4436 if (zend_hash_exists(&EG(included_files), resolved_path)) {
4437 goto already_compiled;
4438 }
4439 } else if (UNEXPECTED(EG(exception))) {
4440 break;
4441 } else if (UNEXPECTED(strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename))) {
4442 zend_message_dispatcher(
4443 (type == ZEND_INCLUDE_ONCE) ?
4444 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4445 Z_STRVAL_P(inc_filename));
4446 break;
4447 } else {
4448 resolved_path = zend_string_copy(Z_STR_P(inc_filename));
4449 }
4450
4451 if (SUCCESS == zend_stream_open(ZSTR_VAL(resolved_path), &file_handle)) {
4452
4453 if (!file_handle.opened_path) {
4454 file_handle.opened_path = zend_string_copy(resolved_path);
4455 }
4456
4457 if (zend_hash_add_empty_element(&EG(included_files), file_handle.opened_path)) {
4458 zend_op_array *op_array = zend_compile_file(&file_handle, (type==ZEND_INCLUDE_ONCE?ZEND_INCLUDE:ZEND_REQUIRE));
4459 zend_destroy_file_handle(&file_handle);
4460 zend_string_release_ex(resolved_path, 0);
4461 if (Z_TYPE(tmp_inc_filename) != IS_UNDEF) {
4462 zval_ptr_dtor_str(&tmp_inc_filename);
4463 }
4464 return op_array;
4465 } else {
4466 zend_file_handle_dtor(&file_handle);
4467 already_compiled:
4468 new_op_array = ZEND_FAKE_OP_ARRAY;
4469 }
4470 } else if (!EG(exception)) {
4471 zend_message_dispatcher(
4472 (type == ZEND_INCLUDE_ONCE) ?
4473 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4474 Z_STRVAL_P(inc_filename));
4475 }
4476 zend_string_release_ex(resolved_path, 0);
4477 }
4478 break;
4479 case ZEND_INCLUDE:
4480 case ZEND_REQUIRE:
4481 if (UNEXPECTED(strlen(Z_STRVAL_P(inc_filename)) != Z_STRLEN_P(inc_filename))) {
4482 zend_message_dispatcher(
4483 (type == ZEND_INCLUDE) ?
4484 ZMSG_FAILED_INCLUDE_FOPEN : ZMSG_FAILED_REQUIRE_FOPEN,
4485 Z_STRVAL_P(inc_filename));
4486 break;
4487 }
4488 new_op_array = compile_filename(type, inc_filename);
4489 break;
4490 case ZEND_EVAL: {
4491 char *eval_desc = zend_make_compiled_string_description("eval()'d code");
4492 zend_string *code = zval_get_string(inc_filename);
4493 new_op_array = zend_compile_string(code, eval_desc);
4494 zend_string_release(code);
4495 efree(eval_desc);
4496 }
4497 break;
4498 EMPTY_SWITCH_DEFAULT_CASE()
4499 }
4500
4501 if (Z_TYPE(tmp_inc_filename) != IS_UNDEF) {
4502 zval_ptr_dtor_str(&tmp_inc_filename);
4503 }
4504 return new_op_array;
4505 }
4506 /* }}} */
4507
zend_fe_reset_iterator(zval * array_ptr,int by_ref OPLINE_DC EXECUTE_DATA_DC)4508 static zend_never_inline zend_bool ZEND_FASTCALL zend_fe_reset_iterator(zval *array_ptr, int by_ref OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4509 {
4510 zend_class_entry *ce = Z_OBJCE_P(array_ptr);
4511 zend_object_iterator *iter = ce->get_iterator(ce, array_ptr, by_ref);
4512 zend_bool is_empty;
4513
4514 if (UNEXPECTED(!iter) || UNEXPECTED(EG(exception))) {
4515 if (iter) {
4516 OBJ_RELEASE(&iter->std);
4517 }
4518 if (!EG(exception)) {
4519 zend_throw_exception_ex(NULL, 0, "Object of type %s did not create an Iterator", ZSTR_VAL(ce->name));
4520 }
4521 ZVAL_UNDEF(EX_VAR(opline->result.var));
4522 return 1;
4523 }
4524
4525 iter->index = 0;
4526 if (iter->funcs->rewind) {
4527 iter->funcs->rewind(iter);
4528 if (UNEXPECTED(EG(exception) != NULL)) {
4529 OBJ_RELEASE(&iter->std);
4530 ZVAL_UNDEF(EX_VAR(opline->result.var));
4531 return 1;
4532 }
4533 }
4534
4535 is_empty = iter->funcs->valid(iter) != SUCCESS;
4536
4537 if (UNEXPECTED(EG(exception) != NULL)) {
4538 OBJ_RELEASE(&iter->std);
4539 ZVAL_UNDEF(EX_VAR(opline->result.var));
4540 return 1;
4541 }
4542 iter->index = -1; /* will be set to 0 before using next handler */
4543
4544 ZVAL_OBJ(EX_VAR(opline->result.var), &iter->std);
4545 Z_FE_ITER_P(EX_VAR(opline->result.var)) = (uint32_t)-1;
4546
4547 return is_empty;
4548 }
4549 /* }}} */
4550
_zend_quick_get_constant(const zval * key,uint32_t flags,bool check_defined_only OPLINE_DC EXECUTE_DATA_DC)4551 static zend_always_inline zend_result _zend_quick_get_constant(
4552 const zval *key, uint32_t flags, bool check_defined_only OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4553 {
4554 zval *zv;
4555 zend_constant *c = NULL;
4556
4557 /* null/true/false are resolved during compilation, so don't check for them here. */
4558 zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4559 if (zv) {
4560 c = (zend_constant*)Z_PTR_P(zv);
4561 } else if (flags & IS_CONSTANT_UNQUALIFIED_IN_NAMESPACE) {
4562 key++;
4563 zv = zend_hash_find_ex(EG(zend_constants), Z_STR_P(key), 1);
4564 if (zv) {
4565 c = (zend_constant*)Z_PTR_P(zv);
4566 }
4567 }
4568
4569 if (!c) {
4570 if (!check_defined_only) {
4571 zend_throw_error(NULL, "Undefined constant \"%s\"", Z_STRVAL_P(RT_CONSTANT(opline, opline->op2)));
4572 ZVAL_UNDEF(EX_VAR(opline->result.var));
4573 }
4574 return FAILURE;
4575 }
4576
4577 if (!check_defined_only) {
4578 ZVAL_COPY_OR_DUP(EX_VAR(opline->result.var), &c->value);
4579 if (ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED) {
4580 zend_error(E_DEPRECATED, "Constant %s is deprecated", ZSTR_VAL(c->name));
4581 return SUCCESS;
4582 }
4583 }
4584
4585 CACHE_PTR(opline->extended_value, c);
4586 return SUCCESS;
4587 }
4588 /* }}} */
4589
zend_quick_get_constant(const zval * key,uint32_t flags OPLINE_DC EXECUTE_DATA_DC)4590 static zend_never_inline void ZEND_FASTCALL zend_quick_get_constant(
4591 const zval *key, uint32_t flags OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4592 {
4593 _zend_quick_get_constant(key, flags, 0 OPLINE_CC EXECUTE_DATA_CC);
4594 } /* }}} */
4595
zend_quick_check_constant(const zval * key OPLINE_DC EXECUTE_DATA_DC)4596 static zend_never_inline zend_result ZEND_FASTCALL zend_quick_check_constant(
4597 const zval *key OPLINE_DC EXECUTE_DATA_DC) /* {{{ */
4598 {
4599 return _zend_quick_get_constant(key, 0, 1 OPLINE_CC EXECUTE_DATA_CC);
4600 } /* }}} */
4601
zend_get_arg_offset_by_name(zend_function * fbc,zend_string * arg_name,void ** cache_slot)4602 static zend_always_inline uint32_t zend_get_arg_offset_by_name(
4603 zend_function *fbc, zend_string *arg_name, void **cache_slot) {
4604 if (EXPECTED(*cache_slot == fbc)) {
4605 return *(uintptr_t *)(cache_slot + 1);
4606 }
4607
4608 // TODO: Use a hash table?
4609 uint32_t num_args = fbc->common.num_args;
4610 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION)
4611 || EXPECTED(fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO)) {
4612 for (uint32_t i = 0; i < num_args; i++) {
4613 zend_arg_info *arg_info = &fbc->op_array.arg_info[i];
4614 if (zend_string_equals(arg_name, arg_info->name)) {
4615 *cache_slot = fbc;
4616 *(uintptr_t *)(cache_slot + 1) = i;
4617 return i;
4618 }
4619 }
4620 } else {
4621 for (uint32_t i = 0; i < num_args; i++) {
4622 zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
4623 size_t len = strlen(arg_info->name);
4624 if (len == ZSTR_LEN(arg_name) && !memcmp(arg_info->name, ZSTR_VAL(arg_name), len)) {
4625 *cache_slot = fbc;
4626 *(uintptr_t *)(cache_slot + 1) = i;
4627 return i;
4628 }
4629 }
4630 }
4631
4632 if (fbc->common.fn_flags & ZEND_ACC_VARIADIC) {
4633 *cache_slot = fbc;
4634 *(uintptr_t *)(cache_slot + 1) = fbc->common.num_args;
4635 return fbc->common.num_args;
4636 }
4637
4638 return (uint32_t) -1;
4639 }
4640
zend_handle_named_arg(zend_execute_data ** call_ptr,zend_string * arg_name,uint32_t * arg_num_ptr,void ** cache_slot)4641 zval * ZEND_FASTCALL zend_handle_named_arg(
4642 zend_execute_data **call_ptr, zend_string *arg_name,
4643 uint32_t *arg_num_ptr, void **cache_slot) {
4644 zend_execute_data *call = *call_ptr;
4645 zend_function *fbc = call->func;
4646 uint32_t arg_offset = zend_get_arg_offset_by_name(fbc, arg_name, cache_slot);
4647 if (UNEXPECTED(arg_offset == (uint32_t) -1)) {
4648 zend_throw_error(NULL, "Unknown named parameter $%s", ZSTR_VAL(arg_name));
4649 return NULL;
4650 }
4651
4652 zval *arg;
4653 if (UNEXPECTED(arg_offset == fbc->common.num_args)) {
4654 /* Unknown named parameter that will be collected into a variadic. */
4655 if (!(ZEND_CALL_INFO(call) & ZEND_CALL_HAS_EXTRA_NAMED_PARAMS)) {
4656 ZEND_ADD_CALL_FLAG(call, ZEND_CALL_HAS_EXTRA_NAMED_PARAMS);
4657 call->extra_named_params = zend_new_array(0);
4658 }
4659
4660 arg = zend_hash_add_empty_element(call->extra_named_params, arg_name);
4661 if (!arg) {
4662 zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
4663 ZSTR_VAL(arg_name));
4664 return NULL;
4665 }
4666 *arg_num_ptr = arg_offset + 1;
4667 return arg;
4668 }
4669
4670 uint32_t current_num_args = ZEND_CALL_NUM_ARGS(call);
4671 // TODO: We may wish to optimize the arg_offset == current_num_args case,
4672 // which is probably common (if the named parameters are in order of declaration).
4673 if (arg_offset >= current_num_args) {
4674 uint32_t new_num_args = arg_offset + 1;
4675 ZEND_CALL_NUM_ARGS(call) = new_num_args;
4676
4677 uint32_t num_extra_args = new_num_args - current_num_args;
4678 zend_vm_stack_extend_call_frame(call_ptr, current_num_args, num_extra_args);
4679 call = *call_ptr;
4680
4681 arg = ZEND_CALL_VAR_NUM(call, arg_offset);
4682 if (num_extra_args > 1) {
4683 zval *zv = ZEND_CALL_VAR_NUM(call, current_num_args);
4684 do {
4685 ZVAL_UNDEF(zv);
4686 zv++;
4687 } while (zv != arg);
4688 ZEND_ADD_CALL_FLAG(call, ZEND_CALL_MAY_HAVE_UNDEF);
4689 }
4690 } else {
4691 arg = ZEND_CALL_VAR_NUM(call, arg_offset);
4692 if (UNEXPECTED(!Z_ISUNDEF_P(arg))) {
4693 zend_throw_error(NULL, "Named parameter $%s overwrites previous argument",
4694 ZSTR_VAL(arg_name));
4695 return NULL;
4696 }
4697 }
4698
4699 *arg_num_ptr = arg_offset + 1;
4700 return arg;
4701 }
4702
start_fake_frame(zend_execute_data * call,const zend_op * opline)4703 static zend_execute_data *start_fake_frame(zend_execute_data *call, const zend_op *opline) {
4704 zend_execute_data *old_prev_execute_data = call->prev_execute_data;
4705 call->prev_execute_data = EG(current_execute_data);
4706 call->opline = opline;
4707 EG(current_execute_data) = call;
4708 return old_prev_execute_data;
4709 }
4710
end_fake_frame(zend_execute_data * call,zend_execute_data * old_prev_execute_data)4711 static void end_fake_frame(zend_execute_data *call, zend_execute_data *old_prev_execute_data) {
4712 zend_execute_data *prev_execute_data = call->prev_execute_data;
4713 EG(current_execute_data) = prev_execute_data;
4714 call->prev_execute_data = old_prev_execute_data;
4715 if (UNEXPECTED(EG(exception)) && ZEND_USER_CODE(prev_execute_data->func->common.type)) {
4716 zend_rethrow_exception(prev_execute_data);
4717 }
4718 }
4719
zend_handle_undef_args(zend_execute_data * call)4720 ZEND_API zend_result ZEND_FASTCALL zend_handle_undef_args(zend_execute_data *call) {
4721 zend_function *fbc = call->func;
4722 if (fbc->type == ZEND_USER_FUNCTION) {
4723 zend_op_array *op_array = &fbc->op_array;
4724 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
4725 for (uint32_t i = 0; i < num_args; i++) {
4726 zval *arg = ZEND_CALL_VAR_NUM(call, i);
4727 if (!Z_ISUNDEF_P(arg)) {
4728 continue;
4729 }
4730
4731 zend_op *opline = &op_array->opcodes[i];
4732 if (EXPECTED(opline->opcode == ZEND_RECV_INIT)) {
4733 zval *default_value = RT_CONSTANT(opline, opline->op2);
4734 if (Z_OPT_TYPE_P(default_value) == IS_CONSTANT_AST) {
4735 if (UNEXPECTED(!RUN_TIME_CACHE(op_array))) {
4736 init_func_run_time_cache(op_array);
4737 }
4738
4739 void *run_time_cache = RUN_TIME_CACHE(op_array);
4740 zval *cache_val =
4741 (zval *) ((char *) run_time_cache + Z_CACHE_SLOT_P(default_value));
4742
4743 if (Z_TYPE_P(cache_val) != IS_UNDEF) {
4744 /* We keep in cache only not refcounted values */
4745 ZVAL_COPY_VALUE(arg, cache_val);
4746 } else {
4747 /* Update constant inside a temporary zval, to make sure the CONSTANT_AST
4748 * value is not accessible through back traces. */
4749 zval tmp;
4750 ZVAL_COPY(&tmp, default_value);
4751 zend_execute_data *old = start_fake_frame(call, opline);
4752 zend_result ret = zval_update_constant_ex(&tmp, fbc->op_array.scope);
4753 end_fake_frame(call, old);
4754 if (UNEXPECTED(ret == FAILURE)) {
4755 zval_ptr_dtor_nogc(&tmp);
4756 return FAILURE;
4757 }
4758 ZVAL_COPY_VALUE(arg, &tmp);
4759 if (!Z_REFCOUNTED(tmp)) {
4760 ZVAL_COPY_VALUE(cache_val, &tmp);
4761 }
4762 }
4763 } else {
4764 ZVAL_COPY(arg, default_value);
4765 }
4766 } else {
4767 ZEND_ASSERT(opline->opcode == ZEND_RECV);
4768 zend_execute_data *old = start_fake_frame(call, opline);
4769 zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
4770 end_fake_frame(call, old);
4771 return FAILURE;
4772 }
4773 }
4774
4775 return SUCCESS;
4776 } else {
4777 if (fbc->common.fn_flags & ZEND_ACC_USER_ARG_INFO) {
4778 /* Magic function, let it deal with it. */
4779 return SUCCESS;
4780 }
4781
4782 uint32_t num_args = ZEND_CALL_NUM_ARGS(call);
4783 for (uint32_t i = 0; i < num_args; i++) {
4784 zval *arg = ZEND_CALL_VAR_NUM(call, i);
4785 if (!Z_ISUNDEF_P(arg)) {
4786 continue;
4787 }
4788
4789 zend_internal_arg_info *arg_info = &fbc->internal_function.arg_info[i];
4790 if (i < fbc->common.required_num_args) {
4791 zend_execute_data *old = start_fake_frame(call, NULL);
4792 zend_argument_error(zend_ce_argument_count_error, i + 1, "not passed");
4793 end_fake_frame(call, old);
4794 return FAILURE;
4795 }
4796
4797 zval default_value;
4798 if (zend_get_default_from_internal_arg_info(&default_value, arg_info) == FAILURE) {
4799 zend_execute_data *old = start_fake_frame(call, NULL);
4800 zend_argument_error(zend_ce_argument_count_error, i + 1,
4801 "must be passed explicitly, because the default value is not known");
4802 end_fake_frame(call, old);
4803 return FAILURE;
4804 }
4805
4806 if (Z_TYPE(default_value) == IS_CONSTANT_AST) {
4807 zend_execute_data *old = start_fake_frame(call, NULL);
4808 zend_result ret = zval_update_constant_ex(&default_value, fbc->common.scope);
4809 end_fake_frame(call, old);
4810 if (ret == FAILURE) {
4811 return FAILURE;
4812 }
4813 }
4814
4815 ZVAL_COPY_VALUE(arg, &default_value);
4816 if (ZEND_ARG_SEND_MODE(arg_info) & ZEND_SEND_BY_REF) {
4817 ZVAL_NEW_REF(arg, arg);
4818 }
4819 }
4820 }
4821
4822 return SUCCESS;
4823 }
4824
zend_free_extra_named_params(zend_array * extra_named_params)4825 ZEND_API void ZEND_FASTCALL zend_free_extra_named_params(zend_array *extra_named_params)
4826 {
4827 /* Extra named params may be shared. */
4828 zend_array_release(extra_named_params);
4829 }
4830
4831 #if defined(ZEND_VM_IP_GLOBAL_REG) && ((ZEND_VM_KIND == ZEND_VM_KIND_CALL) || (ZEND_VM_KIND == ZEND_VM_KIND_HYBRID))
4832 /* Special versions of functions that sets EX(opline) before calling zend_vm_stack_extend() */
_zend_vm_stack_push_call_frame_ex(uint32_t used_stack,uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)4833 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame_ex(uint32_t used_stack, uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
4834 {
4835 zend_execute_data *call = (zend_execute_data*)EG(vm_stack_top);
4836
4837 ZEND_ASSERT_VM_STACK_GLOBAL;
4838
4839 if (UNEXPECTED(used_stack > (size_t)(((char*)EG(vm_stack_end)) - (char*)call))) {
4840 EX(opline) = opline; /* this is the only difference */
4841 call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
4842 ZEND_ASSERT_VM_STACK_GLOBAL;
4843 zend_vm_init_call_frame(call, call_info | ZEND_CALL_ALLOCATED, func, num_args, object_or_called_scope);
4844 return call;
4845 } else {
4846 EG(vm_stack_top) = (zval*)((char*)call + used_stack);
4847 zend_vm_init_call_frame(call, call_info, func, num_args, object_or_called_scope);
4848 return call;
4849 }
4850 } /* }}} */
4851
_zend_vm_stack_push_call_frame(uint32_t call_info,zend_function * func,uint32_t num_args,void * object_or_called_scope)4852 static zend_always_inline zend_execute_data *_zend_vm_stack_push_call_frame(uint32_t call_info, zend_function *func, uint32_t num_args, void *object_or_called_scope) /* {{{ */
4853 {
4854 uint32_t used_stack = zend_vm_calc_used_stack(num_args, func);
4855
4856 return _zend_vm_stack_push_call_frame_ex(used_stack, call_info,
4857 func, num_args, object_or_called_scope);
4858 } /* }}} */
4859 #else
4860 # define _zend_vm_stack_push_call_frame_ex zend_vm_stack_push_call_frame_ex
4861 # define _zend_vm_stack_push_call_frame zend_vm_stack_push_call_frame
4862 #endif
4863
4864 #ifdef ZEND_VM_TRACE_HANDLERS
4865 # include "zend_vm_trace_handlers.h"
4866 #elif defined(ZEND_VM_TRACE_LINES)
4867 # include "zend_vm_trace_lines.h"
4868 #elif defined(ZEND_VM_TRACE_MAP)
4869 # include "zend_vm_trace_map.h"
4870 #endif
4871
4872 #define ZEND_VM_NEXT_OPCODE_EX(check_exception, skip) \
4873 CHECK_SYMBOL_TABLES() \
4874 if (check_exception) { \
4875 OPLINE = EX(opline) + (skip); \
4876 } else { \
4877 ZEND_ASSERT(!EG(exception)); \
4878 OPLINE = opline + (skip); \
4879 } \
4880 ZEND_VM_CONTINUE()
4881
4882 #define ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION() \
4883 ZEND_VM_NEXT_OPCODE_EX(1, 1)
4884
4885 #define ZEND_VM_NEXT_OPCODE() \
4886 ZEND_VM_NEXT_OPCODE_EX(0, 1)
4887
4888 #define ZEND_VM_SET_NEXT_OPCODE(new_op) \
4889 CHECK_SYMBOL_TABLES() \
4890 OPLINE = new_op
4891
4892 #define ZEND_VM_SET_OPCODE(new_op) \
4893 CHECK_SYMBOL_TABLES() \
4894 OPLINE = new_op; \
4895 ZEND_VM_INTERRUPT_CHECK()
4896
4897 #define ZEND_VM_SET_RELATIVE_OPCODE(opline, offset) \
4898 ZEND_VM_SET_OPCODE(ZEND_OFFSET_TO_OPLINE(opline, offset))
4899
4900 #define ZEND_VM_JMP_EX(new_op, check_exception) do { \
4901 if (check_exception && UNEXPECTED(EG(exception))) { \
4902 HANDLE_EXCEPTION(); \
4903 } \
4904 ZEND_VM_SET_OPCODE(new_op); \
4905 ZEND_VM_CONTINUE(); \
4906 } while (0)
4907
4908 #define ZEND_VM_JMP(new_op) \
4909 ZEND_VM_JMP_EX(new_op, 1)
4910
4911 #define ZEND_VM_INC_OPCODE() \
4912 OPLINE++
4913
4914
4915 #define ZEND_VM_REPEATABLE_OPCODE \
4916 do {
4917 #define ZEND_VM_REPEAT_OPCODE(_opcode) \
4918 } while (UNEXPECTED((++opline)->opcode == _opcode)); \
4919 OPLINE = opline; \
4920 ZEND_VM_CONTINUE()
4921 #define ZEND_VM_SMART_BRANCH(_result, _check) do { \
4922 if ((_check) && UNEXPECTED(EG(exception))) { \
4923 OPLINE = EX(opline); \
4924 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
4925 if (_result) { \
4926 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4927 } else { \
4928 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4929 } \
4930 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
4931 if (!(_result)) { \
4932 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4933 } else { \
4934 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4935 } \
4936 } else { \
4937 ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
4938 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
4939 } \
4940 ZEND_VM_CONTINUE(); \
4941 } while (0)
4942 #define ZEND_VM_SMART_BRANCH_JMPZ(_result, _check) do { \
4943 if ((_check) && UNEXPECTED(EG(exception))) { \
4944 OPLINE = EX(opline); \
4945 } else if (_result) { \
4946 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4947 } else { \
4948 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4949 } \
4950 ZEND_VM_CONTINUE(); \
4951 } while (0)
4952 #define ZEND_VM_SMART_BRANCH_JMPNZ(_result, _check) do { \
4953 if ((_check) && UNEXPECTED(EG(exception))) { \
4954 OPLINE = EX(opline); \
4955 } else if (!(_result)) { \
4956 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4957 } else { \
4958 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4959 } \
4960 ZEND_VM_CONTINUE(); \
4961 } while (0)
4962 #define ZEND_VM_SMART_BRANCH_NONE(_result, _check) do { \
4963 ZVAL_BOOL(EX_VAR(opline->result.var), _result); \
4964 ZEND_VM_NEXT_OPCODE_EX(_check, 1); \
4965 ZEND_VM_CONTINUE(); \
4966 } while (0)
4967 #define ZEND_VM_SMART_BRANCH_TRUE() do { \
4968 if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
4969 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4970 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
4971 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4972 } else { \
4973 ZVAL_TRUE(EX_VAR(opline->result.var)); \
4974 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
4975 } \
4976 ZEND_VM_CONTINUE(); \
4977 } while (0)
4978 #define ZEND_VM_SMART_BRANCH_TRUE_JMPZ() do { \
4979 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4980 ZEND_VM_CONTINUE(); \
4981 } while (0)
4982 #define ZEND_VM_SMART_BRANCH_TRUE_JMPNZ() do { \
4983 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4984 ZEND_VM_CONTINUE(); \
4985 } while (0)
4986 #define ZEND_VM_SMART_BRANCH_TRUE_NONE() do { \
4987 ZVAL_TRUE(EX_VAR(opline->result.var)); \
4988 ZEND_VM_NEXT_OPCODE(); \
4989 } while (0)
4990 #define ZEND_VM_SMART_BRANCH_FALSE() do { \
4991 if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPNZ|IS_TMP_VAR))) { \
4992 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
4993 } else if (EXPECTED(opline->result_type == (IS_SMART_BRANCH_JMPZ|IS_TMP_VAR))) { \
4994 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
4995 } else { \
4996 ZVAL_FALSE(EX_VAR(opline->result.var)); \
4997 ZEND_VM_SET_NEXT_OPCODE(opline + 1); \
4998 } \
4999 ZEND_VM_CONTINUE(); \
5000 } while (0)
5001 #define ZEND_VM_SMART_BRANCH_FALSE_JMPZ() do { \
5002 ZEND_VM_SET_OPCODE(OP_JMP_ADDR(opline + 1, (opline+1)->op2)); \
5003 ZEND_VM_CONTINUE(); \
5004 } while (0)
5005 #define ZEND_VM_SMART_BRANCH_FALSE_JMPNZ() do { \
5006 ZEND_VM_SET_NEXT_OPCODE(opline + 2); \
5007 ZEND_VM_CONTINUE(); \
5008 } while (0)
5009 #define ZEND_VM_SMART_BRANCH_FALSE_NONE() do { \
5010 ZVAL_FALSE(EX_VAR(opline->result.var)); \
5011 ZEND_VM_NEXT_OPCODE(); \
5012 } while (0)
5013
5014 #ifdef __GNUC__
5015 # define ZEND_VM_GUARD(name) __asm__("#" #name)
5016 #else
5017 # define ZEND_VM_GUARD(name)
5018 #endif
5019
5020 #define UNDEF_RESULT() do { \
5021 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) { \
5022 ZVAL_UNDEF(EX_VAR(opline->result.var)); \
5023 } \
5024 } while (0)
5025
5026 #ifdef ZEND_VM_HYBRID_JIT_RED_ZONE_SIZE
5027 /* This callback disables optimization of "vm_stack_data" variable in VM */
5028 void (*zend_touch_vm_stack_data)(void *vm_stack_data) = NULL;
5029 #endif
5030
5031 #include "zend_vm_execute.h"
5032
zend_set_user_opcode_handler(zend_uchar opcode,user_opcode_handler_t handler)5033 ZEND_API zend_result zend_set_user_opcode_handler(zend_uchar opcode, user_opcode_handler_t handler)
5034 {
5035 if (opcode != ZEND_USER_OPCODE) {
5036 if (handler == NULL) {
5037 /* restore the original handler */
5038 zend_user_opcodes[opcode] = opcode;
5039 } else {
5040 zend_user_opcodes[opcode] = ZEND_USER_OPCODE;
5041 }
5042 zend_user_opcode_handlers[opcode] = handler;
5043 return SUCCESS;
5044 }
5045 return FAILURE;
5046 }
5047
zend_get_user_opcode_handler(zend_uchar opcode)5048 ZEND_API user_opcode_handler_t zend_get_user_opcode_handler(zend_uchar opcode)
5049 {
5050 return zend_user_opcode_handlers[opcode];
5051 }
5052
zend_get_zval_ptr(const zend_op * opline,int op_type,const znode_op * node,const zend_execute_data * execute_data)5053 ZEND_API zval *zend_get_zval_ptr(const zend_op *opline, int op_type, const znode_op *node, const zend_execute_data *execute_data)
5054 {
5055 zval *ret;
5056
5057 switch (op_type) {
5058 case IS_CONST:
5059 ret = RT_CONSTANT(opline, *node);
5060 break;
5061 case IS_TMP_VAR:
5062 case IS_VAR:
5063 case IS_CV:
5064 ret = EX_VAR(node->var);
5065 break;
5066 default:
5067 ret = NULL;
5068 break;
5069 }
5070 return ret;
5071 }
5072
